Privacy Policy
Last updated: April 30, 2026
Note on this document. This Privacy Policy is provided by Holy Toast LLC for informational purposes and to satisfy app-store and SMS-compliance disclosure requirements. It is not legal advice, and reading it does not create an attorney-client relationship. It was drafted with the assistance of AI tooling and reviewed by Holy Toast LLC personnel, but has not been reviewed by a licensed Florida attorney as of the "Last updated" date above. If you are relying on any specific clause for a legal decision, please consult your own counsel.
Holy Toast LLC ("Holy Toast," "we," "us," or "our") operates the Holy Toast mobile app (the "App") and the Holy Club loyalty program. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
By using the App, you agree to this Privacy Policy. If you don't agree, please don't use the App.
1. What we collect
Information you give us directly
- Account information. When you sign up, we collect your name and one of the following, depending on the sign-in method you choose:
- Email + password — the password is stored as a one-way bcrypt hash; we never see your plaintext password.
- Phone number — we send your number to Twilio Inc. to deliver a one-time SMS verification code (passwordless login). We do not store the code on our servers; Twilio holds it for the 10-minute verification window.
- Sign in with Apple — we receive the Apple-issued user identifier and, if you choose to share them, your name and a private-relay email. We never see your Apple ID password.
- Order details. Items you order, modifiers and special instructions you enter, the store you ordered from, your tip amount.
- Payment information. Processed entirely by Stripe, Inc. We do not store your full card number, CVV, or expiration on our servers. Stripe stores a token that lets us charge approved orders. See Stripe's Privacy Policy at https://stripe.com/privacy.
- Photos and captions you share through the in-app community feed.
- Referral codes you enter at sign-up or share with friends.
- Optional support messages you send us via email or in-app.
Information we collect automatically
- Device information. iOS version, device model, app version. Used to debug crashes and improve the experience.
- App usage analytics. Which screens you visit, which features you use, in aggregate. We do not track you across other apps or websites.
- Order activity timestamps for fraud prevention (e.g. detecting unusual ordering patterns).
Information we do NOT collect
- Location data beyond the store you select to order from. We do not track your physical location.
- Contacts. We do not access your phone's contact list.
- Microphone or camera except when you explicitly choose to take a photo for the community feed.
- Browsing or activity outside the App.
2. How we use your information
- Provide the service. Process your orders, calculate loyalty points and rewards, send order confirmations and verification codes.
- Communicate with you. Order receipts (sent by Stripe on our behalf), occasional product updates if you opt in.
- Improve the App. Aggregate analytics on which features are used, which surfaces have bugs.
- Prevent fraud. Detect fake accounts, abusive ordering patterns, and chargeback fraud.
- Comply with the law. Tax reporting, accounting, court orders.
We do not sell your personal information.
3. Who we share information with
We share information only with the following categories of recipients:
| Recipient | What | Why |
|---|---|---|
| Stripe, Inc. | Order amount, payment method token, your name and email for receipts | Process payments, send receipts |
| Twilio Inc. | Your phone number, country/region, verification code | Send SMS verification codes for passwordless login |
| Cloudflare, Inc. (R2 object storage) | Photos you upload to the community feed | Store images for the feed |
| Toast, Inc. (when integrated) | Your order items, special instructions, your first name | Route orders to our kitchen POS |
| Slack Technologies | Your first name + order details when you place an order | Notify our kitchen staff |
| Apple, Inc. | Crash reports (if you've opted in via iOS Settings → Privacy); Sign in with Apple identifier (if you used that method) | Diagnose app crashes; enable Sign in with Apple |
| Our hosting provider | Encrypted data backups | Operate the backend service |
We do not share your information with advertisers, data brokers, or third-party marketing services.
We may share information when legally required (subpoena, court order) or in connection with a sale or merger of our business — in which case we'll notify you in advance.
4. SMS messaging consent
By providing your phone number for verification, you consent to receive SMS messages from Holy Toast at that number for the purpose of authenticating your account. Message and data rates may apply. Message frequency is one verification code per sign-in attempt. We do not send marketing or promotional SMS under this consent.
You may stop receiving messages by replying STOP to any message you receive. Reply HELP for help. To opt out by other means, contact accounting@holytoast.com. We do not share your phone number with third parties for their marketing.
5. How long we keep information
| Data | Retention |
|---|---|
| Account information | As long as your account is active. Deleted within 30 days of your account-deletion request, except where retained for fraud prevention, tax, or legal compliance (max 7 years). |
| Order history | 7 years (Florida tax and accounting recordkeeping). |
| Photos in the community feed | Until you delete them, or you delete your account. |
| Payment tokens | Held by Stripe per their retention rules; we do not control these. |
| Server logs | 30 days unless investigating a specific incident. |
| SMS verification metadata | 30 days at Twilio; we retain only the timestamp of the request, not the code itself. |
6. How we protect your information
- Encryption in transit. All API calls use HTTPS (TLS 1.2+).
- Password storage. Bcrypt with strong cost factor; we never see your plaintext password.
- Access controls. Only our engineering team can access production data, with audit logging.
- No card data on our servers. Stripe handles card collection in their PCI-DSS Level 1 certified environment.
- Regular security review. We use industry-standard tools and review our code for security issues.
No system is perfectly secure. If we experience a security breach affecting your personal information, we will notify you in accordance with Florida Statutes § 501.171 — generally within 30 days of discovery, unless a law-enforcement delay applies — and any other applicable U.S. federal or state laws.
7. Your rights
You have the right to:
- Access the data we hold about you. Email us at
accounting@holytoast.comand we'll send you a copy within 30 days. We may need to verify your identity before responding (so we don't release your data to someone impersonating you). - Correct inaccurate information. Most fields can be edited in the App's Profile settings; email us for anything else.
- Delete your account and associated data, in-app: Profile → Delete Account. You can also email
accounting@holytoast.comwith the subject "Delete my account." We process within 30 days. Your name, email, phone number, and Apple identifier are removed; order history and points-ledger entries are retained for the 7-year window described in Section 5 in disconnected form (no longer linked to your identity). - Opt out of marketing emails. Click "Unsubscribe" on any marketing email; transactional emails (receipts, order updates, verification codes) you can't opt out of as long as you're using the App.
- Object to specific uses of your data. Email us; we'll respond within 30 days.
8. California residents (CCPA/CPRA)
If you reside in California, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) give you additional rights:
- Right to know what personal information we have collected about you (Section 1 of this policy).
- Right to delete your personal information (Section 7).
- Right to opt out of sale or sharing of your personal information. We do not sell or share personal information, so this right is moot for our practices, but you have it.
- Right to non-discrimination for exercising your rights — we will not deny service or charge different prices.
To exercise any of these rights, email accounting@holytoast.com with "California Privacy Request" in the subject line. We may verify your identity before responding.
9. EEA / UK residents (GDPR)
If you are in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply. Our legal bases for processing your personal data:
- Contract — to fulfill orders, manage your account, and operate the loyalty program.
- Consent — for SMS verification codes (which you can withdraw by deleting your account).
- Legitimate interest — for fraud prevention and basic analytics.
You have the right to access, rectify, delete, restrict processing, and port your data. You may also lodge a complaint with your local data-protection supervisory authority (in the UK, the ICO at ico.org.uk).
10. Children
The App is not directed to children under 13. We do not knowingly collect information from children under 13 (in compliance with the Children's Online Privacy Protection Act, "COPPA"). If you believe a child under 13 has provided us with information, contact accounting@holytoast.com and we'll delete it.
11. Changes to this policy
We may update this policy from time to time. Material changes will be flagged in the App with at least 14 days' notice before they take effect. Continued use after changes means you accept the updated policy. The "Last updated" date at the top of this page reflects the most recent revision.
12. Contact us
Questions about this policy? Email accounting@holytoast.com or write to:
Holy Toast LLC
Attn: Privacy
Miami, FL
(Mailing address pending — email is the fastest channel.)