HomeToHomeTo

Legal

Privacy Policy

Last updated 26 September 2026

HomeTo is a neighbourhood marketplace. Customers browse local shops and place orders; the shop confirms the order on its own dashboard and delivers it with its own staff (assigning the delivery over WhatsApp), and you pay cash on delivery. This policy explains what information the HomeTo website and mobile app collect, why, who sees it, and the choices you have. It applies to customers, shop owners and visitors.

In short: we collect only what is needed to take and deliver orders and to run shop accounts. We do not sell your data, we do not show ads, we do not use analytics or advertising trackers, and we never see your payment details because everything is paid in cash.

What we collect

Name, phone number and delivery address (customers)To place your order and let the shop confirm and deliver it.The shop you order from, and the delivery staff it assigns your order to (sent over WhatsApp).
Your device location, only if you allow it (customers)To show shops within 10 km of you, and to help the shop find your door if you place an order.The shop you order from and its delivery staff (as a map pin with your order).
Items, prices and totals of your orderTo fulfil the order and keep the shop's records.The shop you order from; the HomeTo platform administrators.
Name, email and password (shop owners)To create your account and sign you in. Passwords are stored only as a one-way hash.Not shared.
Shop details: name, description, address, WhatsApp number, hours, map pin, logo, cover and product photosTo list your shop and products to customers.Shown publicly on your shop page, except your WhatsApp number, which is never shown to customers.
Delivery staff's name and WhatsApp number (entered by shop owners, per order)So the shop owner can send them that order's details and the customer's delivery location.Sent to that phone number over WhatsApp; not shared further.
Push notification token of your phone (shop owners using the mobile app)To alert you when a new order arrives for your shop.Expo's push notification service.
IP address and sign-in activityTo prevent abuse (rate limiting, lockouts) and keep an audit log of sensitive administrator actions.Not shared.

You do not need an account to order. Customers just enter a name, phone number and address at checkout. Accounts exist only for shop owners and HomeTo administrators.

What we do not collect: payment card or bank details (orders are cash on delivery), your contacts, your photos or files (the app asks for photo access only when a shop owner chooses a product picture), advertising identifiers, or your location in the background — location is read only while you use the app or site, and only if you allow it.

Stored on your own device

To save you re-typing, HomeTo keeps a few things in your browser or app storage on your device:

  • your basket for each shop,
  • the name, phone and address you last used at checkout, and your chosen location (or locality),
  • for shop owners, a sign-in session (a secure cookie on the website, secure storage in the app).

These stay on your device. Clearing your browser data or the app's storage removes them. We use only the cookies needed to keep shop owners and administrators signed in — no advertising or tracking cookies.

How we use information

  • to show you shops near you and let you place an order,
  • to send your order to the shop and notify the shop owner that it arrived,
  • to let shops manage their catalogue, orders and settings, and to calculate the fees on each order,
  • to keep the service secure and prevent abuse,
  • to answer support requests and meet legal obligations.

Who we share it with

We do not sell or rent your information. It is shared only as described here:

  • The shop you order from receives your name, phone number, address, optional location pin and order details on its own dashboard, because it must deliver to you. Each shop is responsible for using them only to fulfil your order. When the shop assigns your order to its delivery staff, those same details (and your live location pin, if you shared one) are sent to that person over WhatsApp, which is governed by WhatsApp’s own privacy policy.
  • Service providers who process data on our behalf: MongoDB Atlas (database hosting), Cloudflare R2 (image storage), our web hosting provider, and Expo (delivery of push notifications to shop owners’ phones — the notification contains the order number, customer name, item count and total).
  • OpenStreetMap (Nominatim): when a shop owner or administrator searches for a shop’s location, the text they type is sent to this free map-search service through our server. No account information is sent with it.
  • Authorities, when required by law or to protect the rights and safety of users.

How long we keep it

Order records are kept so shops have an accurate history and so fees between shops and HomeTo can be reconciled. Shop owner accounts and shop data are kept while the account is active. You can ask us to delete your data at any time (see below); we will remove it unless we must keep a record for legal or accounting reasons. Push tokens are removed when you sign out of the app or when the device stops accepting notifications.

Security

Data is sent over HTTPS. Passwords are stored only as salted one-way hashes. Access to shop and administrator areas requires signing in, with repeated wrong passwords temporarily locking the account, and sensitive administrator actions are recorded in an audit log. No system is perfectly secure, but we work to protect your information and limit who can see it.

Your choices and rights

  • You can decline location access and browse by locality instead — the app still works.
  • You can turn off notifications in your phone's settings, or sign out of the app to stop them.
  • Shop owners can view and edit their shop details, products and location pin in Settings.
  • You can ask us to access, correct or delete the information we hold about you, or withdraw consent, by contacting us below. Depending on where you live you may have further rights under applicable law, such as India's Digital Personal Data Protection Act, 2023.

Children

HomeTo is not directed at children under 18, and we do not knowingly collect their information.

Changes to this policy

If we change this policy we will update the date above and, for significant changes, notify shop owners in the app or on the website.

Contact us

Questions, or a request to access or delete your data? Email [set NEXT_PUBLIC_SUPPORT_EMAIL].