Privacy Policy

This policy covers all three DropEat apps and the DropEat website:

• DropEat — customer app (com.dropeat.customer)
• DropEat Restaurant — restaurant app (com.dropeat.restaurant)
• DropEat Driver — driver app (com.dropeat.driver)

1. What we collect

Data	Why
Email address	Account creation and sign-in. A 6-digit code is emailed to verify it.
Name	Shown on orders to the restaurant and driver.
Phone number	So the customer, restaurant and driver can reach each other during a delivery.
Password	Sign-in. Stored hashed; it cannot be read back by anyone, including us.
Location (GPS)	Setting the delivery address, finding the nearest driver, and showing the driver on the map while a delivery is in progress.
Delivery address	Delivering the order.
Photos	Profile pictures, menu item photos, restaurant photos.
Order history	Showing past orders and calculating payments.
Device notification token	Sending a notification when an order changes state.

2. Location

Location is collected only with your permission. In the driver app, location is sent while the driver is on shift and while a delivery is in progress, so the customer can see where their order is. You can revoke the permission at any time in your device settings; some features, such as filling the delivery address automatically, will then stop working.

3. How it is used

• Managing accounts and sign-in
• Taking, accepting and delivering orders
• Letting the customer, restaurant and driver contact each other
• Sending notifications about order status
• Calculating payments and receipts
• Keeping the service secure and diagnosing technical problems

4. Who sees it

We do not sell data to anyone and we do not use it for advertising.

During an order:

• The restaurant sees the customer's name and order details
• The driver sees the customer's name, phone number and delivery address
• The customer sees the driver's name and map position during delivery

This access is limited to that order and ends when the order is complete.

5. Third-party services

Service	Purpose
Google Firebase (Cloud Messaging)	Delivering push notifications
Resend	Sending the sign-in verification email
OpenStreetMap	Map tiles

6. Security

• All traffic between the apps and the server is encrypted with HTTPS
• Passwords are stored hashed and cannot be read back, including by us
• The server runs behind a firewall with only the necessary ports open
• Database backups are encrypted

7. Retention

Account data is kept while the account exists. Order history is kept for payment reconciliation and accounting.

8. Account and data deletion

You can request deletion of your account and all associated data by emailing dvrmabast@gmail.com.

Requests are actioned within 30 days. Account details, photos and addresses are deleted. Order records are retained in anonymised form where accounting obligations require it.

9. Children

The service is not directed at children under 13 and we do not knowingly collect data from them. The driver app is intended for users aged 18 and over.

10. Changes

If this policy changes, the new version is published on this page with a new effective date.

11. Contact

Questions about this policy or your data: dvrmabast@gmail.com