Privacy

What we collect

When you create an account: your email address, and a password stored only as a bcrypt hash, which we cannot read. Optionally your name, phone number and preferred language.

When you order: the delivery address, contact name and phone you enter at checkout, what you ordered, and the price. An order keeps its own copy of the address, so later edits to your saved addresses cannot change where a past delivery says it went.

When you use one of our apps: a Firebase notification token for that device and which app it belongs to. Sessions record the browser or app that created them, so you can tell one from another.

Why we collect it

To take your order to the shop, get it delivered, and let you see it afterwards. To tell you when it is accepted, on its way, or cancelled. To let you sign in, and to limit abuse such as repeated password attempts or mass email requests.

We do not sell your data and we do not use it for advertising.

Who else sees it

The shop you ordered from sees your name, phone number, delivery address and what you ordered. It cannot see anything about your orders from other shops.

A courier sees the delivery address, your name and phone number, and the cash to collect, for the delivery assigned to them and until it is finished.

Signing in with Google

If you sign in with Google, Google tells us your Google account identifier, email address, name and profile picture. We never receive your Google password and we cannot see anything else in your Google account.

Notifications

Notifications are sent through Firebase Cloud Messaging. A device is registered only after you sign in and unregistered when you sign out. Turning notifications off in your phone settings stops them; nothing else about your account changes.

A delivery handover code is never put in a notification, because a notification can be read on a locked screen.

Location

We collect location only from couriers, only while they are carrying a delivery, and we keep only the most recent position rather than a history. Customers and shop owners are not located.

Companies that process data for us

The site and database are hosted by Vercel and Neon. Email is sent through Resend. Sign-in and notifications use Google. Uploaded product photos are held with our storage provider. Each handles data only to provide that service to us.

How long we keep it

Orders are kept as business records, including the address snapshot taken at the time. Notification tokens are deleted when you sign out, and removed automatically once a device stops accepting them. Password reset links expire after one hour and cannot be used twice.

Your choices

You can change your name, phone number and language, and remove a saved address, from your account page. Removing a saved address does not alter past orders.

To ask what we hold about you, or to have your account deleted, write to fakher.alzibari@gmail.com.

Changes

If this policy changes in a way that affects what we collect or who sees it, we will update this page and the date at the top.