What this site stores.

Who we are

Magic Smoothies LLC, 4285 N Atlantic Ave, Cocoa Beach, FL 32931. Phone (321) 613-3604. If anything on this page needs explaining, call us or ask at the counter.

Cookies

This site sets no cookies and runs no tracking. It keeps these values in your browser’s local storage, so an announcement bar stays closed once you have closed it and so your cart survives a page change:

• Whether you closed the Fall Edition bannerStored as modal-fall-edition
• Which run of the Fall Edition banner you closedStored as modal-start-date-fall-edition
• How often the Fall Edition banner may come backStored as modal-freq-fall-edition
• Whether you closed the app waitlist bannerStored as modal-app-waitlist
• Which run of the app waitlist banner you closedStored as modal-start-date-app-waitlist
• How often the app waitlist banner may come backStored as modal-freq-app-waitlist
• What is in your cartStored as ms-order-v1

Once you place an order, your browser also keeps its own copy of that receipt, stored as ms-order-<number>. None of it leaves your device, and clearing this site’s data removes all of it.

Offline cache

A service worker keeps a copy of the pages, images and fonts under the name ms-v7 so the site loads quickly on a phone. That is a cache on your device, not a record of your visit.

The map

The Google map on the Visit page does not load until you tap it. Once you do, that embed is Google’s, and Google’s terms and privacy policy apply to it.

Ordering on this site

When you place an order here we store your order number, when you placed it, where it is: received, making, ready, picked up, pickup or delivery, the pickup time you chose, that time in words, the name for the order, a phone number, so the shop can reach you about this order, an e-mail address, if you gave one, for the receipt, a delivery address, only if you chose delivery, what you ordered, what it came to, how it was paid, whether it was, the payment provider's reference numbers for it, and any refund the shop made on it, the courier job, if the order is a delivery, which of the shop’s own ordering pages or apps the order came from, the table number, if you ordered from a table in the shop, whether you ticked the text box, the e-mail box, when, and which version of their words the checkout showed you, never a device or a browser, the rewards system’s number for a reward you chose to use on this order, if you chose one, and nothing else about your rewards, a one-way hash of your IP address, never the address itself, and a one-way hash of the link that shows you this order. The record deletes itself 90 days after the order. It is written with an expiry, not a policy somebody has to remember. Your IP address is never written down; a one-way hash of it counts orders per hour. No card number ever reaches this site: payment happens on the payment provider’s own page. The shop sees your order on its kitchen board, and you see it through the link you are given after checkout. The payment provider that takes your card receives what you ordered and what it came to, and your name and phone number, so the ticket at the counter says who it is for. On a delivery order, the delivery partner that carries the order receives your name, your phone number, the delivery address, your notes for the driver and the list of what you ordered, so the driver can find you and hand over the right bag.

Ordering apps

Our DoorDash, Uber Eats and Grubhub buttons hand you over to those apps, and our pay-ahead link to its provider. From the moment their page opens, their privacy policy applies and ours stops.

Messages after the order

The checkout has one tick box for news and offers by e-mail, empty until you tick it. A second one, for texts, appears only once the shop sends texts. They are separate permissions, and neither is needed to order. When the shop sends e-mail, the receipt for the order you just placed goes to the address you gave either way. It is the receipt for a thing you asked for, not a message about anything else.

If you tick one, two messages can follow: a note 45 minutes after your order leaves the shop (you pick it up, or the driver does), asking how it went, and a thank-you the morning after your first order. Everybody who ticks the box gets the same words. Nothing is offered in exchange for a review, and the shop does not decide who to ask based on what you said or spent. If you tick one and have not ordered for a month, one hello can follow, and not another for three months. A text says STOP; an e-mail carries a link that stops it in one tap, and a reply stops it too.

Until one of those messages is sent it sits in a queue the shop can read, and this is the whole of what it holds:

• a reference for this one messageStored as id
• which message it is: a review request, a welcome after a first order, or a hello after a month awayStored as kind
• the order it followsStored as orderId
• text or e-mailStored as channel
• the number or address it would go to, empty when it is not going anywhereStored as to
• when the box this message relies on was ticked, so a later request to stop wins over itStored as consentAt
• the name on the order, so the message can say itStored as name
• the subject line, on an e-mailStored as subject
• the exact words that would be sent, nothing is composed laterStored as text
• when it would goStored as sendAt
• what happened to it, in plain wordsStored as state
• when it was queuedStored as queuedAt
• when it went, if it didStored as sentAt

A queued message expires on the same 90-day rule as the order. One thing more is kept: a one-way hash of your phone number, so the thank-you for a first order is sent once and not again. It holds no name, no number and no address, and it expires on the same rule. The hello after a month away keeps the same kind of hash for three months, so it is sent once in that time. While the shop sends texts, the same kind of hash of your number is kept with the times of the texts sent to it in the last day, so no more than 3 reach you in 24 hours; it deletes itself after two days.

If you ask us to stop, we keep a one-way hash of that address or number, the date you asked and how, and nothing else. It has no expiry, because a stop has to outlast your orders. A later tick at a checkout is a new yes and wins over it.

When you tick a box, the shop also keeps a proof of that yes for four years, longer than the order, because a question about a message can come long after the order is gone. It is filed under a one-way hash of the address or number, never the address or number itself, and this is the whole of what it holds:

• e-mail or text: the box you tickedStored as channel
• when you ticked it: the moment the order was placedStored as at
• the number of the order the tick came withStored as orderId
• which version of the box’s words the checkout showed youStored as wording
• those words, exactly as they wereStored as words
• which of the shop’s own ordering pages or apps the order came fromStored as source

It deletes itself after those four years. A box you left empty leaves no proof behind.

The shop sends its e-mails, the receipt and any message you ticked for, through Resend, a mail service. Resend receives the address each e-mail goes to and the e-mail itself, and nothing else from your order.

The Magic Smoothies app

The app has no account and no sign-in. It keeps these on your phone:

• The items you starredSo they are waiting for you in the app
• The store you pickedSo the app opens on the shop you use
• What is in your cartThe same cart as this shop’s website, in this browser
• Your birthday, if you saved itThe month and the day. Never the year
• The orders you placed in the appTheir numbers, so you can open one again

An order placed in the app is kept exactly as described under “Ordering on this site”. The name and phone number you type at checkout go with that order and are not kept in the app. If you ask to be told when your order is ready, we keep the notification address your phone or browser gives us, under your order number and nowhere else. It is used once, when the shop marks the order ready for pickup, and deleted right after. If that never happens, it is deleted with the order. To remove everything the app keeps on your phone, tap “Clear what this phone keeps” in the app, or delete the app. Nothing is tracked.

The app waitlist

If you give us your e-mail we store the address, the time you signed up, whether you signed up from the bar or from the waitlist page, a one-way hash of your IP address, and never the address itself. The last of those is there only so we can spot abuse. We use it for one thing: to e-mail you when the app is ready. We keep it until you ask us to delete it, which you can do by replying to any e-mail from us or calling (321) 613-3604. We do not sell it, rent it or pass it to anyone else.

If you review the shop on Google

To answer a review, the shop keeps a copy of what Google already shows publicly: the stars, the words, the first name and the day it was posted. Kept with it are the shop's automatic reading of the review (whether it reads as happy, mixed or unhappy, the topics it mentions with the words that matched, and any warning it raised, for example about illness, the law or a member of staff named in it), the latest reply drafted for it, what the shop decided and when, and the reply the shop approved. For a review the shop receives from Google directly, it also keeps Google's reference for the review and whether Google accepted the reply. Nothing else about you is added: the copy is not linked to an order, a phone number or an e-mail address. While the shop uses a drafting service to write the first version of a reply, the stars, the words, the first name and the day it was posted are sent to that service, Anthropic, for that one draft. The copy deletes itself about 13 months after it last changed.

Analytics

Visits are not counted on this site today. If we add a visit counter, it will be one that works without cookies, and this page will say so before it goes live. Three moments in an order are counted as anonymous daily tallies: an item added to the cart, the checkout opened, an order placed. Each tally is one record of the date, in UTC; whether the hit came from the live site or the staging copy; which of three things happened: an item added to the cart, the checkout opened, or an order placed; a short label for where it happened (a menu section, a page name), never a URL you typed. It holds nothing about you: no address, no id, no cookie, no session. It deletes itself after 90 days.