Privacy Policy

Effective date: 14 August 2026 Last updated: 14 August 2026 App: ExtraHelper (iOS and Android) Developer: D. Raj Gurung Contact: divy5831@gmail.com

This Privacy Policy describes how ExtraHelper (“the app,” “we,” “our,” or “us”) handles information when you use the application.

ExtraHelper is a workplace tool. It is used by restaurant staff to take orders, send tickets to the kitchen, print bills, and count stock. It is not a consumer app, and it is not intended for use by the general public or by children.

1. Who controls your data

ExtraHelper accounts are created and managed by the restaurant that employs you, not by us. That restaurant decides who has an account, what role each person holds, and what happens to the records its staff create.

In data protection terms, the restaurant is the controller of the information in its workspace. We operate the software on the restaurant’s behalf as a processor. If you are a staff member and you want your personal information corrected or removed, speak to the restaurant’s owner or manager first — they control the account. You may also contact us at the address above and we will assist.

2. Information we handle

2.1 Account information

Email address — used to sign you in and to identify you to your team.
Password — never stored in readable form. Authentication is handled by Supabase, and passwords are stored only as salted hashes.
Display name and role — for example Owner, Manager, or Staff, set by your restaurant.
User ID — a random identifier that links your actions to your account.

2.2 Operational records you create

While doing your job in the app, you create business records such as:

Orders, order items, custom items, and their prices
Table and floor status
Kitchen tickets and their routing between stations
Bills, payments, and receipt history
Store room counts and inventory adjustments
Manager log entries and shift notes

These records belong to the restaurant. They describe restaurant operations, not your private life. Where a record shows who performed an action, that is deliberate — it is how a restaurant maintains accountability over cash and stock.

2.3 Guest information

ExtraHelper is designed so that restaurant guests stay anonymous. We do not ask you to record a guest’s name, phone number, email, or payment card details, and the app provides no field for them. Payment QR codes printed on a bill are generated from the restaurant’s own payment details, not the guest’s.

If a member of staff types personal information about a guest into a free-text field such as an order note, that text is stored like any other order data. Please don’t do this.

3. Device permissions

The app asks for the following permissions. Each is used for one narrow purpose, and you can decline any of them and still use the rest of the app.

Camera — to scan barcodes and QR codes on item labels during a store room count. Frames are processed on the device to read the code. Images are never saved, never uploaded, and never leave your phone. You can always search for an item by name instead.
Bluetooth — to discover and connect to a nearby thermal printer so the app can print bills and kitchen tickets. Used only for printing. We do not use Bluetooth for location, presence detection, proximity marketing, or analytics.
Local network — to send print jobs to a thermal printer on the same WiFi network. Used only for printing. The app does not scan the network for any other purpose.

4. Where your data is stored

Account and operational data are stored in a Supabase project operated by us on the restaurant’s behalf. Supabase provides the database and authentication infrastructure and hosts it on cloud servers. Access is enforced by row-level security so that a restaurant’s staff can reach only that restaurant’s records.

The app also keeps a local copy on your device so it keeps working when the internet drops. This cache lives in the app’s private storage, is not readable by other apps, and syncs back to the server once you are online again. Signing out or deleting the app removes it.

Data transmitted between the app and the server is encrypted in transit using HTTPS.

5. What we do not do

We do not include advertising SDKs. The app shows no ads.
We do not include third-party analytics or tracking SDKs.
We do not track you across other apps or websites, and we do not use the iOS Advertising Identifier.
We do not sell, rent, or lease any information to anyone, ever.
We do not collect your location. The app has no location permission.
We do not access your contacts, photo library, microphone, calendar, or health data.

We share information only in these situations:

With your restaurant. Your colleagues and managers see the records you create, according to the role your restaurant assigned you.
With infrastructure providers. Supabase stores the data so the service can run. It acts on our instructions and does not use the data for its own purposes.
When legally required. If we receive a valid legal order, we may have to disclose information. We will tell the affected restaurant unless the law forbids it.

7. Retention and deletion

Operational records are kept for as long as the restaurant maintains its account, because businesses need historical sales and stock records.

To delete your account, ask your restaurant’s owner or manager to remove you, or email us at divy5831@gmail.com and we will action the request within 30 days. When an entire restaurant closes its account, its data is deleted within 90 days of the request.

Note that deleting a staff account does not erase the restaurant’s sales history. Orders remain as business records; the personal account attached to them is removed.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. Email us and we will help. Because your restaurant controls the workspace, we may need to route the request through them.

9. Children

ExtraHelper is a workplace tool for restaurant staff. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, contact us and we will remove it.

10. Changes to this policy

If we change this policy we will update the “Last updated” date above. Material changes will be communicated to account owners by email.

11. Contact

Questions about this policy, or about how your data is handled:

D. Raj Gurung divy5831@gmail.com