THE SMALL PRINT, IN PLAIN SIGHT
Cookies & Browser Storage.
Effective date: 04-09-2026
This page explains the essential and functional cookies and browser storage used by The Coffee Club website, and local storage used by the native apps. The TCC application does not use advertising cookies, analytics cookies or tracking pixels.
What we store
| Category | Purpose | Typical duration |
|---|---|---|
| Customer sign-in | Keeps you signed in to your TCC account and connects you with your orders and loyalty. | Up to 90 days. |
| Pending signup | A secure, HttpOnly, host-only cookie binds the six-digit email check to the browser where signup began. The code itself is not stored in cookies or browser storage. | Up to 10 minutes, renewed when a replacement code is requested. |
| Staff sign-in | Secures authorised staff access. Staff sessions refresh every five minutes while visible and online. | Staff: one-hour inactivity timeout and a 16-hour maximum. Admin: fixed eight-hour maximum. |
| NFC loyalty | Temporarily authorises a Collect Stamp interaction and helps prevent duplicate or replay use. | A few minutes. |
| Basket & order continuity | May retain basket choices, receipts and payment continuation from earlier website use. New browser/PWA ordering and checkout are disabled. Account-linked continuity is cleared on logout or account deletion. Separate guest receipts remain accessible to people sharing this browser profile. | Account-linked data: until logout/deletion. Guest data: until replaced or site data is cleared. |
| Payment return | Temporarily allows checkout to resume after a payment or security redirect. Payment-card details are not stored in this browser value. | The current browser session, with application expiry protection. |
| Optional order notifications | If you choose Notify me, browser storage keeps a random notification-access token and your browser’s push service keeps the technical subscription needed to deliver order-status alerts to this device. | Until you turn notifications off, the subscription expires or site data is cleared. |
| PWA / installed web app | Remembers installation preferences and caches public application files. Account responses, order services and personal customer records are not intentionally cached. | Until updated or cleared. |
| iPhone app session | The device Keychain stores the customer session and a limited account preview. The app removes both on local sign-out. If sign-out happens offline, a separate Keychain record holds the old session only to retry server logout and notification-device cleanup without signing you back in. | Session: until sign-out, deletion or expiry. Pending logout record: until server cleanup succeeds or that session expires. |
| iPhone app basket and display data | App storage remembers basket choices and limited public menu and Home display data. It does not hold payment-card details. | Until updated, cleared in the app or the app is removed. |
| iPhone app payment and receipt recovery | The device Keychain stores an order draft, idempotency and receipt-recovery details when needed to resolve an interrupted payment. Separate guest receipt references can remain on the device. | Pending payment details: until the attempt is resolved. Guest receipts: until removed from the app or its secure storage is cleared. |
| Android app session and basket | Encrypted device storage protected by Android Keystore retains the account session and limited account preview. Local app storage retains basket and public display data. Sign-out removes local account access; pending server logout retries can remain encrypted until completed. | Session: until sign-out, deletion or expiry. Local display data: until updated, cleared or the app is removed. |
| iPhone app notifications | When registered for account-linked alerts or Live Activities, the app sends its APNs device token or Live Activity token to the service. These are removed from the account on successful logout or account deletion; offline logout retries server cleanup on reconnect. | While registered and needed for the selected updates, subject to token expiry and account cleanup. |
Hosting and payment services
Cloudflare and SumUp may use necessary technologies to provide hosting, security and payment functionality. These services operate their technologies under their own service arrangements.
Managing local data
Your browser controls can clear this site’s cookies and stored site data. Removing the iPhone app clears its local app data; Keychain items may need to be cleared through the app’s sign-out or account-deletion controls. Clearing local data does not delete orders or customer accounts held by The Coffee Club. Use the account deletion control or contact us for those requests.