Privacy Policy

📊 1. Information We Collect

When you register for a Slurpie account, we collect:

• Full name
• Email address
• Phone number
• Password — stored in a securely hashed format using industry-standard bcrypt encryption. We never store your password in plain text.
• Profile avatar — an image you optionally upload to personalise your account.

To keep your account secure, we generate and temporarily store:

• One-Time Passwords (OTPs): 6-digit codes sent to your email for verification. OTPs expire within 10 minutes and are deleted from our systems immediately after use.
• JSON Web Tokens (JWTs): short-lived session tokens (valid for 24 hours) used to authenticate your requests. These are stored in your browser's session storage and are not retained on our servers beyond active use.

To enable food discovery and pickup coordination, we collect:

• Saved pickup/delivery addresses: including street addresses, city, and any labels you assign.
• Geographic coordinates (latitude and longitude): associated with your saved addresses and with food listings you post, used to calculate distances and display nearby food on the map.

You are in full control of the addresses you save and may add, update, or delete them at any time from your profile.

When you post a food item, we collect:

• Food name, category, type (vegetarian / non-vegetarian), quantity, and weight.
• A price (if applicable) and food image (optional).
• Pickup address and associated geographic coordinates.
• Expiry duration — used to automatically remove listings once they are no longer fresh.
• Your contact number (shared only with users who request a pickup from your listing).

Food listings are automatically and permanently deleted from our systems once their expiry window closes or once all available quantity has been claimed.

When you place an order on Slurpie, we record:

• Items ordered (name, quantity, price, image).
• Total order amount and delivery address.
• Order status (active, delivered).
• An Order ID, which references the payment transaction processed.
• A payment invoice record (transaction ID, amount, payment method, date).

We do not store your card number, bank account details, CVV, or any other sensitive payment credentials.

As part of normal platform operation, we may collect:

• Browser session storage data (e.g., authentication tokens, cached API responses) — this data exists only for the duration of your session and is cleared on logout.
• Server-side logs — including IP addresses, request timestamps, and error messages, used for platform security, debugging, and abuse prevention. These logs are not used for profiling or marketing.

⚙️ 2. How We Use Your Information

We use the information we collect for the following purposes:

We do not use your personal data for advertising, profiling, or sale to third parties.

🤝 3. How We Share Your Information

Slurpie does not sell, rent, or trade your personal data. We share information only in the following limited circumstances:

When you post a food listing, the following is visible to other Slurpie users:

• Food name, category, type, quantity, price, and image.
• Your pickup address (or approximate location on a map).
• Your contact number — shared only as part of the pickup coordination process.

Your email address is never displayed publicly on the platform.

We work with trusted third-party providers to operate the platform. Each provider processes only the minimum data necessary for their function:

• Google Maps — Used to display pickup locations and calculate distances. Geographic coordinates are shared with Google Maps for rendering. This is governed by Google's Privacy Policy.
• MongoDB Atlas — Our cloud database provider (MongoDB, Inc.) stores all platform data on secured, access-controlled servers. Data is stored within their cloud infrastructure and subject to MongoDB Atlas's Data Processing Agreement.
• Nodemailer / Gmail SMTP — Used to deliver OTP verification codes and NGO contact notification emails on behalf of Slurpie. Only your email address and the relevant message content are transmitted.

We may disclose your information if required by applicable law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the safety of our users or the public.

🕒 4. Data Retention

We retain your data for as long as your account remains active and for a reasonable period thereafter to comply with legal obligations. Specific retention practices:

• Food listings: deleted automatically when they expire or when all quantity has been claimed.
• OTP codes: deleted immediately after use or upon expiry (within 10 minutes of generation).
• Order history: retained in your account as a record of your past activity and can be reviewed in your orders section.
• Account data: (name, email, profile) is retained until you request account deletion.
• Server logs: retained for a limited period for security and debugging purposes and are then purged.

🔑 5. Your Rights

You have the following rights regarding your personal data:

• Access: You may request a summary of the personal data we hold about you.
• Correction: You may update your name, phone number, avatar, and saved addresses directly from your profile settings at any time.
• Deletion: You may request deletion of your account and all associated personal data by contacting us. Note that anonymised transaction records may be retained for legal and accounting compliance.
• Withdrawal of Consent: You may stop using the platform at any time. Logging out clears your active session and tokens.
• Data Portability: Upon request, we will provide a copy of your data in a commonly used, machine-readable format.

To exercise any of the above rights, please contact us at the address provided in Section 9.

🍪 6. Cookies & Session Storage

Slurpie does not use persistent tracking cookies. We use browser session storage to temporarily hold:

• Your authentication token (JWT)
• Your cart contents
• Cached API responses (to reduce load times during your session)

This data is automatically cleared when you log out or close your browser session. We do not use cookies for advertising or cross-site tracking.

🛡️ 7. Security Measures

We take the security of your data seriously. The measures we have in place include:

• bcrypt hashing for all stored passwords — your actual password is never stored or readable by anyone, including us.
• JWT-based authentication with short expiry windows (24 hours) to limit the risk of token misuse.
• HTTPS — all data in transit between your browser and our servers is encrypted.
• Access controls — role-based access ensures that sensitive admin functionality is only available to authorised users.
• Automatic data deletion — expired food listings and used OTPs are removed from the system without manual intervention.

No system is 100% immune to risk. If you suspect any unauthorised access to your account, please contact us immediately and change your credentials.

📣 8. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. For significant changes, we may notify you via email or a prominent notice on the platform.

We encourage you to review this policy periodically to stay informed about how we protect your information.

📞 9. Contact Us

If you have any questions, concerns, or requests related to this Privacy Policy or the way we handle your data, please reach out to us: