A Loyalty Program for DoorDash & Grubhub Orders
It's easy to assume a restaurant that does steady volume on DoorDash and Grubhub is also building a customer base — that somewhere behind all those orders is a growing list of people the restaurant could reach again. It isn't, and the reason has nothing to do with how good the food is. Both marketplaces hand a restaurant the order and keep the customer. Every order arrives as a self-contained transaction, and once it's delivered, the restaurant has no way back to that person unless they happen to order again through the same app.
The same missing piece, on two more platforms
This is the same structural gap covered in the Uber Eats version of this problem: no marketplace in this category is built to hand a restaurant a reusable way to reach the person who ordered. DoorDash and Grubhub aren't exceptions — a restaurant sees each order through the marketplace's own interface, with no persistent email, no direct phone number, and no order history that ties one visit to the next. The specifics of what each API exposes differ; the shape of the problem doesn't. A regular on DoorDash and a regular on Grubhub are both, as far as the restaurant can tell, first-time customers every single time.
The bag is the one channel still under your control
None of that means the relationship has to end where the marketplace's data does. It means the restaurant has to build the contact itself, at the only point in the whole transaction it still fully owns: packing the order. Whatever DoorDash or Grubhub does or doesn't expose about the person on the other end of the delivery, the restaurant still controls what goes in the bag. A small printed card with a QR code, dropped in alongside the food, doesn't depend on either marketplace's app, account system, or API at all — it's a piece of paper the restaurant put there.
That's the part worth building around, because it's the one lever that's entirely the restaurant's, independent of whatever DoorDash or Grubhub decide to change about their own data-sharing rules next quarter.
What actually happens when the code gets scanned
Ruffus generates these as single-use QR codes, printed in a batch from the dashboard and cut apart like tickets — a merchant prints a stack, keeps it by the packing station, and drops one in with each delivery or takeout order. A customer who has never given the restaurant a phone number, an email, or even their real name can scan the code on their own phone once the bag arrives, and in about five seconds they're looking at a stamp card that belongs to that restaurant. No app to download, no account to create with a password — the card either lands in their Apple or Google Wallet or opens as a page they can bookmark, and either way it's tied to their own phone, not to the marketplace's.
From that scan onward, the restaurant has something DoorDash's and Grubhub's own dashboards were never going to give it: a direct line to that specific customer, independent of whether the marketplace shows a phone number, an email, or nothing at all. The restaurant didn't need the marketplace's cooperation to get there — it needed a code in the bag and a customer curious enough to scan it.
Why the code has to be single-use
A QR code taped to a napkin holder or printed once and reused across every order for a month has an obvious problem: it can be photographed, screenshotted, and passed along to anyone, and the restaurant ends up handing out stamps to people it never actually served. Single-use closes that hole by construction. Each code in the batch is good for exactly one scan, so the number of stamp cards that can be started from a print run is bounded by how many codes the restaurant actually printed — not by how far a photo of one can travel. That's what turns the bag-insert from a nice idea into something a loyalty program's math can actually rely on, the same way it does for the stamp-based punch cards this replaces at the counter.
It's also what makes the mechanic honest with the customer: scanning a code that's already been used fails cleanly, rather than silently letting a second person claim a stamp meant for someone else's order.
No terminal, no reader, no integration
Because the code is printed paper and the redemption happens entirely on the customer's own phone, there's nothing for the restaurant to install at the delivery station and nothing to request from DoorDash or Grubhub. It's the same underlying mechanism — a code the customer's camera reads, not a reader the restaurant has to buy — already used at the counter for customers who'd rather scan than tap, just pointed at a channel that has no counter at all. A restaurant that has never plugged Ruffus into a point-of-sale system, and has no plans to, can still print a batch of these before the Friday dinner rush and start using them the same night.
What the restaurant gets to decide
Once that first scan happens, everything that follows is the restaurant's call, not the marketplace's. Send a stamp toward a free item, run an occasional message, or just let the card sit quietly in the customer's Wallet until their next order — the point isn't any one of those choices, it's that the restaurant finally has a customer it can make the choice about. DoorDash and Grubhub were never going to hand that over. A code in the bag is how a restaurant takes it.
The short version
DoorDash and Grubhub give a restaurant the order, not the customer — no reusable contact info, no persistent identity, nothing that survives past that one delivery, for the same underlying reason a delivery marketplace has for any platform it runs. A single-use QR code dropped in the bag sidesteps that entirely: it doesn't ask either marketplace for anything, it costs a restaurant a few seconds of printing, and it turns a customer who was a stranger on delivery number forty into someone the restaurant can actually reach on delivery number forty-one.