Kudaro is a placard on a shop counter. A customer taps it with their phone, or scans the code printed on it, and Kudaro’s server decides where to send them — normally that shop’s Google review page, sometimes a punch card.
This page says what that collects. It is written for the person at the counter and the person who owns the shop, so it names the actual fields and the actual companies rather than describing a category of practice.
The two addresses
kudaro.link is what the placard opens. It is the tap surface and nothing else: no sign-in, no session, and no analytics or advertising script of any kind. A tap that only leads to a review sets no cookie; a phone that uses a punch card gets the two cookies described below.
kudaro.app is the marketing site, the business owner’s dashboard, the reseller’s app, and this page. Signing in there sets a session cookie, which is what keeps you signed in and does nothing else.
Kudaro loads no third-party analytics or advertising scripts on either address, and it does not sell anything described on this page to anyone.
If you only tapped the placard
The ordinary tap sends you to the business’s Google review page. It asks you for nothing and it stores nothing about you.
What Kudaro records is one row about the tap, not about you: which placard was tapped, the time, whether it resolved, and — if something was wrong — why it did not. That is the entire record. No IP address, no device identifier, no browser fingerprint, nothing that links one tap to the next.
This is what a business owner sees as “twelve taps on Tuesday”. It is counting for one shop, and it cannot tell that shop, or Kudaro, who any of those people were.
Once you land on Google, you are on Google. What happens there is covered by Google’s privacy policy, not this one.
Your phone number
There is exactly one place Kudaro asks for a phone number: the punch card. If the shop runs one and you want your punches kept, you type your number. Nothing about you exists in Kudaro until you do — and leaving a review never needs it.
Your number is stored twice, in two forms, and neither of them is a readable number:
- Encrypted, with AES-256-GCM, under a key that lives outside the database. This is the copy that would let us text you, if you asked us to.
- A separate one-way keyed hash, which is what every lookup in the system actually matches on. It is what finds your card when you come back next week.
Your number is never written into a log line, an error message, or the page you are looking at — the punch screen makes you retype it rather than echoing it back, on purpose. Those are rules the code enforces on itself, not habits.
One card exists per phone number per business. Kudaro can tell that the same number holds cards at two shops; the shops cannot see each other’s cards.
Marketing texts, and the box you did not have to tick
When you enter your code on a punch card there is an unchecked box offering texts with offers from that shop and from Kudaro. It is a separate control from the button that saves your punch, and the punch never waits on it.
Ticking it is not a condition of earning a punch, getting a reward, or buying anything. Leaving it alone costs you nothing at all.
If you do tick it, two things are recorded on your card: the moment you ticked it, and a version identifier naming the exact sentence you agreed to. The sentence itself is frozen — if the wording ever changes, that is a new version with a new identifier, and yours keeps pointing at the words you actually read.
Kudaro is not sending marketing texts yet. Today the only text message this system can send you is a verification code, described next. If that changes, this consent is what it will rely on, every message will say how to stop, and replying STOP will stop them.
Verification codes
To prove a phone number belongs to the person holding the phone, Kudaro can text a one-time code through Twilio Verify. You type the code back; Twilio answers approved or denied. Kudaro never receives the code itself, and there is nowhere in the system it could be stored.
The code we text when you save a card
When you add your number to a punch card for the first time, Kudaro texts that number a one-time code. The button you press says so, right under it. Typing the code back proves the phone is yours, and that is what saves your card: until then your first punch is held for 24 hours, and if the code is never entered, nothing is kept. Agreeing to offers by text is a separate box, and your card never depends on it.
Kudaro keeps a record that you asked for the code: the time, the exact notice that was on the screen, the page address, your browser’s description of itself, and a scrambled form of your network address that cannot be turned back into it. That record is deleted after 30 days.
How this phone remembers your card
After a correct code, Kudaro sets one cookie on kudaro.link. It holds a random value and nothing else: not your number, not your card. Kudaro keeps only a scrambled copy of that value, so even our own database cannot recreate the cookie.
With it, this phone does not have to type your number again, at this shop or at any other shop that uses Kudaro. It stops working after 45 days without a visit, and 180 days after your last code, whichever comes first. A reward on a remembered phone needs a code again once the last one is more than 90 days old. “Not you?” on the card page forgets this phone straight away. Only one phone is remembered for a number at a time: confirming a code on another phone forgets the earlier one.
Proving your number is shared across shops. Agreeing to texts is not. A shop can only text you offers if you ticked that shop’s own box, on that shop’s page. The sentence you agreed to, with the shop’s name as it was shown, is stored with your card.
Limits on codes
Kudaro only texts US numbers, and limits how many codes go to one number, from one network, and from one shop. Those counters are keyed so that they cannot be linked back to you. They outlive a deletion request until their month ends, so asking to be forgotten cannot be used to reset them, and then they are deleted too.
Your punch card and rewards
A card holds your punch count, when it was last punched, and the rewards released against it. Two limits sit on it, and both are per phone number at that one shop:
- One punch per day. This keeps the count meaning something.
- A monthly cap on rewards, set by the shop owner, which starts at two. The owner pays for the reward, so the owner sets how many leave their counter.
A reward is a short-lived code shown on your phone, which someone at the counter confirms. It expires — the shop chooses how fast, ten minutes by default — and Kudaro keeps the record that it was released.
Location, and when Kudaro asks for it
Your first punch at a shop never asks. After that, adding a punch asks your browser where it is, once, to check that you are at the shop and not on the sofa with a saved link. If you refuse, that punch is not added; nothing else changes, and the page says how to allow it next time. Kudaro also checks the time against the opening hours the shop set, without asking you anything.
Your position is compared with the shop’s pin and discarded. What is kept, for 180 days, about each punch decision: whether it was added and why not, how far you were from the shop in metres only if that was under 2 km, how precise the phone said its position was, a keyed fingerprint of the exact reading (so an identical reading used twice can be recognised, without the reading itself being kept), the distance in kilometres between the shop and the area your internet connection is registered to, and a keyed fingerprint of that connection. None of these can be turned back into where you were.
A second small cookie remembers the browser, not you or your number, so that one phone cannot collect two punches in one visit by switching numbers. It is HttpOnly, works only on kudaro.link, and Kudaro stores only a one-way hash of it.
Separately, when Kudaro’s own checks flag a reward confirmation as unusual, the confirm button asks your browser for your location first.
You can refuse, and the reward is released anyway. A refusal, a phone that cannot answer, a slow prompt, a timeout — all of them go through. Nothing about this blocks a reward, by design, because a customer standing at a counter should not lose a free coffee to a permission dialog.
If your browser does return a position, it is compared against the shop’s address in memory and then discarded. It is not stored and not logged. What is kept is a single word — near, far, denied, or unavailable — for a human at Kudaro to read later if something looks wrong.
If you own a business that uses Kudaro
Kudaro holds, about you and your shop:
- Your sign-in email. The address itself lives with Supabase, which runs sign-in. Kudaro’s own database stores only a keyed hash of it, used to notice when two accounts are being opened on one address.
- Your business name, address, Google Place ID, review link, and counter coordinates, taken from Google’s own listing for your shop when the account is set up, and re-read from Google at least every 30 days. The coordinates are what the location checks above compare against; if you set the pin yourself from your dashboard, yours is kept instead. Your opening hours, if you enter them, decide when punches can be added.
- Your subscription and payment status, from Stripe. Card details are collected and held by Stripe on Stripe’s pages. Kudaro never sees or stores a card number.
- A shipping address, if you ordered placards, so someone can pack the box.
- Counts. Taps, punches, rewards, and the like, for your own shop only.
Kudaro emails you a summary on Mondays. Every one carries an unsubscribe link, and the link works without signing in — a “stop emailing me” behind a login wall is not one.
If you ask us to contact you. The “Get started” form asks for your shop’s name, city and state, your name, your email address, a phone number if you choose to give one, and which plan interests you. Kudaro keeps those details and shows them to its own staff so a person can email you about getting set up. Sending the form does not create an account or charge you, and nothing is emailed to you automatically. To stop abuse of the form, Kudaro also records the IP address each attempt came from, and deletes those records automatically after a day. Email support@kudaro.app to have your details removed.
If you sell Kudaro
Kudaro keeps a reseller’s name, email address, the businesses they signed and the commission owed on them, and a record of each version of the reseller agreement they accepted: when, from which IP address and browser, and the exact words of the box they ticked. If you order placard stock, the shipping address for that order too. The reseller agreement covers the commercial side; this page covers the data.
The beta waitlist. If you join the reseller waitlist on the resellers page, Kudaro keeps the email address you typed, and your name, city and state if you gave them, to contact you about becoming a reseller. Nothing is sent automatically and no account is created. To stop abuse of the form, Kudaro also records the IP address each attempt came from, and deletes those records automatically after a day. Email support@kudaro.app to be taken off the list.
Your date of birth. Kudaro resellers must be 18 or older. You are asked for your date of birth when you sign up, or the next time you accept the agreement if you joined before Kudaro asked. It is used once, to check whether you are 18 or older, and is not kept. If you are under 18, signup stops there: no reseller account is created. The email address you typed to get your sign-up link is still kept in two places — Kudaro’s record that a link was requested (it stops working after 65 minutes) and the sign-in account Supabase creates to send that link. Neither is deleted automatically; email support@kudaro.app and both will be. If you are 18 or over, nothing about your age is stored except that you answered. If you joined before Kudaro asked and the date you give shows you are under 18, Kudaro stores one date, your 18th birthday, so Kudaro staff can see that. That date reveals your birthday, so it is treated like one: it is never written to logs, and only Kudaro staff can see it. Kudaro does not collect ID from you; Stripe asks for and checks identity when you set up payouts, under its own privacy policy.
Companies that handle this data for Kudaro
- Stripe — payments, subscriptions, and card details. Kudaro never holds a card number.
- Supabase — sign-in for owner, reseller, and staff accounts. It holds email addresses and sign-in state, and knows nothing about customers or punch cards.
- Neon — the Postgres database everything described above is stored in.
- Twilio — the verification text, through Twilio Verify.
- Resend — outbound email: sign-in links, the Monday summary, and Kudaro’s internal alerts.
- Google — two separate roles. Google Places supplies a shop’s name, address, and coordinates when the account is set up, and Google is where a tap normally sends a customer. No customer information is sent to Google by Kudaro.
- Vercel — hosting. Requests pass through it and it keeps ordinary server logs, which Kudaro does not use to build any record described on this page.
How long things are kept
Kudaro deletes the records of each punch’s location check after 180 days. Besides that and the day-old IP records of the two public forms described above, there is one automatic deletion. Once a day, a scheduled job deletes any request for a parent or guardian to accept the reseller agreement that expired more than a day earlier, together with the name and email stored with it. Kudaro no longer sends those requests, because resellers must be 18 or older, so the job normally finds nothing. Otherwise there is no automatic deletion schedule, and saying otherwise would be describing something that does not exist. Sign-up link records and sign-in accounts are not deleted automatically. Punch cards, taps, rewards, and account records persist while the business is a customer, and a reseller’s agreement acceptances persist with their account.
If you want your punch card and the phone number behind it deleted, email support@kudaro.app and say which shop it was, and Kudaro will delete it. A business owner can ask for the same on their own account.
Your choices, in one place
- Never give a number at all. Leaving a review never asks for one.
- Leave the marketing box unticked. Your punch lands either way.
- Reply STOP to any marketing text, once Kudaro sends any.
- Use the unsubscribe link in any Kudaro email.
- Refuse the location prompt. A reward is released regardless. A punch after your first at a shop is not added without it.
- Ask for deletion at support@kudaro.app.
Children
Kudaro is sold to businesses and is not directed at children. Kudaro does not knowingly keep a punch card for anyone under 13. If you believe one exists, email support@kudaro.app and it will be deleted. Resellers must be 18 or older, and Kudaro does not accept new resellers under 18. A parent or guardian can ask to correct or delete what Kudaro holds about their child at the same address.
Changes to this page
When this page changes, the date under the title changes with it. Because the address of this page is written into a consent disclosure customers have already agreed to, the address itself does not move.
Contact
support@kudaro.app. If you are a customer, tell us which shop you tapped — Kudaro finds a card by shop and phone number, and cannot look you up any other way.