Privacy Policy

We collect the following categories of information to deliver a seamless, personalised experience:

• Account Information: Name and email address when you register or sign in via Google.
• Profile Data: An optional profile picture you choose to upload.
• Order & Transaction Data: Food order details, payment confirmations, and delivery addresses needed to fulfil your requests.
• Location Data: Approximate location — only when you explicitly grant permission — to show nearby outlets and enable delivery.
• Device Information: Basic device and app-version details used solely for crash reporting and improving stability.

We use collected data exclusively to:

• Create and maintain your account.
• Process food orders and payments securely.
• Personalise your experience and show relevant restaurant recommendations.
• Send order status updates and essential service notifications.
• Diagnose technical issues and continuously improve app performance.
• Comply with applicable legal obligations.

FlashBite requests the following device permissions:

• Camera (android.permission.CAMERA): Used solely to scan QR codes for pickup confirmation and optionally to upload a profile picture. We never capture, record, or store any image or video without your explicit action.
• Internet: Required for all core features including menu loading, ordering, and payments.
• Location (optional): Used to surface nearby restaurants. You may deny this permission; the app will still function with manual address entry.

You may revoke any permission at any time via Settings → Apps → FlashBite → Permissions on your device.

We share your information only with trusted service providers, strictly for delivering core app functionality:

• Firebase (Google): Authentication, real-time database, and cloud storage.
• Razorpay: Secure payment processing. Your full card details are never stored by FlashBite.
• Restaurant Partners: Your name, order details, and delivery address are shared with the relevant outlet to fulfil your order.

All third-party partners are contractually required to keep your information confidential and process it only for the stated purpose.

We retain your personal data for as long as your account is active or as needed to provide services. If you delete your account, we will delete or anonymise your personal information within 30 days, except where longer retention is required by law (e.g., payment and tax records).

We implement industry-standard security measures, including:

• HTTPS encryption for all data in transit.
• Firebase Security Rules to restrict unauthorised database access.
• Secure payment tokenisation via Razorpay — raw card numbers are never stored by us.

No system is 100% secure. If you suspect unauthorised access to your account, contact us immediately.

FlashBite is not directed to individuals under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child under 13 has provided us personal data, we will take immediate steps to delete it.

Under applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct any inaccurate data.
• Delete your account and associated personal data.
• Withdraw Consent for optional data processing (e.g., location) at any time.

To exercise any of these rights, contact us at the email address below.

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. We will notify you of significant changes by updating the "Last Updated" date at the top of this page and, where appropriate, via an in-app notification.