Privacy Policy

KosherEats ("we," "us," or "our") operates the KosherEats mobile applications (Consumer, Seller, and Courier) and the website at koshereats.shop (collectively, the "Service"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Service.

Information you provide

• Account information: name, email address, phone number, and password when you create an account.
• Delivery addresses: street address, city, state, ZIP code, and geographic coordinates for order delivery.
• Payment information: payment card details are collected and processed directly by our payment processor, Stripe. We do not store full card numbers on our servers.
• Order history: items ordered, restaurants, delivery details, tips, and order timestamps.
• Chat messages: messages you send within the order chat feature to communicate with your courier or restaurant.
• Courier onboarding documents: driver's license, insurance, vehicle registration, and a selfie photo, collected during the courier application process.

Information collected automatically

• Device information: device type, operating system version, and push notification tokens for delivering order updates.
• Location data: precise GPS location when you grant permission, used to show nearby restaurants (consumer app) and track delivery progress (courier app). The courier app collects location in the background during active deliveries only.
• Usage data: pages viewed, features used, and interaction timestamps for improving the Service.

• Process and deliver your food orders.
• Facilitate communication between consumers, restaurants, and couriers via order chat.
• Send push notifications about order status updates (e.g., "Your order is on the way").
• Process payments and courier payouts through Stripe and Stripe Connect.
• Conduct background checks on courier applicants through our third-party provider (Checkr).
• Verify courier identity and vehicle information during onboarding.
• Improve, personalize, and optimize the Service.
• Respond to customer support requests.
• Comply with legal obligations.

We do not sell your personal information. We share data only in these limited circumstances:

• Restaurants: receive your name, delivery address, and order details to prepare your food.
• Couriers: receive the restaurant address, your delivery address, and your first name to complete the delivery.
• Payment processors: Stripe processes payments and courier payouts. Their use of your data is governed by Stripe's Privacy Policy.
• Background check provider: Checkr processes courier background checks. Their use is governed by Checkr's Privacy Policy.
• Cloud infrastructure: we use Amazon Web Services (S3) for document and image storage, and Fly.io for application hosting.
• Legal requirements: we may disclose information if required by law, regulation, or legal process.

We retain your account information for as long as your account is active. Order history is retained for record-keeping and dispute resolution. Courier onboarding documents are retained for the duration of the courier's active status plus any legally required retention period. You may request deletion of your account and associated data by contacting us.

We implement industry-standard security measures including encrypted data transmission (TLS/HTTPS), secure password hashing (bcrypt), token-based authentication (JWT), and rate limiting on authentication endpoints. Payment card data is handled entirely by Stripe and never touches our servers.

• Access and correction: you can view and update your profile information in the app at any time.
• Deletion: you may request deletion of your account by contacting us at privacy@koshereats.shop.
• Location: you can revoke location permissions in your device settings. This may limit the ability to show nearby restaurants or track deliveries.
• Push notifications: you can disable push notifications in your device settings.
• Marketing: we do not send marketing emails. All communications are transactional (order updates, account security).

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly.

The Service may contain links to third-party websites or services (e.g., restaurant websites, Stripe payment pages). We are not responsible for the privacy practices of these third parties.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. Your continued use of the Service after changes constitutes acceptance.

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

Email: privacy@koshereats.shop