Privacy Policy

1. What this covers

Ghar Dabba runs three mobile apps and this website: the buyer app for ordering tiffins, the Ghar Dabba Seller app for home kitchens, and the Ghar Dabba Delivery app for delivery partners. This policy applies to all of them, and to ghardabba.com. Ghar Dabba decides what data is collected and why, so it is the data fiduciary for the information described here.

Each app has its own privacy notice shown before you sign in, and each app only ever touches the data its own role needs.

2. Information we collect

Everyone

• Phone number — your sign-in identity. We verify it with a one-time password and store the number against your account.
• Name — the one you enter on your profile.
• Account role and status — buyer, kitchen, or delivery partner, and whether an application is pending, approved, or suspended.
• Push notification token — see section 5.
• Location you allow us to see — see section 4.

Buyers

• Saved delivery addresses: label, recipient name, contact number, address line, area, city and the map coordinates of that address.
• Orders: the items and slots you chose, quantities, the amounts you were charged, payment method and delivery status.
• Tiffin plans you subscribe to, including pause and resume history.
• Ratings and written reviews you leave for a kitchen.

Kitchen owners

• Owner name, contact number, and the kitchen's name, area, city, postal code, door number and street, and map coordinates.
• What you cook and how you sell it: menu items, prices, cooking time, service radius, delivery mode, packaging and delivery fees.
• Your food business licence number and the type of government ID you hold. For kitchens we record the ID type only — we do not ask for or store the ID number.
• Verification photos of the documents themselves, taken with your phone camera at sign-up: your food business licence and one government ID. See section 3 for who can see these.
• Images you publish: a profile photo of yourself, a brand photo for your kitchen, and photos of your dishes. These are part of your shop and are visible to buyers.

Delivery partners

• Name, contact number, base area, city, postal code and street address, and the map coordinates you give us.
• Vehicle type, and your driving licence number when the vehicle you use requires one.
• Your government ID type and number (a national ID, tax ID, passport, residence permit or driving licence) — see section 3.
• Verification photos: one government ID, and your driving licence when your vehicle requires one. See section 3 for who can see these.
• A profile photo of yourself. Buyers see it next to your name and vehicle on the order they have asked you to deliver, so they know who is at the door; it is not shown to anyone outside that order.
• Completed jobs and the delivery fees earned on them.

Apart from the photos listed above, we do not collect your contacts, camera roll, microphone, files, or browsing history, and we do not run advertising or analytics SDKs in any of the three apps, so we do not build an advertising profile of you.

3. Sensitive personal data, and why

A government ID number and a driving licence number are sensitive personal data. We collect them only from delivery partners, only during application, and only for these purposes: confirming the applicant is a real, identifiable adult; matching the person to the vehicle they ride; and being able to answer an accident, theft or police complaint about a specific delivery. Kitchen owners give us a food business licence number for the same reason — home kitchens must show one where they trade, and buyers rely on it being valid.

We never show these numbers to buyers, never use them for marketing, and never send them to third parties except when legally required. Give this data only if you are the person it belongs to.

Document photos. Along with the numbers, kitchen owners and delivery partners send us photographs of the same documents: a food business licence and one ID for a kitchen; one ID and, where the vehicle needs it, a driving licence for a partner. A photograph of an ID carries far more than the number we record — full name, date of birth, address, photograph, and for a national ID the number itself — so we treat these images as the most restricted data on your account:

• They are used for one purpose: verifying that your application is genuine before you can trade.
• They are visible only to you and to Ghar Dabba's review team. Buyers and kitchens never see them, and they are never shown on any public page.
• They are kept out of the public parts of your account record; a reviewer opens them through a private link that expires on its own.
• Uploading them is optional in the sense that a kitchen or partner without them cannot be approved — but you choose which documents to photograph, and you should cover or crop out anything we do not need to see.

Do not photograph a document that is not yours. If we cannot verify an applicant we suspend the application rather than keep a document we have no right to hold.

4. Location

All three apps can ask your phone for its location, and nothing is read until you grant that permission. We use it for one job only: working out what is near you. In the buyer app it powers "kitchens near you" and helps drop a pin on your address. In the Seller app it places your kitchen on a map and measures your service radius. In the Delivery app it is your base area, so the jobs offered to you are ones you can actually reach.

We do nottrack you continuously, we do not record where you are during a delivery, and we do not keep a location history. Addresses and kitchen positions are stored once, as the coordinates you confirmed. You can switch location off in your phone's settings at any time; typing an address still works.

When a kitchen owner or delivery partner confirms a pin, we send those coordinates to your phone's own address lookup — Google's on Android, Apple's on iPhone — to write the street, area and postal code into the form for you. That is the only time a location leaves your account to a map provider, it happens once at sign-up, and nothing is stored from the answer except the address text you accept. We use no paid Maps product and keep no map search history.

5. Push notifications

Order and job alerts are sent as push notifications. To deliver them we store a per-device notification token, linked to your account and the role you were signed in as — a seller token never receives buyer messages. The token is a random identifier, not a device serial.

Signing out removes it, and we delete tokens the notification service reports as dead, so an uninstalled app stops being targeted. Notifications are on by default because a kitchen that is not told about an order cannot cook it; you can turn them off in your phone's settings, which means you will have to open the app to see new orders.

6. Payments

Today orders are paid in cash on delivery, or by UPI directly to the kitchen or delivery partner when they hand over the food. We therefore do not collect card numbers, UPI PINs, bank account numbers, or any other payment credential, and we do not integrate a payment gateway. We do keep a record of how each order was settled and whether it was paid, because that is the only audit trail a disputed delivery has.

7. How we use your information

• To sign you in, and to keep one account tied to one verified phone number.
• To place an order with the right kitchen, at the right slot, at the right address.
• To match delivery jobs to approved partners and to record who picked up and dropped off what.
• To review kitchen and delivery applications before anyone can trade.
• To send you the operational notifications you signed up for.
• To calculate the platform commission, and to reconcile a disputed delivery.
• To answer support requests, and to detect fake orders, review abuse, and account takeovers.
• To meet legal obligations, including food-safety, tax and law-enforcement requirements.

8. Who sees your information

The kitchen you order from receives your name, contact number, delivery address and order contents for that order, plus your ratings of them. They cannot see your other orders, your saved addresses, or anything else on your account.

The delivery partner carrying your order receives the drop name, contact number, address and the amount to collect. They see the pickup point for the job they claimed, and nothing about other jobs. You see the same information in reverse about that partner — their name, profile photo and vehicle — for as long as the order is with them.

The kitchen's door address goes to the rider, not to buyers.In the buyer app a kitchen is shown by name, area and city only. The street address and postal code a kitchen owner confirms at sign-up are read by the delivery partner holding a pickup from that kitchen, so they can find the gate — and by our review team when an application is checked. A partner's own base address is never shared with buyers or kitchens at all.

What a kitchen publishes is public.A kitchen's brand photo, dish photos and the owner's profile photo appear in the buyer app and on this website so people can choose where to order from. Remove them from your Shop tab if you do not want them shown. Verification photos of your business licence, ID and driving licence are the exception: they are not part of your public profile and no buyer, kitchen or partner can open them.

Other kitchens and partners never see your personal details. Ratings are shown to a kitchen with your first name only.

Our service providers. Ghar Dabba runs on Google Cloud and Firebase. Google processes data on our behalf for phone sign-in (Firebase Authentication), the database (Cloud Firestore), server-side functions (Cloud Functions, hosted in the asia-south1 region in India), file storage for the images described above (Firebase Storage, in the same asia-south1 region), push delivery (Firebase Cloud Messaging), and app distribution if you install us from Google Play. Those providers are bound by their own terms and data-processing commitments, and their own privacy notices apply to them.

Nobody else. We do not sell or rent personal data, we do not share it with advertisers or data brokers, and we disclose it to law enforcement only when we are legally compelled to, and only the minimum required.

9. How long we keep it, and deletion

While your account is open we keep your profile, addresses, orders and role data, because the service cannot work without them. After that:

• Buyers can delete their account inside the buyer app. That removes your profile and every saved address immediately and cancels your active plans with the kitchen.
• Kitchens and delivery partners do not yet have a delete button in the app. Ask us at contact@ghardabba.com and we will suspend the account immediately and remove it once any open order, dispute or dues are settled.
• Verification photos (business licence, ID, driving licence) are kept only while your account is open, and are deleted with it. If an application is declined or left unfinished, we delete its document photos within 90 days of the last activity on it — we do not hold ID images for people we did not approve. You can also ask us to delete a photo at any time; the effect is the same as a fresh application, because we need it to keep your account approved.
• Shop and profile photos are removed as soon as you delete them in the app, and with your account. Buyers may still see them in a browser until the page is reloaded.
• Order records stay. A completed order keeps the name, contact number and address that were used for it, because the kitchen and the platform need a food-safety and accounting trail, and tax records must be retained for years. Deleting your account ends the link to your login, but the order itself is not erased.
• You can ask for erasure. Write to us with your registered number and we will remove or anonymise the remaining copies unless we are required by law to keep them, and we will tell you which records we could not delete and why.

10. Your rights

Data protection law gives you the right to: access a summary of the data we hold about you and know who we received it from; correct, complete or update it; erase it, subject to the legal-retention limits above; withdraw the consent you gave us at any time; and nominate someone else to exercise these rights if you are unable to.

You can do most of this yourself in the app. For anything else, write to contact@ghardabba.com from the phone number on your account. We acknowledge requests within two working days and answer within thirty days. You also have the right to complain to the data protection authority for the place you live, and to the contact named in section 13.

11. Security

Traffic between the apps and our servers is encrypted in transit. Access control is enforced in the database itself: every read and write is checked against signed-in identity and role, a buyer cannot read another buyer's orders, a kitchen cannot approve its own application, and a partner can only claim jobs that are genuinely unassigned. Status, commission and rating fields cannot be edited by the account that owns them. Administrative access is limited to a small allowlist of verified phone numbers, and every approval and suspension is stamped with who did it and when.

Uploaded images have their own access rules, separate from the database. Everything you publish as part of your shop is readable by anyone; anything filed as a verification document is readable only by the account that uploaded it, and our reviewers reach it through a link that stops working after a few minutes. A document photo is never given a permanent public address.

No system is unbreakable. Keep your one-time passwords to yourself — anyone who has the code sent to your number can sign in as you. Tell us immediately at the address above if you lose a phone or suspect your account has been used without you.

12. Children

Ghar Dabba is for adults. Nobody under 18 should create an account, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes, and how to reach us

When we change this policy we update the date at the top and, for material changes, announce it in the apps before it takes effect. The current version is always at ghardabba.com/privacy.

Grievance officer, Ghar Dabba: contact@ghardabba.com. The same address handles privacy requests, support, and reports about a kitchen or a delivery partner.