Why there is no login

You can use every part of this site without telling us anything. There is no sign-up, no email capture, no "continue with" button, no password to forget. Your tray, your order history, your streak and your collected couriers all live in your own browser and go nowhere else.

That was not a privacy stance we adopted after the fact. It was the shape of the thing from the first sketch, and it made a lot of other decisions easy.

What a login is actually for

Accounts exist for three reasons, and it is worth separating them.

• To keep your data with you across devices. Genuinely useful.
• To let a service charge you, support you, or stop you doing something twice. Necessary if any of those apply.
• To give the company a durable identifier so it can build a picture of you over time. Very useful to them.

Look down that list from where this site sits. Nothing is charged, so there is nothing to bill. Nothing is shipped, so there is nothing to support. Nothing you do here affects anybody else, so there is nothing to police. Only the first reason survives, and it applies to a tray of imaginary noodles.

Which leaves the third reason as the only real argument for an account — and "we would learn things about you" is not a reason we are willing to charge you for a product that is otherwise free.

Where your stuff actually lives

Everything is written to your browser's local storage under a handful of keys. That is a small box of text that belongs to your browser, on your device, that only pages from this site can read. We never send it anywhere, because there is nowhere to send it: no backend, no database, no analytics pipeline waiting for it.

The practical consequences are worth being blunt about:

• Clear your browser data and your order history is gone. Not archived. Gone, permanently, with no way for anyone to restore it.
• Your phone and your laptop are two different worlds. There is no sync, and there cannot be without a server.
• Private browsing keeps nothing after you close the tab.
• We cannot look up your account, because there is no account to look up.

We would rather you know that up front than discover it after a streak you were proud of.

The party trick

The one place we needed to share state was the shared tray — putting an order together with friends. That normally requires a server, because two people have to see the same thing.

Instead, the whole tray is encoded into the link. Everything about the shared order lives in the URL itself, so sending someone the link literally sends them the data. It is why there are limits on how many people and how many items a party can hold: the whole thing has to survive inside a web address. That constraint is annoying about twice a year and worth it the rest of the time.

What we give up

This is not a free lunch, and it would be dishonest to present it as one.

We cannot tell you which dishes are popular, because we do not know. We cannot restore anything for anyone. We cannot email you when something new lands, which means the only way to find out is to come back. And we will never be able to show you a personal page on a new phone, because from a new phone you are a stranger to us in the most literal sense.

There is also a version of this site that would be more successful with accounts. More retention, more measurable, easier to explain. We are not claiming we resisted a great temptation heroically — we mostly just liked how light it felt without one.

The test we apply

When we consider a feature now, the question is: does this need to know who you are? If yes, it usually means the feature is really about us rather than you, and it does not get built.

It is a crude test. It has stopped a few good ideas. It has also meant that the honest answer to "what do you do with my data" is short enough to fit in a sentence, and we think that is worth more than most of what an account would have bought us.