Lemon Lime Canteen · IUBAT — International University of Business Agriculture and Technology · Last updated 3 October 2026
This policy covers the Lemon Lime — IUBAT Canteen Android
app (info.iubat.lemonlime) and the website at cafe.iubat.info.
The app is published on Google Play by the developer elaichix, who built and maintains it for the Lemon Lime canteen at IUBAT. The canteen runs the service for IUBAT students and staff. In this policy, “we” means elaichix and the canteen together.
| Information | Why we have it |
|---|---|
| Your name and ID number | Supplied by the university's own student and employee records so the canteen can recognise you. You do not enter these; they are already on file when you first activate your account. |
| Your email address | Only if the university's staff records hold one for you, or if you
type your address — for example
ID@iubat.edu — to sign in. It is used only to find
your account. We never send marketing to it. |
| Your password | Stored only as an irreversible cryptographic hash. Nobody at the canteen can read it, including the people who run this system. |
| Your orders | What you ordered, what it cost and when, so the counter can serve you and you can see your own history. |
| Your wallet balance and transactions | Top-ups made at the counter and payments taken from the balance. This is your money, so we keep an accurate record of it. |
| Sign-in sessions | A token that keeps you signed in. In the app it lasts up to 90 days from your last use, so you are not asked to sign in at every visit. It is cancelled when you sign out or your password is reset. |
| Failed sign-in attempts | The network address an attempt came from, kept briefly, so that somebody guessing at passwords can be slowed down. This protects your account. |
| Crash reports (app only) | If the app closes unexpectedly it keeps the technical error, the app version, your Android version and your phone's model, and sends them the next time you open it. This is how we find and fix faults. It contains no personal message, photo or file. |
The app does not ask for, and cannot see:
Nobody outside the canteen. We do not sell your information, we do not share it with advertisers, and there is no third-party analytics or tracking in this app. Crash reports go to the university's own server — not to Google, Firebase or any outside company.
The only exception is a legal one: we would disclose information if IUBAT were required to by law.
Traffic between the app and cafe.iubat.info is encrypted in transit (HTTPS). Passwords are stored hashed, never in readable form. Access to canteen records is limited to canteen staff accounts, and sensitive actions are logged.
Your account and its order and wallet history are kept while you are at IUBAT, because they are the record of money you have paid in and spent. Sign-in attempt records are short-lived. Crash reports are kept in the server's log files, which are overwritten as they fill, within 12 months.
You can ask for your Lemon Lime account to be closed and your personal data removed at any time. You do not need to uninstall the app first.
What is deleted: your password, your email address and phone number, every sign-in session (you are signed out everywhere), and records of failed sign-in attempts. The account can no longer be signed in to.
What is kept, and why: your name and ID number, attached to your past orders, wallet transactions and any tab payments. These are the canteen's financial records of money paid and meals served, kept for up to 5 years for the canteen's accounts and then deleted. Crash reports already sent stay in the server's logs until they are overwritten, within 12 months.
This app is for enrolled IUBAT students and staff. It is not directed at children and is not designed for them.
If this policy changes, the date at the top of this page changes with it.
Questions about your data: arafat@iubat.edu, or ask at the canteen counter.