Privacy · Antechamber

Customers who join a line

We store the first name or nickname they type, their party size, their ticket number and the times they joined, were called and were finished.
We do not ask for phone numbers, e-mail addresses, accounts or locations, and names that look like phone numbers or web addresses are refused.
The name is shown on their own ticket and on the shop's counter. The lobby board shows numbers only.
Names are cleared when the shop closes for the day and, at the latest, within an hour after the line's day ends (4 AM local time). Every ticket is deleted before it is 36 hours old (a clean-up runs every hour).
A cookie on the customer's phone remembers their ticket link for 12 hours so the join page can point back to it.

Shops that open a line

We store the business name, line name, welcome note, minutes per customer, time zone and ticket letter, and daily counts (joins, served, no-shows, waits). Daily counts hold no names.
The counter link is the only key to a line. Our database keeps only a one-way fingerprint of it, so we cannot look it up or send it again. (The web server's access log does record page addresses, counter links included: see below.)
A line that nobody uses for 45 days is deleted with its counts (unless a paid pass is running). Deleting a line from its Settings removes everything at once.

Everyone

To stop abuse we count requests per address, keeping only a salted one-way fingerprint of the address. Those counts are deleted after about three days.
Like every website, the web server keeps a standard access log: for each request, the time, the visitor's IP address, the browser name and the page address. For counter and ticket pages that address is their private link. The log is archived monthly and each month's archive is removed at the end of the following month; the server's statistics programs keep monthly summaries of it (such as the most-requested pages and visitor addresses) for longer. It is used only to run and protect the server. The site's own error log blanks out counter and ticket links.
Forms set one security cookie (a CSRF token). There are no ads, no analytics scripts, no trackers and nothing loaded from other websites.
Backups can include first names from the last day and a half. The nightly database backups and the copies taken when the site is updated stay on the server for up to 14 days. The copies we take off the server when we update the site hold only line settings and daily counts.
WeldonPC also backs up the whole server, this site's files and database included: copies made several times a week go to WeldonPC's backup storage and are kept for about four weeks, and WeldonPC's office backup system can keep its copies longer. Names can stay in those copies until they are replaced. They are used only to restore the server after a failure.
When payments open, PayPal will handle payment details; we will receive only what is needed to switch a pass on.

Questions: WeldonPC.com.