Privacy Policy

Who we are

These services are provided by HandyCafe, LLC ("HandyCafe", "we", "us"). This policy covers the HandyCafe app for cafe customers, the HandyCafe Manager app for operators, the desktop software (HandyCafe Server, HandyCafe Client, HandyCafe Gateway, HandyCafe Gateway Manager), the customer dashboard (dashboard.handycafe.com), the cloud services they connect to and this website. Use of the software is also governed by our End User License Agreement.

Cafe data and our role

When a cafe uses HandyCafe, its members, sessions, sales, devices and network logs are stored on the cafe's own server. The cafe operator is the controller of that data. It reaches us only for the cloud features the operator turns on, and we process it on the operator's behalf to provide the service. If you are a customer of a cafe, contact that cafe first about this data.

Information we collect

HandyCafe (customer app)

• Your mobile phone number, which is your account identity (used to sign you in with a one-time code).
• A display name, and optionally an email address and a profile photo that you choose to add.
• Your activity within the service: cafe sessions and balances, reservations, tournaments, favourites, community posts and messages. For memberships linked to the app, the cafe sends us your name, username, balance, level and recent session, transaction and app usage records.
• Basic device and log information needed to operate the service securely, and push notification tokens.

HandyCafe Manager and the customer dashboard (operators)

• The operator account email address and password (stored hashed), or Google sign-in.
• For remote management, data passed from the cafe server to the app: members, reports, earnings, stock, logs and, when requested, screenshots of the server screen and consoles. These pass through our cloud connection.

Desktop software

• License activation and checks: the license key, an installation ID, the version and a hardware fingerprint (machine ID, network card MAC addresses, processor, operating system, computer name, memory, and disk and motherboard serial numbers). Regular checks also send client counts, version, operating system, language, local time, uptime and the server's local network IP addresses. We record the connecting IP address and user agent.
• Gateway Manager account: email, password, a two-step verification code if used, a device name that includes the computer name, and the gateway's ID.
• Usage statistics (telemetry): while licensed, HandyCafe Server sends daily and monthly summaries as part of the service; this cannot be turned off in the app. They include revenue and expenses, session counts and minutes, occupancy and hourly patterns, the most used apps, games and products, new and active member counts, campaign and package setup (including names and descriptions the operator wrote), prices, hardware classes, time zone, country and, if the operator entered it, the cafe's location. When reservations are on, each computer's MAC address, name and price are sent too. Daily totals of the most visited domains across the whole cafe (not per person) are also sent; this can be turned off in settings. Telemetry does not include individual member identities.
• Updates: the software asks our download server for new versions. No identifiers are sent; the server only sees the IP address, version and user agent.
• Diagnostic logs (optional): if the operator turns this on, warning and error logs of the server and stations are sent with secrets masked. It is off by default. Gateway Manager keeps its logs on the computer; we only see a diagnostics package if you save it and send it to us.
• Cloud features (where your plan includes them): cloud backup (a full copy of the cafe database), member, session and transaction sync, the cafe profile (contact details, social links, opening hours), reservations and tournaments.
• AI assistant: questions asked to the assistant are sent to us with the statistics summary needed to answer them. In the station chat feature, the messages customers type take the same path.

This website

• Essential cookies such as your language choice. Analytics cookies (Google Tag Manager) load only if you accept them in the cookie banner.
• What you write in contact and support forms. Forms are protected against abuse with Cloudflare Turnstile.

How we use information

• To create and secure accounts and sign you in.
• To verify licenses, enforce license limits and prevent misuse.
• To provide app and software features: sync, backup, remote management, reservations, tournaments, payments and the AI assistant.
• To use telemetry to give operators reports and suggestions, improve our products and produce anonymous per-country benchmarks. A benchmark figure is never shown unless at least 20 cafes contribute to it.
• To provide support, fix errors and keep the service reliable and safe.

We do not sell your personal data, we do not use it for advertising, and we do not track you across other companies' apps or websites.

Service providers

We share the minimum data needed with providers that operate the service on our behalf, under contract:

• Akamai (Linode) and Amazon Web Services: servers, database and DNS.
• Bunny.net: downloads, media files and cloud backups (backups are stored in Frankfurt, Germany by default).
• Twilio, Sinch and Netgsm (Turkey): SMS verification codes.
• Google Firebase and Apple: push notifications.
• Mailgun: sending email.
• AI providers such as OpenAI and Anthropic: assistant and support replies.
• Google (website analytics, only with your consent) and Cloudflare (form protection).

Some features connect directly to third parties with the cafe's own account and are governed by their policies: payments with Stripe, PayTR and Ödeal, e-invoices and receipts with Facturapi and Checkbox, console pairing with Sony PlayStation Network, ban checks with Steam, and the dynamic DNS provider the operator chooses.

Data retention and account deletion

• License audit records (IP, device fingerprint): 365 days.
• Diagnostic logs: 30 days.
• Cloud backups: the last 50 backups, up to 60 days.
• Account and cafe data: while the account or license is active. Afterwards it is deleted or anonymised unless the law requires us to keep it.

You can delete your account and personal data at any time from Account → Delete account in the HandyCafe app, which permanently removes your cloud profile and associated personal data. You may also request deletion by contacting us at the address below.

Children

The apps are rated 4+ and are not directed to children, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will remove it.

Security and international transfers

We protect data in transit with encryption (HTTPS/TLS) and apply reasonable safeguards. Our servers and providers may be located in countries other than yours, in particular the United States and the European Union. Where we transfer data internationally we take steps to protect it.

Your rights

You may access, correct or delete your personal data, object to its processing and withdraw consent. The laws where you live (for example the GDPR or KVKK) may give you further rights. To exercise them, use the in-app controls or contact us. For cafe data, contact the cafe first.

Changes

We may update this policy from time to time. Material changes will be reflected here with a new "last updated" date.