PEBBLE MANAGER

Privacy Policy

Effective September 9, 2026

Pebble Manager and its customer-facing companion, Pebble Coffee (together, “Pebble”), help a coffee-cart manager maintain customer tabs, inventory, expenses, orders, notifications, and an optional Google Calendar order calendar. This policy explains what information Pebble handles and why.

Information Pebble handles

• Account information: email address, display name, account identifier, and coffee-cart name used for authentication and account setup.
• Coffee-cart records: customers, invitation codes, menu and inventory information, expenses, tab transactions, balances, order details, pickup times, customer notes, and bug reports entered through the app.
• Notification information: browser push-subscription endpoints and related device keys when a user enables notifications.
• Google Calendar connection information: an encrypted OAuth refresh token, the identifier and name of the dedicated order calendar, and short-lived authorization state information.
• Device storage: cached app and coffee-cart information stored in the browser so the app can reopen and preserve changes while offline.

How information is used

Pebble uses this information only to provide its visible features: authenticating users, synchronizing coffee-cart records, calculating balances and inventory, processing and displaying orders, delivering requested notifications, responding to bug reports, and synchronizing the manager’s dedicated Google Calendar.

Pebble does not sell personal information, use it for advertising, or use Google user data to determine eligibility for credit or lending.

Coffee Chat phone numbers and payments

Coffee Chat accounts: Pebble stores an optional phone number that you can edit in account settings. It is not verified and is not used for receipt delivery. Square handles card details and processes Coffee Chat payments; Pebble stores payment identifiers, card brand and last four digits, itemized receipts, tax amounts, and refund and delivery status. Pebble does not store full card numbers or security codes. Receipt emails use Resend. Receipt information is available to you and the coffee-cart manager and is retained for business and tax records. These messages are requested transactional receipts, not marketing.

Google Calendar data

The manager’s Google Calendar connection is optional. Pebble requests calendar.app.created, calendar.calendarlist.readonly, and calendar.freebusy permissions. These permit Pebble to manage its dedicated order calendar, show your calendar list, and read busy time ranges from calendars you select. Busy ranges are stored securely to block pickup times and flag conflicting orders, with a 20-minute buffer before and after events. Personal event names and descriptions are not read. Customers receive availability information only, without calendar names or IDs. Pebble does not access Gmail.

Order events may contain the customer’s display name, ordered items, pickup time, order note, and status. Pebble sends this information to Google only to create and maintain the manager’s order calendar. The Google refresh token is encrypted before it is stored in Supabase and is decrypted only by the server function when calendar access is required.

When the manager disconnects Google Calendar, Pebble revokes the stored authorization, deletes its stored connection, and attempts to remove the dedicated order calendar. A customer’s “Add to Google Calendar” button opens a prefilled Google Calendar page; Pebble does not receive or retain access to that customer’s Google Account.

Pebble Manager’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Service providers and disclosures

Pebble uses Supabase for authentication, database storage, synchronization, and server functions; Google Calendar for the optional order calendar; browser push services for notifications; and GitHub Pages to host the static application. These providers may process information only as needed to operate their respective services and are governed by their own terms and privacy policies.

Information may also be disclosed when reasonably necessary to comply with law, protect users, investigate abuse or security problems, or preserve the operation of the service. Pebble does not otherwise share personal information with advertisers or data brokers.

Retention and deletion

Coffee-cart records remain until they are deleted through the app or removed by the project operator. Browser data remains until it is replaced, cleared, or the app is uninstalled. Google OAuth state records expire after approximately ten minutes. A Google Calendar connection remains until it is disconnected, revoked through the Google Account permissions page, or removed by the project operator.

To request deletion of an account or associated cloud records, contact the project operator using the address below. Some limited information may be retained when required for security, legal compliance, or recovery from backups.

Security

Pebble uses HTTPS, account authentication, database row-level access controls, server-only credentials, and encryption of stored Google refresh tokens. No system can guarantee perfect security, so users should protect their passwords and promptly report suspected unauthorized access.

Your choices

• You may decline or disable browser notifications.
• The manager may disconnect Google Calendar in Pebble settings or revoke Pebble from the Google Account permissions page.
• You may clear browser storage or uninstall the app to remove locally cached information.
• You may contact the project operator to request access, correction, or deletion of cloud information associated with your account.

Children’s privacy

Pebble is not directed to children under 13 and does not knowingly collect their personal information. Contact the project operator if you believe a child has provided personal information.

Changes to this policy

This policy may be updated as Pebble changes. The effective date at the top of this page will be revised when material updates are made.

Contact

Questions, requests, or privacy concerns may be sent to adinimos@gmail.com.