Privacy
OrderLah privacy policy
Effective 4 August 2026 · Published by Junyx Tan / OrderLah · [email protected]
This policy explains what OrderLah does with information. It covers the OrderLah Android application (com.orderlah.app) — the hub, counter, kitchen and display modes — the customer ordering page the hub serves over the local network, and this website.
The short version
OrderLah is an offline-first point-of-sale app. Your menu, your orders, your staff list and your takings live on your own devices. They are not uploaded to us. We do not operate a server that receives your restaurant's data, and we cannot see it.
There is no advertising in OrderLah, no analytics SDK, and no crash-reporting service. We do not sell or share data with data brokers.
This website
orderlah.app sets no cookies, runs no analytics, and loads nothing from a third-party server — the fonts, images and scripts all come from this domain. The interactive demo runs entirely in your browser and creates no order anywhere.
If you fill in the pilot form, the answers are sent to [email protected] so we can reply to you about the pilot. They are not used for anything else and not passed to anybody. If you'd rather not use the form, email us directly.
Who is responsible for customer data
OrderLah is a tool the restaurant operator runs on their own devices. Where an operator records information about their customers (for example a phone number on a loyalty card), the operator is the data controller for that information and is responsible for handling it lawfully. The publisher of this app supplies the software and does not receive that data.
What OrderLah stores on your device
| Information | Why it exists | Where it is kept |
|---|---|---|
| Menu items, categories, prices, photos | To take orders | On the device |
| Orders: items, quantities, special requests, table number, order type, status, timestamps, totals | To run service and produce reports | On the device |
| Payment method and paid/unpaid status | To reconcile takings | On the device |
| Staff accounts: name, role, permissions, PIN | To control who can do what | On the device — new PINs use salted PBKDF2-HMAC-SHA256 hashes. Legacy SHA-256 hashes remain readable for migration; PIN digits are never stored |
| Loyalty cards: the identifier the operator types (a phone number or a table label) and a stamp count | To run a stamp-card scheme | On the device |
| Printer, network and display settings | To keep the setup working | On the device |
| Backup files | To recover after a crash or device swap | In the app's private documents folder (orderlah_backups/) |
Order and queue data is held in a local SQLite database. Its contents are encrypted at rest with an AES-256-GCM key generated per install and stored separately from the database file. If that key cannot be created or read on a particular device, OrderLah keeps working with the data unencrypted rather than refuse to take orders — reliability during service is treated as the higher duty. Physical access to an unlocked device is therefore always a risk worth managing with a device lock screen.
What leaves the device
Your local network. Counter, kitchen and display devices exchange orders and status with the hub over your Wi-Fi or hotspot. The hub also serves a customer ordering page to phones that scan your QR code. This traffic stays on your local network and is not routed through us. Note that local traffic is sent over plain HTTP unless you enable TLS in settings, so anyone on the same Wi-Fi could in principle observe it — use a private network for your stall.
Google Play. If you buy an in-app upgrade, Google processes the purchase and tells the app what was bought. We never see your card details. Google's handling is covered by the Google Privacy Policy.
Google Fonts. The app and the customer ordering page load display fonts from Google's font servers. Google receives the requesting device's IP address and standard request metadata. This happens on staff devices and on the phones of customers who open your ordering page.
Nothing else. OrderLah contains no analytics, advertising, attribution or crash-reporting SDK. No order, customer, staff or takings data is transmitted off your devices by the app.
Device permissions and why they are asked for
| Permission | Used for | Leaves the device? |
|---|---|---|
| Camera | Scanning pairing QR codes, and reading printed receipts to fill an order automatically | No. Recognition runs entirely on the device using a bundled ML Kit text model; images are not uploaded |
| Photos / storage | Choosing menu item pictures and payment QR images | No |
| Bluetooth | Finding and printing to receipt printers | No |
| Local network / Wi-Fi state | Discovering and pairing hub, counter, kitchen and display devices | Local network only |
| Notifications | Alerting the kitchen and counter about new orders | No |
| Wake lock | Keeping the kitchen screen awake during service | No |
Backups and exports
Automatic backups are written to the app's own private folder. Nothing is uploaded. If you choose to share or export a backup, it leaves the device by whatever route you pick — a backup file contains your orders, menu, staff list and loyalty cards, so treat it as sensitive and store it somewhere safe.
How long data is kept
Data stays on your devices until you delete it — by removing records in the app, resetting data from settings, or uninstalling. Uninstalling removes the app's local database, its encryption key and its backups. There is no copy held elsewhere for us to delete on your behalf.
Children
OrderLah is a business tool for restaurant and hawker operators. It is not directed at children and we do not knowingly collect information from them.
Your rights
Because your data sits on your own devices, you exercise access, correction, export and deletion directly in the app rather than by asking us. If you have a question about this policy, contact [email protected].
Changes to this policy
If this policy changes we will update this page and move the effective date at the top. Material changes will also be noted in the app's release notes.
The canonical copy of this policy lives with the source code, in docs/PRIVACY_POLICY.md ↗.