Loading the shop
Everything TreeHaus Kombucha holds about you, why we hold it, and what you can do about each one. This describes what the app actually does today — not what we intend to build.
Updated 9 October 2026
Baca dalam Bahasa MelayuWhat it is: The name you typed when you set up your account.
Why we hold it: It is what we call out when your order is ready, and it is the name on the payment page when you pay by online banking (FPX).
Without it we cannot hand you your order, which is why it is the one thing we insist on.
Taking it back: Change it any time on Your details. We cannot delete it while your account exists — read “What we cannot do yet”, below.
What it is: The address you signed in with, or the one Google gave us when you signed in with Google.
Why we hold it: It is how you sign in: we email you a six-digit code. It is also where an order update goes when we send one, and a notice about your balance — a top-up we could not accept, money on its way back to your bank, a balance about to expire.
We do not sell it. We hand it to the payment page when you top up or pay by online banking (FPX), because the gateway asks for it — otherwise nothing in this app sends it anywhere except the emails described above.
Taking it back: This app has no screen for changing it. Message the shop and a person will change it for you.
What it is: A Malaysian mobile number.
Why we hold it: So we can reach you about your order — it is late, it is ready, we cannot find your gate.
We also hand it to the payment page when you pay by online banking (FPX), because the bank wants it. Nowhere else.
Taking it back: Change it any time on Your details.
What it is: Five digits, the pickup point you picked from the list, or both — we need at least one of the two.
Why we hold it: It is how we know which fridge is nearest to you.
TreeHaus Kombucha does not deliver, so it is not used to work out a delivery fee — there is none to work out.
Taking it back: Change either one on Your details. One of the two has to stay while your account can place an order.
What it is: One pair of coordinates — the place you pointed at — and how accurate your phone said it was. When you move the pin we ask a map service what street is there, rounded to about 11 metres first, and show you the answer. What we keep is the coordinates, not that answer, and we store no street address for the pin.
Why we hold it: So your nearest fridge comes first in the list. That is all it is used for here.
The exact pin stays on our server — no screen in this app draws your home on a map. One rounded copy of it does go out: rounded to about 11 metres, to a map service outside Malaysia, only to get the name of the street so we can show it back to you. That is precise enough to name a street and not precise enough to name a house. The shop’s customer map groups people by postcode, and only draws a postcode once at least three different people have ordered from it — so nobody can be picked out of it.
Taking it back: Remove it on Your details, and the coordinates go. We keep the record that you agreed once — the date, and which screen asked — because that record is the only proof we were allowed to hold it at all.
What it is: The day, the month and the year you were born.
Why we hold it: So the shop can send you a voucher on the day, if it is running a birthday reward. If it is not running one, we do not ask.
And so the shop can see which age groups like which flavours — only ever as groups of at least three people, never on their own. That report is the only thing the year is used for.
Because we keep the year, this shop can work out how old you are. We do not use that to decide anything about your order, and there is no age limit on anything here — but it is true, and we would rather say it than imply we cannot.
Taking it back: Ask on Your details and it is removed. A stored date cannot be edited into a different one — the database refuses that change outright — except that if you gave only the day and month before, you can add the year once. Either way the birthday voucher is issued once a year, and that is the guarantee that actually holds.
What it is: One of three answers: Perempuan, Lelaki, or “rather not say”. “Rather not say” is a real answer that we store, and we keep it apart from never having been asked.
Why we hold it: So the shop can see which flavours are popular with whom, and brew more of the right ones. That is the only thing it is for.
It is never shown to another customer, and it is never used to price anything — not your prices, not your tier, not a delivery fee.
Where this shop groups customers on a map or by area, a group of fewer than three people is never drawn on its own: the customer map only draws a postcode once at least three different people have ordered from it, and the breakdown by area merges anything smaller into “Other areas”. The report of which flavours sell to which gender is held to the same floor: if any gender group for a flavour has fewer than three people, that flavour is left off the report altogether.
Taking it back: Change it or remove it on Your details, any time. This one can be changed in place; your birthday cannot.
What it is: Two answers, not one. The offers answer on Your details — yes or no, with the date you gave it and which screen asked you — and a separate “Remind me to check in” switch on Notifications, which is off unless you turn it on.
Why we hold it: If you said yes to offers, the shop can send you one as a notification on your phone. If you said no, or were never asked, it cannot — the send is filtered on this answer, not on a list somebody keeps by hand.
The daily check-in nudge, and the note that a voucher you hold is about to run out, ride the SECOND switch rather than this one. They are promotions too, which is why they have a switch of their own and why turning offers off does not stop them.
Order updates are not offers and do not depend on either switch. You get those either way.
Taking it back: Turn offers off on Your details, and turn the daily reminders off on Notifications — both, if you want neither. We keep the record that you once said yes, and when: without it we could not show we were allowed to send what we had already sent.
What it is: The balance itself, in sen, and one line for every time it was topped up and every time it was spent — in the order they happened. Any bottle credit you are owed, and the points you have earned and spent. A top-up line carries the reference the payment gateway gave it, and if you paid by bank transfer and sent a picture of the slip, the picture, the reference you typed and the date are kept with it.
Why we hold it: It is the money itself. You cannot be shown a balance the shop keeps no record of, and the shop cannot be asked to honour one it cannot show.
The record cannot be edited or deleted, only corrected by adding a further line — so a mistake shows up as a correction instead of quietly disappearing.
Taking it back: The balance page shows the whole history. A wrong line is fixed by adding a correcting line, never by deleting one — that is what makes it worth anything. Money coming back out is the balance terms’ business, and this record is not deleted; read “What we cannot do yet”, below.
What it is: What you bought and when, where it went, what you paid and how you paid it, any points or vouchers, any note you leave — on the whole order or on a single bottle — how many empties you said you would bring, and any bottles you brought back.
Why we hold it: It is your receipt and it is ours. You have to be able to open an old order; the shop has to be able to show what it sold and what it was paid for.
This is not something you opt into — it is what ordering leaves behind.
Taking it back: We do not delete orders. If you want your name and number taken off yours, message the shop and a person will do it.
The six-digit sign-in codes we email you. They are short-lived and they are checked, not read.
If you turned notifications on, the address your browser handed us for this one phone. It is not a phone number and it names nobody; it is how a message reaches this device and no other. The browser string comes with it, and a short label made from that string — “iPhone · Safari” — which is what names each device in the list on Account → Notifications.
The IP address your sign-in came from, and the browser it came from. They are kept on the session, and copied onto the record of what was done to your account — joining this shop, a change of role, something a member of staff did. An IP address is personal data, so we name it here rather than let you assume we hold none: it is what makes a sign-in that was not yours possible to spot, and what gives “who changed this, and from where” an answer.
The shop’s own staff — the people who make your order and hand it over. They see your name, your phone number, your email address, your postcode or the fridge you collect from, and your orders, because they cannot do the job without them. Beyond that postcode they do not see where you live — TreeHaus Kombucha does not deliver, so there is no street address here to be seen, and the only map they have is the postcode one described above.
The payment page, when you top up your balance or pay for an order by online banking (FPX). It is given your name, your email address, your phone number and the amount. It is not given your address, your birthday, or a list of what you bought.
Our email service, when we send you a sign-in code, an order update, or a notice about your balance. It is given your email address and the words of that one email.
The push service your phone already uses — Google, Apple or Mozilla, depending on the phone — when a notification is sent to it. It carries the message; it is not told who you are.
A map search service run on OpenStreetMap data, outside Malaysia, when you SEARCH for a place. What we send is the words you typed. Never your name, your number, your email, or anything about your order.
The same service again, when you drop or drag a pin instead of typing. What we send is that pin rounded to about 11 metres, and nothing else, so it can tell us the name of the street. Never your name, your number, your email, or anything about your order.
Our error monitor, run by Sentry in the United States. It gets two kinds of report: a crash report when something in the app breaks, and, on about one page in ten, a timing report of how long that page took — which is sent even when nothing broke. Neither kind is sent your cookies or your account details, and the monitor keeps no IP address — not the one described above — though it may note the country and town your connection comes from. Before any report goes, and on every step of the trail of pages and requests it carries, everything in a page address from the “?” or “#” onward is cut off — that is where your email sits on the sign-in code page — the headers your browser sent are removed, and so are a few named fields most likely to carry your email or your phone. A report from the app on your phone goes straight from your phone to the error monitor. What we will not claim is a filter that reads every word: if a name or an address is ever written into the words of an error itself, it goes across as written.
On one rented server, in Germany. The database is there, and the nightly copies of the database go to Cloudflare’s storage.
So your personal data leaves Malaysia. Under the PDPA that is a cross-border transfer, and we are telling you plainly rather than burying it, because it is the kind of thing you would want to know and not the kind of thing you would go looking for.
The app itself is served through Cloudflare, which has machines all over the world. They pass the request along; your account does not live on them.
There is no button in this app that deletes your account. We have not built one. We could have written a sentence here promising it, and we are not going to, because a promise you cannot act on is worse than no promise.
There is no button that gives you a copy of your data either. Same reason, same answer.
What you can do is ask. Message the shop. Ask for a copy of what is held about you, ask for something to be corrected, or ask for your name and number to be taken off your old orders — and it will be done by hand.
There is no automatic system behind that request. It is a person reading a message, so it takes as long as a person takes.
This shop is not built for children, and nothing it sells has an age limit, so there is no age check anywhere in it. If you give your date of birth the shop can work out your age — it uses that only to group customers into age bands for the flavour report, in groups of at least three, and for nothing about your order.
It changes when the app changes, and not before. If TreeHaus Kombucha starts collecting something that is not on this page, this page is wrong and we would like to be told.
The message goes to TreeHaus Kombucha — the same people who make your kombucha, not a support desk somewhere else.