Privacy policy

Skano has two kinds of user: the venue owner, who creates an account and manages the menu, and the guest, who opens the public menu from a QR code. Data is collected differently for each.

• Name and email — for the account and for signing in.
• Password — stored only as a hash (bcrypt); we never keep the plain text.
• Venue information: name, description, contact, address, opening hours, menu and prices. You enter this yourself and it appears on the public menu.
• Plan and subscription status.

A guest needs no account and we ask for no personal data. When a menu is opened we store an anonymous event:

• the event type (menu view or dish tap) and the time;
• the language and the device category (mobile / tablet / desktop);
• the table code, if the QR belongs to a table — and only when the code matches a real table of that venue.

IP addresses are not written to the database — they live in process memory only, for rate limiting, and are gone on restart. There are no analytics cookies and no third-party trackers on the guest side.

If a guest leaves a review we store the score and the comment text. The comment is a free field — do not put personal information in it.

We use exactly one cookie — the session token, and only for a signed-in owner. It is httpOnly (JavaScript cannot read it), lasts 7 days and is sent over a secure connection on HTTPS. There are no advertising cookies.

Uploaded images are processed on the server: resized, converted to WebP, and stripped of metadata including EXIF geolocation. Files are stored under a name tagged with the venue identifier, so one venue cannot delete another venue file by accident or on purpose.

• Email sender (Resend) — only for verification and password reset messages, when enabled.
• Object storage (S3-compatible) — for uploaded images, when enabled.
• Error monitoring (Sentry) — for diagnosing technical errors, when enabled.
• Payment provider — not integrated yet; we neither process nor store card details.

Data is kept while the account is active. You can delete the account from the dashboard at any time — the venue, menu, images, analytics and reviews go with it. Before deleting you can download a full export; the analytics export covers the last 90 days.

To request access, correction or deletion, write to us: hello@skano.app.