Legal
Privacy Policy
Sugar Jar by Jarrar is a small home kitchen in Amman, Jordan. This site is a menu and an order builder. Browsing and filling your jar need no account; placing an order does, and we store only what is needed to bake and deliver it. There are no payments on the site — every order is cash on delivery.
The short version
- Your jar (cart) is stored on your own device, not on our servers.
- You can browse the whole menu without an account; ordering needs one.
- Your order is sent to our kitchen and stored with your account.
- We use your details to bake and deliver, and nothing else.
- We do not sell, rent or share your information for advertising.
What stays in your browser
When you add cookies to your jar, the site saves that list in your browser's
localStorage under the key sugarjar_cart. It holds product
names and quantities only. It never leaves your device, we cannot read it, and
clearing your browser data removes it. The site sets no advertising or tracking
cookies — the only cookie it ever sets is the sign-in one described below, and
only if you choose to have an account.
Your account
Placing an order requires an account, so that every order is tied to a name and an address we can bake for and deliver to. It also means your details fill themselves in instead of you retyping them each time. We store your email address, name and — if you give them — your phone, area and address, along with the date you signed up.
Your password is never stored as you typed it. It is put through scrypt, a deliberately slow one-way hashing function, with a random salt unique to your account. We cannot read your password, recover it, or tell you what it is — if you forget it, we can only send you a one-time link to choose a new one. Signing in is limited to five attempts, after which the account pauses for fifteen minutes; we keep a short-lived count of failed attempts and the IP address they came from purely to enforce that.
Staying signed in uses one strictly necessary cookie, sj_session.
It holds a random token, no personal data, and exists only to keep you logged
in for up to 30 days. It is not used for tracking or advertising. Signing out
deletes the session on our side as well as in your browser.
Account data is held by Upstash, our database provider, on our behalf. To change your details, use the account page. To delete your account and everything in it, message us on WhatsApp and we will remove it.
What you send us when you order
When you press Place order, the order is sent to us and saved. It records what you ordered, the total, and the delivery details on the form: name, phone number, area, address and any notes you added, together with the account it was placed from and the time.
We use it to bake and deliver the order, and to call you if something about it needs sorting out. Nothing about your order is sent anywhere else.
How long we keep it
Orders are kept while they are active and for a period afterwards for our own records and in case of a complaint. The list is capped at the most recent 500 orders, so older ones drop off automatically. If you would like your order history removed sooner, message us and ask.
Other companies involved
Only a few third parties are ever in the picture:
- Vercel hosts the site. Like any web host, its servers process the technical request data needed to serve a page (IP address, browser type, page requested). We do not add our own analytics on top.
- Upstash is our database. It holds account data — email, hashed password and saved delivery details — and the orders you place. Browsing the menu and filling your jar store nothing there.
- Google Fonts serves the typefaces. Your browser requests the font files from Google's servers.
- Instagram (Meta) supplies the reels embedded on the home page. Those embeds load from Instagram and are subject to Meta's own privacy policy. If you would rather not load them, block third-party content for this site in your browser — the rest of the page works normally.
- WhatsApp (Meta) is only a way to contact us — the link in our footer. Orders no longer travel through it. If you message us, your use of WhatsApp is governed by its own terms and privacy policy.
We have no payment processor, because every order is cash on delivery. We never ask for card details, and you should never send them to us.
Children
This site is meant for adults ordering food. We do not knowingly collect information from children under 16. If a child has sent us their details, message us and we will delete them.
Your choices
You can empty your jar at any time from the jar drawer, or clear this site's data in your browser settings. If you have an account, you can view and change your saved details on the account page, and sign out to end the session. To ask what we hold about you, to correct it, or to have your account and its data deleted, message us on WhatsApp and we will handle it directly.
Changes
If this policy changes, the updated version appears on this page with a new date at the top.
Contact
Questions about privacy? Message WhatsApp 0796 599 964 or reach us on Instagram.