Privacy Policy

1. Information We Collect

To deliver fresh chicken, meat, seafood, and eggs swiftly and hygienically to your doorstep, we collect only essential personal data:

• Customer Identity & Contact: Full name, verified mobile phone number, and optional email address.
• Delivery Addresses: Street names, house/apartment numbers, landmarks, and GPS pin locations.
• Order History: Product items ordered, quantities, order timestamps, payment methods (Cash on Delivery or UPI / Online), delivery statuses, and cancellation notes.
• Device Identifiers: Firebase Cloud Messaging (FCM) registration tokens used to deliver critical status alerts and notifications.

2. Login: WhatsApp OTP & Google Sign-In

You can log in with Google or with a one-time code sent to your WhatsApp number. Accounts are managed by Google Firebase Authentication:

• WhatsApp OTP: A 6-digit One-Time Password is generated on our server and sent to your mobile number through the WhatsApp Business Platform (Meta Platforms, Inc.) to verify that you own the number. Your number is shared with Meta only to deliver this message.
• OTP Security: Codes expire after 5 minutes, are stored only in hashed (unreadable) form, and are protected by attempt limits and request rate limits.
• Google Sign-In: If you choose Google, we receive your name, email address and profile photo from your Google account to create your GOSHTGO profile.
• No Marketing Spam: We never sell, lease, or distribute your phone number to third-party telemarketers.

3. Location Information & Permissions

GOSHTGO requests location access (ACCESS_FINE_LOCATION and ACCESS_COARSE_LOCATION) only when explicitly permitted by you:

• Purpose: Used solely to position the delivery pin on Google Maps and verify that your address is inside our delivery area.
• Permission Control: You can grant, deny, or revoke location permissions at any time in your Android system settings. You can also manually drop a pin or enter addresses without enabling GPS.
• No Background Tracking: We do not track your location in the background when the app is closed.

4. Order Processing, Customer Support & Notifications

We process your data to:

• Prepare, inspect, package, and dispatch your fresh meat orders.
• Route assigned delivery partners accurately to your doorstep.
• Deliver transactional push notifications regarding order confirmation, butchery status, dispatch, and delivery.
• Provide responsive customer support and investigate refund or replacement requests.

5. Payments & Third-Party Service Providers

• Payment options: Cash on Delivery, or UPI paid directly to our shop's UPI ID by scanning our QR code in your own UPI app.
• No Payment Credentials Stored: We never see or store your UPI PIN, bank or card details. For UPI orders we store only the 12-digit UTR / transaction reference you provide, so our team can match it with the payment received.
• Service Providers: Data is shared only with partners strictly necessary for operations: Google Firebase (hosting, cloud database, authentication, notifications), Google Maps (location and addresses), Meta WhatsApp Business Platform (login codes), and our delivery partners (your name, phone number and delivery address for your order).

6. Data Security, Retention & Deletion

• Encryption: All network communication is encrypted using TLS 1.3/HTTPS. Cloud databases are guarded with granular Firestore security rules.
• Retention Period: Personal details and order histories are retained only as long as necessary for tax, accounting, and consumer protection audit requirements.
• Account & Data Deletion: You can delete your account in the app (Profile > Delete Account) or request deletion without the app on our account deletion page.

7. User Privacy Rights & Consent

Under the DPDP Act 2023, you have rights to:

• Access a summary of personal data held about you.
• Request correction of outdated or inaccurate contact and address details.
• Withdraw consent for marketing communications at any time.
• Lodge a grievance with our designated Grievance Redressal Officer.

8. Cookies & Analytics

• Mobile App: The Android application stores only necessary session keys and UI preferences locally using Android SharedPreferences. No intrusive cross-app tracking SDKs are utilized.
• Website: The GOSHTGO website uses strictly functional cookies to ensure page security and responsiveness.

9. Children's Privacy

GOSHTGO does not knowingly collect personal information from individuals under 18 years of age. If we discover that personal data of a minor has been collected without parental consent, we take immediate steps to delete such data from our records.

10. Policy Updates & Privacy Contact Details

We may update this Privacy Policy from time to time. Any material changes will be reflected with a revised Effective Date.