1. Who we are
- Legal entity: Cup Cup LLC
- Registered address: Baghramyan 59 Ave, Apt 28, Yerevan, Armenia
- Website: https://cupcup.am
- Privacy and support contact: info@cupcup.am
2. Information you provide
- Your first and last name when you join Cup Cup Club. A sign-in provider may supply a name to help fill these fields. New Club enrollment does not ask for a phone number; older profiles may still contain one.
- Your checkout name and phone number, selected drinks and customizations, quantities, pickup branch and pickup time option. The phone number is required to place an order.
- An optional order note, stored with your order and visible to staff fulfilling it. Please include only information needed to prepare your order.
- Your email address when you choose email-link sign-in or when Google or Apple supplies it during sign-in, including an Apple relay address where used. Provider profile information may include a name and profile-photo link. We do not ask for access to your photo library or contacts.
- Information you choose to send when contacting support or requesting account deletion, such as contact details, an order number or member code. Staff sign-in also uses email and password through Firebase Authentication; staff actions can create audit records with staff identifiers and reasons.
3. Account, order and loyalty information
The app creates an anonymous Firebase Authentication account when no existing session is available. Its user ID connects your activity to that account; it is not a hardware device identifier. You can use guest ordering without choosing a durable sign-in method.
If you choose Google, Sign in with Apple on supported iOS devices, or email-link sign-in, Firebase Authentication processes the credential and the identity information the provider supplies. It stores the sign-in association and account profile. Linking can preserve your current account ID; recovery can transfer supported guest activity to an existing account and records the association between the old and recovered account IDs.
We store order items, prices, amounts, payment method and status, pickup branch, order status, cancellation and refund information, timestamps and identifiers used to prevent duplicate orders and verify pickup. Checkout is currently pay-at-pickup. No active online bank integration collects payment-card numbers, CVVs or bank-account details through this app.
Club records include your member code, points balance, lifetime qualifying-spend and tier-status data, points earned or redeemed, adjustments, refunds and migration history. Legacy stamp, cup-count, free-drink and redemption records may remain and are processed when converting or reconciling earlier loyalty activity.
4. Notifications, device information and diagnostics
On supported native devices, notifications are optional. If you grant permission, the app registers device routing information with Expo Push Service and stores your Expo push token, a notification installation identifier, platform and app version with your account. Expo also processes its own installation identifier, the native Apple or Google push token and app/project identifiers. Order and reward notifications can include an order identifier, order number and pickup branch. Our constructed notification payloads do not include your name, phone number, email or order note. Delivery attempts and receipt results are stored for operational support, including attempts skipped because no token is registered.
A separate installation identifier accompanies backend calls for abuse prevention, independently of notification permission. Firebase App Check uses Apple App Attest or DeviceCheck and Google Play Integrity on configured native builds. Our backend processes IP addresses and uses pseudonymous identifiers derived from the account, installation or IP for rate limiting and operational correlation.
When Sentry error reporting is configured in the app build, diagnostic data can be sent automatically to Sentry. It includes JavaScript exceptions, native crash reports, stack traces, app version and build, environment, device and operating-system information, workflow breadcrumbs and reliability information such as app hangs and session health. Backend services also record request outcomes and durations. These features help us diagnose failures; the app currently has no individual diagnostics switch.
We disable default personally identifying information in Sentry, screenshots, view hierarchy attachments, session replay and sampled performance tracing/profiling. The JavaScript reporting path removes user/request context, replaces exception messages and filters workflow data. Native crash reporting uses separate SDK processing, so these JavaScript filters do not guarantee removal of every native message, network breadcrumb or SDK installation identifier. Diagnostic records may remain associated with an installation. Network providers can receive connection IP addresses and request metadata.
We do not integrate an advertising SDK or use advertising identifiers for cross-app advertising. We do not request your device GPS location; choosing a pickup branch is part of the order, not a device-location permission.
5. Information stored on your device
The app stores sign-in state, your cart and intended points redemptions, pending request identifiers, installation identifiers, notification-prompt state and language preference locally. The web sign-in flow may remember the email address awaiting link completion in browser storage. Native and browser sign-in storage, and service SDKs, can also retain credentials, registration state or queued diagnostic reports. Local app storage is not a promise that all information is encrypted at rest.
Deleting an account signs out the requesting client and clears its cart, pending request IDs, pending web email-link address, and Cup Cup push/security installation IDs after backend success. It does not reset device preferences, operating-system permissions, every service cache, or data on another device. The app then creates a fresh anonymous session. Device or browser controls can remove local app data; removing local data alone does not delete server records.
6. How we use information and our service providers
We use information to authenticate and recover accounts, prepare and hand off orders, operate loyalty, deliver requested transactional notifications, provide support, prevent abuse, reconcile transactions and assess operational reliability and loyalty activity. We do not sell information or use it for third-party advertising or marketing profiling.
Firebase and Google Cloud provide authentication, databases, backend functions, app-integrity checks and infrastructure/application logs. Google Identity and Apple process sign-in when you choose them. Apple and Google also provide native app attestation. Expo Push Service sends notifications through Apple Push Notification service or Google Firebase Cloud Messaging. Sentry processes diagnostic reports. Vercel is the documented hosting infrastructure for our public website and web app flows, where connection and web request metadata may be processed. Customer-initiated support email is handled by the email services used by you and Cup Cup.
Only the information needed for each integration is intentionally sent to that service; for example, order notes are stored in the backend rather than included in our push message payload. Authorized Cup Cup staff access order and loyalty information to perform their work. These service-provider and authentication flows are third-party processing even where a store form does not classify them as data sharing.
Our providers may process information outside Armenia. Locations and retention depend on the service and its configuration; we do not promise that all data stays in Armenia or one cloud region. Contact us for questions about these arrangements. Ameriabank is not an active data recipient in the current app payment flow.
7. Account deletion and retention
To delete your account in the app, open More → Delete account, type the confirmation word shown and confirm. If you cannot access the app, use the instructions at https://cupcup.am/delete-account or email info@cupcup.am. We may need information to verify ownership; do not send passwords or card details.
On successful deletion we delete your Firebase Authentication account and its provider associations, Club profile and member-code reservation, points balance, matching legacy stamps and rewards and their redemption tokens, push registrations, and account-linked duplicate-request and push-delivery records. Cleanup includes trusted recovered/retired account identifiers associated with the active account. We remove the account field, name, phone number and order note from matched order records and minimize direct customer identifiers in retained loyalty/security records where they are not needed for record integrity. When Apple sign-in is linked, we revoke the stored Apple authorization token before deleting the Cup Cup account. Deleting Cup Cup does not delete your Google or Apple account.
Completed orders and financially material loyalty and audit records are retained for at least five years from the applicable reporting period where needed for accounting, tax, reconciliation or transaction evidence. Five-year record retention does not mean keeping your Cup Cup profile or checkout contact data for five years: those direct fields are removed on account deletion where the retained record remains usable without them. Some internal order, transaction or audit identifiers can remain pseudonymous during the retention period when changing them would undermine record integrity.
Active identity-recovery redirects are retained while the canonical account exists because they prevent stale recovered sessions from writing under an abandoned identity and preserve trusted loyalty continuity. After account deletion, Cup Cup-controlled deleted-identity security markers, retired redirects and matching recovery audit evidence are scheduled to expire after 90 days. Push-delivery diagnostic records are retained for 30 days and are deleted sooner when directly linked to the deleted account. Rate-limit records use their short configured security expiry.
Our retention schedule also provides five years for financially material staff actions; active staff access records plus three years after access ends; one year for ordinary non-financial administrative audit records; three years after case closure for support correspondence; 90 days after case closure for support attachments/screenshots; 30 days for Cup Cup-controlled application/debug diagnostics; and one year after closure for security-incident evidence. A documented legal hold, live dispute or ongoing investigation can extend only the records relevant to that matter.
Provider-controlled logs, backups, authentication, push, hosting, mail and diagnostic records follow the provider's technical/legal retention and the settings Cup Cup can configure. Account deletion does not promise instant erasure from every provider backup, delivered notification, device cache or historical diagnostic event. Checked-in Firestore TTL declarations also require production activation and asynchronous deletion before expiry can be relied on operationally.
A deletion failure is shown in the app so you can retry or contact support. Some cleanup may have completed before a failure. A successfully deleted sign-in account cannot restore its former Club balance by signing up again. Short-lived security markers may remain for the post-deletion protection period described above.
8. Your rights and choices
You may choose guest ordering, choose whether to link a supported sign-in method, omit order notes and decline notifications. Native notification permission is controlled in your device settings. Those notification choices do not disable security or automatic configured diagnostic processing.
For access, correction, retention questions or deletion help, contact info@cupcup.am. We will handle requests consistent with applicable law. Our account-deletion feature does not provide a complete automated data export. This policy is governed by the law of the Republic of Armenia; additional rights may apply in other jurisdictions.
9. Children’s privacy
Cup Cup is not directed to children under 13. We do not knowingly collect their personal information. If you believe a child has provided information, contact info@cupcup.am so we can review and address the request.
10. Security
Configured production service connections use HTTPS/TLS. Backend authorization rules restrict customer and staff access, and security controls include account authorization, app attestation where configured and rate limiting. No method of transmission or storage is completely secure. These measures do not guarantee that every retained record is anonymous or that all service data is erased at account deletion.
11. Changes and contact
We may update this policy as the app or its processing changes and will update the date above. Contact Cup Cup LLC, Baghramyan 59 Ave, Apt 28, Yerevan, Armenia; info@cupcup.am; https://cupcup.am.