Privacy Policy

1. Introduction

Two Kangaroo ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (twokangaroo.com), our game site (play.twokangaroo.com), and use our Australian food pickup and delivery service.

2. Information We Collect

Personal Information

• Account Information: Name, email address, phone number
• Billing Information: Payment details processed securely through Stripe
• Shipping and Delivery Information: Delivery addresses and preferences
• Subscription and Purchase Details: Product selections, delivery schedules

Automatically Collected Information

• Usage Data: Pages visited, time spent on site, click patterns
• Device Information: IP address, browser type, operating system
• Browser Storage: We use your browser's localStorage to store your authentication token for up to 7 days so you stay signed in across visits. We use sessionStorage to temporarily hold your in-progress order data during checkout; this is cleared when you close your browser tab. We do not use traditional tracking cookies.
• Text Message Origination: All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties

RooRunner Game (play.twokangaroo.com)

When you play RooRunner, the following data is collected:

• IP Address: Your IP address is stored server-side solely for rate limiting and anti-cheat purposes (to prevent score manipulation or game abuse). It is not used for advertising or cross-site tracking.
• Leaderboard Name: If you choose to submit a score to the leaderboard, you will be asked to enter up to 3 characters (e.g. your initials). This entry, along with your score, is stored in our database and displayed publicly on the leaderboard. Do not enter your full name or any personally identifiable information as your leaderboard name.

3. How We Use Your Information

• Process and fulfill your orders
• Manage your account and provide customer support
• Send order confirmations, delivery updates, pickup updates, and service notifications
• Process payments through our secure payment processor (Stripe)
• Improve our website and services
• Send promotional emails (with your consent)
• Comply with legal obligations

4. Information Sharing

We do not sell, trade, or rent your personal information. We may share your information with:

• Stripe: Payment processing for subscriptions and one-time orders. Stripe handles all card data; we do not store payment details on our servers.
• Mailtrap: Transactional email delivery (order confirmations, delivery updates, account notifications). Your name and email address are processed by Mailtrap to send these messages.
• Umami Analytics: Privacy-focused website analytics. Umami collects anonymised data about pages visited, click patterns, and custom events (such as button clicks). No personal identifiers or cross-site tracking are used. Umami is self-hosted — your data never leaves our own infrastructure.
• Cloudflare: Our website and API are hosted on Cloudflare's network. Cloudflare processes all traffic to our site, including your IP address, as part of providing CDN and security services. Cloudflare Web Analytics also provides us with aggregate traffic metrics. See Cloudflare's Privacy Policy.
• Google (Fonts): We load website fonts (Work Sans and Playwrite AU NSW) from Google Fonts (fonts.googleapis.com). Your browser makes a direct connection to Google's servers when loading these fonts, which may allow Google to process your IP address. See Google's Privacy Policy.
• Google (Delivery Request Form): If you submit a delivery area request, you will be redirected to a Google Form operated by Google. Any information you enter in that form is subject to Google's Privacy Policy.
• exe.dev: The RooRunner game (play.twokangaroo.com) is hosted on exe.dev, which provides the server infrastructure and database where game data is stored. This includes IP addresses used for rate limiting and leaderboard entries. Data stored on exe.dev is subject to their platform terms and infrastructure security practices.
• Delivery Partners: When applicable, shipping partners for order fulfilment.
• Legal Requirements: When required by law or to protect our rights.
• Business Transfers: In connection with a merger, sale, or transfer of assets.

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Payment information is processed securely through Stripe and we do not store credit card details on our servers.

6. Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and personal information
• Opt-out of marketing and text message communications
• Restrict processing of your information
• Request a portable copy of your data in a commonly used, machine-readable format
• Opt-out of targeted advertising and profiling that produces legal or similarly significant effects

Minnesota residents may also appeal any decision we make regarding a data rights request by contacting us. We will respond to all verifiable requests within 45 days, with one possible 45-day extension where reasonably necessary.

To exercise these rights, please contact us at privacy@twokangaroo.com

7. Text Message Communications

When you opt in to receive text messages from us, we may send you:

• Order confirmations and delivery updates
• Account notifications
• Promotional messages (only with explicit consent)

You can opt out of text messages at any time by replying STOP to any message or contacting us directly.

8. Browser Storage and Tracking

We do not use traditional HTTP tracking cookies. Instead, we use standard browser storage mechanisms:

• localStorage: Stores your authentication token (JWT) so you remain signed in across browser sessions for up to 7 days. This is cleared when you sign out or the token expires.
• sessionStorage: Temporarily holds your in-progress order data (selected products, delivery zone, time slot) while you move through the checkout flow. This is automatically cleared when you close the browser tab.

You can clear browser storage at any time through your browser settings. Doing so will sign you out and clear any in-progress orders.

We also use Umami Analytics and Cloudflare Web Analytics to understand how visitors use our site. These services collect aggregate, anonymised data and do not use tracking cookies or build personal profiles. See Section 4 for details.

9. Data Retention

We retain your personal information for as long as your account remains active. If you cancel your subscription, your account and customer portal access remain available so you can view your order history and resubscribe at any time.

If you request complete account deletion, we will remove your personal information within 30 days of your request, except where we are required to retain it for legal, tax, or regulatory purposes (for example, transaction records). To request deletion, contact us at privacy@twokangaroo.com.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Children's Privacy

Our services, including our food ordering site and the RooRunner game at play.twokangaroo.com, are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

In particular, the RooRunner game collects IP addresses for rate limiting and allows players to submit a 3-character leaderboard name. Children under 13 should not play the game or submit a leaderboard entry without parental consent. Leaderboard entries are publicly visible — players should not enter their full name or any personally identifiable information.

If we become aware that we have collected personal information from a child under 13, we will delete such information promptly. If you believe a child under 13 has provided us with personal information, please contact us at privacy@twokangaroo.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: