Privacy Policy
Last updated 14 October 2026
This policy explains what personal information LineUp collects, why, who sees it, how long we keep it, and your rights under the Protection of Personal Information Act (POPIA). We collect as little as we can.
1. Who we are
•
LineUp is run by [Your full name], Stellenbosch, South Africa. We are the “responsible party” for your personal information.
•
Information Officer: [Your full name].
•
Contact for any privacy question or request: [LineUp email].
2. What we collect
Browsing venues needs no account and no personal information. Depending on what you use:
•
Account (only if you create one): your email address and password. Your password is stored scrambled (hashed) by our login provider; we can’t see it. We also keep when you signed up and last logged in.
•
Deals: which deals you claim, when, and when venue staff scan your code.
•
Line reports (no account needed): the venue, whether you joined the line or got in, where the line ended (if you chose to say), and the time. Each report carries a random device ID created on your device, and a scrambled (salted hash) version of your internet connection’s IP address, used only to stop spam and deleted after 2 days. If you were logged in, the report is also linked to your account.
•
Deal alerts (only if you turn them on): the push subscription your browser or phone gives us (an address at your device’s push service and encryption keys), linked to your account.
•
Venue staff accounts: the work email, the venue, and the door taps they record (counts of people going in and out — never who they are).
•
Technical logs: our hosting and login providers keep short-term logs, including IP addresses and sign-in events, for security.
On your device we store your login session, your random device ID and your current “in the line” status, in the browser’s or phone’s local storage. We don’t use tracking cookies, analytics or advertising tools.
We don’t collect your location, contacts, photos or payment details. The camera is used only by venue staff to scan deal codes, and no images are stored.
3. Why we use it
•
To provide what you ask for: your account, claiming and scanning deals, deal alerts and line reports.
•
To show everyone live, anonymous estimates of how busy venues are and how long lines are.
•
To prevent abuse, such as spam reports and forged deal codes.
•
To give venues statistics: counts of claims and scans, and door counts for their own venue. Venues never see your name or email.
•
Deal alerts are sent only with your consent, which you can withdraw at any time.
4. Who sees it
•
Venues: when staff scan your deal code, the venue sees that the deal was redeemed and when — not your email or any other details.
•
Our service providers (“operators” under POPIA), who process data only on our instructions: Supabase (database and login; servers in the European Union), Cloudflare (website hosting), and the push services of Google, Apple and Mozilla (delivering deal alerts; alert content is encrypted).
•
We don’t sell your personal information and don’t share it with advertisers.
•
We may disclose information if the law requires it, for example to comply with a court order.
5. Information stored outside South Africa
Our database is hosted in the European Union. POPIA (section 72) allows this because the European Union’s data protection law (GDPR) gives protection at least as strong as POPIA, and our providers are bound by agreements that protect your information.
6. How long we keep it
•
Your account: until you delete it. Your claims, scans and alert subscriptions are deleted with it.
•
Line reports: up to 24 months, to predict typical line times (for example “usually busiest at 23:30 on Wednesdays”). Deleting your account removes any link between your reports and you.
•
Scrambled IP addresses on line reports: 2 days.
•
Alert subscriptions: until you turn alerts off, delete your account, or the subscription expires.
•
Technical logs: as long as our providers keep them for security, usually a few weeks.
7. How we protect it
•
All connections use encryption (https).
•
Strict access rules in the database: you can only read your own account information, and venue staff only their own venue’s data.
•
Deal codes change every 30 seconds and are checked on our server, so copies don’t work.
•
Secret keys stay on our server and are never sent to your device.
•
If a security compromise affects your information, we’ll tell you and the Information Regulator as POPIA requires.
8. Your rights
•
Access: ask us what personal information we hold about you ([LineUp email]).
•
Correction: ask us to correct information that is wrong.
•
Deletion: delete your account yourself on the Account page (“Delete my account”), or ask us.
•
Objection and consent: object to how we use your information, or withdraw consent — for deal alerts, simply turn them off.
•
Complaints: you can complain to the Information Regulator of South Africa (inforegulator.org.za). We’d appreciate the chance to sort it out first, at [LineUp email].
10. Changes to this policy
We’ll update this policy when what we collect or how we use it changes. The date at the top shows the latest version; if a change is important, we’ll tell you in the app.