Privacy Policy

This explains what CraveSorted collects, why, who sees it, and how to control it. CraveSorted is run by SSM Enterprises (a sole proprietorship of Monish Yadav) ("we"). We are the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023.

1. The short version

We use your data to run your stamp cards, rewards and reviews, and to show you cafés. Cafés see your visits to them, never your phone number or birthday.

We do not show ads and do not use tracking or analytics tools.

We share your personal data with partners for money only if you switch on "Share my data with partners" in Settings. It is off unless you turn it on, and you can turn it off at any time.

You can correct your details, switch off every kind of message and sharing, and delete your account with everything in it, from Settings.

2. What we collect

Account: your name, email address, password (stored only as a secure hash by our database provider) and your mobile number, which every account must give. If you sign in with Google we receive your name and email from Google.

Optional: your birthday (day and month only, never the year), used only so cafés can send a birthday message if you allow café messages.

Loyalty activity: your member code, each stamp (which café, when, and which staff member issued it), your cards, rewards earned and redeemed, and friends you invited.

Reviews: your rating, what you wrote, the dishes you ticked, and replies or private messages from the café.

Notifications: your notification settings, the nudges and café messages sent to you, whether you opened them, and your device's push token.

Café owners: café details, menu, photos and videos you upload, messages you send to guests, and staff you add.

Security records: our providers keep technical logs (such as IP address and device type) to keep the service secure, and we keep a log of changes cafés make to their settings.

3. Location

When you allow it, your phone's location is used on your device to sort cafés by distance. To find cafés near you, your approximate coordinates are sent to OpenStreetMap's public map service (Overpass API, Germany). We do not store your location on our servers.

4. Why we use it (purpose)

To create and secure your account; to record stamps and rewards; to show cafés, menus and reviews; to send the nudges and café messages you have not switched off; to help you draft a review when you ask; to prevent fraud and abuse; and to meet legal obligations.

We rely on your consent, which you give when you accept these terms, and which you can withdraw. Withdrawing consent to the core service means closing your account.

5. Who sees your data

Cafés you visit: your name, member code, how often and when you visited, your stamps and rewards there, and your rating of them. Your email address only if you switch on "Share my email with cafés I visit". Never your phone number or birthday.

Café staff: only what they need to stamp your card or redeem a reward.

Other diners: your reviews, shown with your first name and last initial.

Service providers who process data for us, only to run the app: Supabase (database, sign-in, file storage; servers in Tokyo, Japan); Google (Sign in with Google, and Google Places to show a café's public Google reviews, which sends no data about you); OpenRouter and OpenAI (only when you ask for review drafts: the café's name and type, the dishes you ticked, your first name, your number of visits and any note you typed); Expo (delivering push notifications); OpenStreetMap (finding nearby cafés, as above).

Some of these providers are outside India (Japan, the United States, Germany). Transfers happen only to the extent allowed by Indian law.

Authorities, when the law requires us to.

6. Sharing with partners (only if you opt in)

If, and only if, you switch on "Share my data with partners" in Settings, we may share with carefully chosen partners (such as food, beverage and lifestyle brands) your name, email address, mobile number, the cafés you visit and how often, your rewards, and the kinds of food you favour. Partners may use it to send you offers. We may be paid for this.

This is off unless you switch it on. Switching it off stops all further sharing from that moment. Data already shared cannot be taken back from a partner, but partners must stop contacting you on request.

Separately, we may share or sell anonymised, aggregated statistics (for example, "lunchtime visits in Indiranagar rose this month"). These cannot identify you.

7. How long we keep it

As long as your account is open. When you delete your account, your personal data is erased within 30 days, except records the law requires us to keep, and anonymised statistics that no longer identify you.

8. Your rights

You can: get a summary of the data we hold about you and who we shared it with; correct or update it; have it erased; withdraw any consent; nominate someone to exercise these rights if you die or become incapacitated; and raise a grievance.

Most of this you can do yourself in Settings: change your name, number and birthday, switch every kind of message and sharing off, and delete your account. For anything else, write to our Grievance Officer below. We respond as soon as we can and within 90 days.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

9. Children

CraveSorted is only for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a child has an account, tell us and we will delete it.

10. Security

Data is encrypted in transit and at rest by our providers. Access is limited by strict rules in our database, every café sees only its own guests, and sign-in sessions are kept in your phone's secure storage. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Board as the law requires.

11. Changes

If we change this policy in a way that matters, we will tell you in the app and ask you to accept it again before you continue.

12. Contact and Grievance Officer

SSM Enterprises (a sole proprietorship of Monish Yadav), RZF 511/20, Street No. 35, Sadh Nagar, Palam Village, South West Delhi, Delhi 110045, India. Email: support@cravesorted.com.

Grievance Officer: Monish Yadav, support@cravesorted.com.