What we do with your information

You can read everything a guest comes here for — our hours, the drinks list and its prices, what is on this week, the gallery and how to find us — on the website or in the app without an account, and without telling us anything about yourself.

Our servers keep ordinary request logs, as any web server does: the time of a request, what was requested, the IP address it came from and the browser or app that sent it. We use those to keep the site up and to deal with abuse, and nothing else.

If you email us or send us a message on social media, we have what you sent us. Public comments, reviews and messages left on the bar’s own social accounts are collected into a staff inbox so somebody actually reads and answers them.

A VIP card is a standing right of admission. For it we hold:

• the name shown on the card, and the account it belongs to if you have one;
• the name on your ID, only where the door needs it to match you to the card;
• a photograph, if one was taken for the card — it is never on a public address;
• the status and expiry of the card, and any note the bar has attached to it;
• a record of each time the card was checked at the door: when, the result, and which member of staff checked it.

The code your card displays changes every few seconds. We store only a digest of it, so reading our database does not let anybody walk in on your card.

For a staff account we hold your name, your email address, your role, and:

• your password, stored only as a hash — we cannot read it;
• if you use two-factor authentication, an encrypted secret and hashes of your unused recovery codes;
• sign-in attempts against your email address, with the IP address and whether they succeeded, kept so we can spot somebody trying to break in;
• an audit record of administrative actions — who changed what, and when. It is append-only on purpose;
• on iPhone, a notification token for the device, so the bar can reach you about work (media waiting for review, a failed sync, a security event). You choose which of those you want;
• photographs and video you upload to the bar’s media library, and the captions you write.

Red Bar is your single sign-in. The bar’s point of sale keeps its own employee record — that is where checks, tips and hours live — and we link your Red Bar account to it so you do not have to register twice. Your shift PIN is held by the point of sale as a hash and is never stored by this website or by the app.

Card payments at the bar are processed by Stripe. Neither this website nor our apps ever sees a card number: the card is read by Stripe’s own software and goes straight to Stripe. We keep the sale, not the card.

Our point-of-sale screen uses Stripe’s Terminal software, which asks for location permission because Stripe requires it to take a payment. Stripe’s own software collects an approximate location and information about how its payment screens are used. That is not tied to your identity, it goes to Stripe rather than to us, and we neither store nor transmit a location ourselves. Card payments are in Stripe’s test mode while the app is being tested, so no real card is charged through it.

If you ask for a receipt by email, we use the address you give us to send it.

We use a small number of companies to run the bar’s software. They act on our instructions and may not use what they hold for their own purposes:

• Amazon Web Services — hosting for this website, and file storage. Photographs and video published to the gallery are served publicly, because a public gallery is what they are for. A VIP card photograph is not: it is stored privately and served only to a signed-in member of staff who is allowed to see it.
• Heroku (Salesforce) — the servers and database behind the website and the apps.
• Amazon SES — the email we send: invitations, password resets, receipts and alerts.
• Stripe — card payments.
• Apple — notifications to iPhones, and TestFlight while the app is being tested.

We will also hand over information where the law requires it, or where it is needed to protect somebody’s safety.

This site sets no advertising or analytics cookies, and there is no consent banner because there is nothing to consent to. Signing in to the staff area stores a session so you stay signed in; signing out ends it.

We keep each kind of record for as long as it is doing a job, and then no longer. We have not set a fixed number of days for each one, and we would rather say so than print a figure we do not actually work to. What governs each kind:

• Staff accounts last as long as the person works here. When somebody leaves we disable the account rather than delete it, because the audit trail has to go on making sense: a record of who changed a price last year is worth little if the name attached to it has been removed.
• The audit trail is append-only by design, and is kept as the bar’s record of who did what.
• VIP records are kept while the card is live, and a revoked one is kept afterwards with the reason — otherwise a card withdrawn at the door could be re-issued by mistake.
• Sign-in attempts and server logs exist to spot somebody trying to break in, and are kept only while they are useful for that.
• Sales and payment records are the bar’s accounting records, and tax and accounting law decides how long those are kept, not us.
• Backups are encrypted and expire on their own schedule, so something deleted from the live system can still exist in a backup for a while afterwards.

This is a bar. This website and the Red Bar Hawaii apps are intended for adults 21 years of age or older, and we do not knowingly collect personal information from anyone under 21. If you believe a child has given us information, write to us and we will delete it.

Write to us and ask what we hold about you, ask us to correct it, or ask us to delete it. We will respond within 30 days, subject to applicable legal requirements and to any extension the law allows — and if we need an extension we will tell you before the 30 days are up.

We will delete what we can. Some of it we cannot, and it is fairer to say which than to promise and then explain: records we are required by law to keep, accounting and tax records of sales, records needed to establish or defend a legal claim, security records such as sign-in attempts while an investigation is open, and the audit trail of administrative actions. Where we cannot delete something, we will tell you what is being kept and why.

Staff can turn individual notifications off in the app at any time, and can turn off notifications entirely in iOS or Android settings.

If this policy changes we will post the new version here with a new date at the top.

Write to us at redbarhawaii@gmail.com, or in person at 1111 Nuuanu Avenue, Honolulu, HI 96817.