What this site stores.

Who we are

Magic Smoothies LLC, 4285 N Atlantic Ave, Cocoa Beach, FL 32931. Phone (321) 613-3604. E-mail Tiffani@magicsmoothies.com. If anything on this page needs explaining, call us or ask at the counter.

Cookies

The site itself stores no cookies for its own use. Google Analytics sets its own cookies (_ga and _ga_TH1YZWKSPK) on this site to count visits (see Analytics below). The site keeps these values in your browser’s local storage, so your cart survives a page change:

• What is in your cartStored as ms-order-v1

Once you place an order, your browser also keeps its own copy of that receipt, stored as ms-order-<number>. None of it leaves your device, and clearing this site’s data removes all of it.

Offline cache

A service worker keeps a copy of the pages, images and fonts under the name ms-v7 so the site loads quickly on a phone. That is a cache on your device, not a record of your visit.

The map

The Google map on the Visit page does not load until you tap it. Once you do, that embed is Google’s, and Google’s terms and privacy policy apply to it.

Ordering on this site

When you place an order here we store your order number, when you placed it, where it is: received, making, ready, picked up, pickup or delivery, the pickup time you chose, that time in words, the name for the order, a phone number, so the shop can reach you about this order, an e-mail address, if you gave one, for the receipt, a delivery address, only if you chose delivery, what you ordered, what it came to, how it was paid, whether it was, the payment provider's reference numbers for it, and any refund the shop made on it, the courier job, if the order is a delivery, which of the shop’s own ordering pages or apps the order came from, the table number, if you ordered from a table in the shop, whether you ticked the text box, the e-mail box, when, and which version of their words the checkout showed you, never a device or a browser, the rewards system’s number for a reward you chose to use on this order, if you chose one, and nothing else about your rewards, a one-way hash of your IP address, never the address itself, and a one-way hash of the link that shows you this order. The record deletes itself 90 days after the order. It is written with an expiry, not a policy somebody has to remember. Your IP address is never written down; a one-way hash of it counts orders per hour. No card number ever reaches this site: payment happens on the payment provider’s own page. The shop sees your order on its kitchen board, and you see it through the link you are given after checkout. The payment provider that takes your card receives what you ordered and what it came to, and your name and phone number, so the ticket at the counter says who it is for. On a delivery order, the delivery partner that carries the order receives your name, your phone number, the delivery address, your notes for the driver and the list of what you ordered, so the driver can find you and hand over the right bag.

Ordering apps

Our DoorDash, Uber Eats and Grubhub buttons hand you over to those apps. From the moment their page opens, their privacy policy applies and ours stops.

Messages after the order

The checkout has one tick box for news and offers by e-mail, empty until you tick it. A second one, for texts, appears only once the shop sends texts. They are separate permissions, and neither is needed to order. When the shop sends e-mail, the receipt for the order you just placed goes to the address you gave either way. It is the receipt for a thing you asked for, not a message about anything else.

If you tick one, two messages can follow: a note 45 minutes after your order leaves the shop (you pick it up, or the driver does), asking how it went, and a thank-you the morning after your first order. Everybody who ticks the box gets the same words. Nothing is offered in exchange for a review, and the shop does not decide who to ask based on what you said or spent. If you tick one and have not ordered for a month, one hello can follow, and not another for three months. A text says STOP; an e-mail carries a link that stops it in one tap, and a reply stops it too.

Until one of those messages is sent it sits in a queue the shop can read, and this is the whole of what it holds:

• a reference for this one messageStored as id
• which message it is: a review request, a welcome after a first order, or a hello after a month awayStored as kind
• the order it followsStored as orderId
• text or e-mailStored as channel
• the number or address it would go to, empty when it is not going anywhereStored as to
• when the box this message relies on was ticked, so a later request to stop wins over itStored as consentAt
• the name on the order, so the message can say itStored as name
• the subject line, on an e-mailStored as subject
• the exact words that would be sent, nothing is composed laterStored as text
• when it would goStored as sendAt
• what happened to it, in plain wordsStored as state
• when it was queuedStored as queuedAt
• when it went, if it didStored as sentAt

A queued message expires on the same 90-day rule as the order. One thing more is kept: a one-way hash of your phone number, so the thank-you for a first order is sent once and not again. It holds no name, no number and no address, and it expires on the same rule. The hello after a month away keeps the same kind of hash for three months, so it is sent once in that time. While the shop sends texts, the same kind of hash of your number is kept with the times of the texts sent to it in the last day, so no more than 3 reach you in 24 hours; it deletes itself after two days.

If you ask us to stop, we keep a one-way hash of that address or number, the date you asked and how, and nothing else. It has no expiry, because a stop has to outlast your orders. A later tick at a checkout is a new yes and wins over it.

When you tick a box, the shop also keeps a proof of that yes for four years, longer than the order, because a question about a message can come long after the order is gone. It is filed under a one-way hash of the address or number, never the address or number itself, and this is the whole of what it holds:

• e-mail or text: the box you tickedStored as channel
• when you ticked it: the moment the order was placedStored as at
• the number of the order the tick came withStored as orderId
• which version of the box’s words the checkout showed youStored as wording
• those words, exactly as they wereStored as words
• which of the shop’s own ordering pages or apps the order came fromStored as source

It deletes itself after those four years. A box you left empty leaves no proof behind.

The shop sends its e-mails, the receipt and any message you ticked for, through Resend, a mail service. Resend receives the address each e-mail goes to and the e-mail itself, and nothing else from your order.

If you review the shop on Google

To answer a review, the shop keeps a copy of what Google already shows publicly: the stars, the words, the first name and the day it was posted. Kept with it are the shop's automatic reading of the review (whether it reads as happy, mixed or unhappy, the topics it mentions with the words that matched, and any warning it raised, for example about illness, the law or a member of staff named in it), the latest reply drafted for it, what the shop decided and when, and the reply the shop approved. For a review the shop receives from Google directly, it also keeps Google's reference for the review and whether Google accepted the reply. Nothing else about you is added: the copy is not linked to an order, a phone number or an e-mail address. While the shop uses a drafting service to write the first version of a reply, the stars, the words, the first name and the day it was posted are sent to that service, Anthropic, for that one draft. The copy deletes itself about 13 months after it last changed.

Analytics

This site uses Google Analytics to count visits and see how the pages are used. To do that, Google sets its own cookies in your browser, named _ga and _ga_TH1YZWKSPK. The _ga cookie holds a random ID that lets Google recognise your browser when you come back. For each page you open here, Google receives that ID, the page address and the page title, the address of the page that sent you here, your browser and device details, and your IP address. Google uses the IP address to estimate your rough location, and Google Analytics does not store it. The site sends those addresses without anything after a question mark, except the campaign tags (utm_ tags and gclid) that say which ad or link brought you here. The shop’s Google Analytics account is also set to record, where a page has them, scrolls to near the bottom of a page, clicks on links to other sites, site searches, file downloads and video plays. The checkout and order status pages do not load it. This site does not send Google your name, phone number or e-mail address, and it asks Google not to use this data for ads personalization or for Google signals. To opt out in a desktop browser, install Google’s Google Analytics opt-out browser add-on. Three moments in an order are counted as anonymous daily tallies: an item added to the cart, the checkout opened, an order placed. Each tally is one record of the date, in UTC; whether the hit came from the live site or the staging copy; which of three things happened: an item added to the cart, the checkout opened, or an order placed; a short label for where it happened (a menu section, a page name), never a URL you typed. It holds nothing about you: no address, no id, no cookie, no session. It deletes itself after 90 days.