ChocoMart Delivery Privacy Policy
Effective and last updated: 15 August 2026
This policy explains how Bombay Store handles information when authorized delivery staff use ChocoMart Delivery (com.bombaystore.delivery).
Who may use the app
The app is for delivery staff whose accounts are created and activated by Bombay Store. It does not offer public self-registration.
Information we handle
| Information | How it is used |
|---|---|
| Staff identifier, name, email, phone number, role, active status, and password hash | To authenticate authorized delivery staff, enforce the delivery role, maintain the staff account, and attribute delivery updates. |
| Local staff session | The app stores the staff identifier, name, email, phone number, and role on the device to keep the staff member signed in until logout. |
| Assigned order and customer information | The app displays order number, customer name and phone number, delivery address, items, prices, totals, status, and timestamps so staff can complete assigned deliveries. |
| Delivery activity | Status changes, completion time, and the staff name or email are written to order history. Completing delivery can also trigger customer cashback and referral ledger updates. |
| Anonymous Firebase authentication identifier | To authorize backend access in addition to the app's staff-role checks. |
Maps and phone calls
The app does not request the delivery worker's device location. When staff tap Open Maps, the delivery address is passed to the device's map handler or Google Maps. When staff tap Call Customer, the customer's phone number is passed to the device dialer. Those external services process information under their own terms and privacy policies.
Services and sharing
The app uses Google Firebase Authentication and Cloud Firestore. Firestore data is configured in the asia-south1 region. Information is available to authorized Bombay Store personnel and service providers only as needed to operate the delivery service, secure the app, comply with law, or resolve disputes.
We do not use an advertising SDK, analytics SDK, crash-reporting SDK, notification SDK, microphone, camera, or device-location permission in the audited delivery app version. We do not sell personal information and do not use it for cross-app tracking.
Retention, security, and staff choices
Staff account and delivery activity data is kept while needed for work assignment, order fulfillment, accounting, fraud prevention, disputes, and legal obligations. Data is transmitted using encrypted network connections. Staff can clear the local app session by logging out.
To request access, correction, deactivation, or deletion of a staff account, contact the Bombay Store administrator or email firebasehostmailid@gmail.com. Historic order status records may be retained or anonymized where needed for business or legal records.
Changes and contact
We may update this policy as the app or legal requirements change. The effective date above will be updated. Questions can be sent to Bombay Store at firebasehostmailid@gmail.com.