This Privacy Policy explains how the gFOOD mobile application (the “App”, “we”, “us”) collects, uses, discloses and protects your information when you use the App on Android or iOS. By creating an account or otherwise using the App, you confirm that you have read this policy and agree to its terms. If you do not agree, please do not use the App.
We comply with Google Play’s User Data policy, Apple’s App Store privacy requirements, and Ghana’s Data Protection Act, 2012 (Act 843).
- Information we collect
- How we use your information
- Device permissions we request
- How we share information
- Third-party services we rely on
- Payments & mobile-money receipts
- Push notifications
- Data retention
- How we protect your data
- Your rights and choices
- Account & data deletion
- Children
- International transfers
- Changes to this policy
- Contact us
1. Information we collect
We collect only the information needed to operate the App and process your orders. We do not sell your personal data, and we do not use it for advertising or behavioural profiling.
| Category | What it includes | Why we need it |
|---|---|---|
| Account information | Your name, Ghana phone number, account password (stored only as a one-way bcrypt hash; we never see or store your plain password), and your role (customer, restaurant owner or admin). | To create your account, sign you in, and let restaurants reach you about your order. |
| Order information | The items you add to your cart, the restaurant you ordered from, subtotal, tax, delivery fee, total, payment method, and the order’s status history. | To place, fulfil and track your order, and to show you a history of past orders. |
| Mobile-money receipt image (optional) | If you choose to pay by Mobile Money (MoMo), you may upload a screenshot of the transfer confirmation. Images are uploaded directly to our image host (Cloudinary) and the image URL is stored alongside your order. | To let the restaurant verify that the MoMo transfer was actually made before they prepare your order. |
| Restaurant profile (restaurant owners only) | Restaurant name, logo, cover photo, contact phone, MoMo number and account name, accent colour, menu items (name, description, price, photo), and when you accepted our Terms of Use. | To list the restaurant in the App and process customer orders. |
| Push notification token | An anonymous device push token issued by Expo / Firebase Cloud Messaging (Android) or Apple Push (iOS). | To send you order-status updates and (for restaurant owners) new-order alerts. |
| Support messages | Messages you send through the in-app support chat, plus the timestamp and your account ID. | To answer your questions and resolve issues. |
| Order chat | Messages between you and a restaurant, and whether either side has blocked the chat. | To sort out order details, and to stop unwanted messages when someone is blocked. |
| Reports | Reports you send about a restaurant or another user: the reason you pick and any note you add. | To review and remove content or accounts that break our Terms of Use. |
| Technical / log data | Generic information our backend logs while serving requests: IP address, request path, HTTP status, timestamp, user-agent. We do not use any third-party analytics SDK inside the App. | To debug crashes, monitor abuse, and keep the service available. |
Information we do NOT collect: we do not collect your precise GPS location, your contacts, your microphone audio, your SMS messages, your photos beyond the single receipt image you choose to upload, your installed-apps list, or any advertising identifier.
2. How we use your information
- To create and authenticate your account.
- To show you nearby restaurants, their menus, and accurate prices.
- To let you add items to a cart, place orders, and track their status.
- To let restaurants you have ordered from contact you about your order.
- To send you push notifications about order status changes (you can revoke this at any time in your device settings).
- To answer your support requests.
- To review reports of content or accounts that break our Terms of Use.
- To detect, investigate and prevent fraud, abuse and security incidents.
- To comply with our legal obligations under Ghanaian law.
We do not use your data to train any AI / machine-learning model, and we do not share it with advertising networks.
3. Device permissions we request
The App only requests permissions it actually needs to provide a feature you have just used.
| Permission | When we ask | What it’s used for |
|---|---|---|
| Camera | Only when you tap “Take photo” on the MoMo payment screen or when a restaurant owner adds a menu-item photo. | To let you capture a receipt or menu photo. The image stays on your device until you confirm upload. |
| Photos / Media | Only when you choose a photo to upload: a MoMo receipt, a menu-item photo, or a restaurant cover photo or logo. On Android 13+ we use the system Photo Picker, so the App never sees your full library. | To let you pick an existing photo to upload. |
| Notifications | Once, the first time the App needs to send an order update. | To deliver order-status notifications. You can disable this anytime from your device settings. |
| Network / Internet | Always. | The App is online-only — needed to talk to our backend. |
| Vibrate | Always. | To vibrate your device when a notification arrives. |
The App does not request location, microphone, contacts, SMS, call-logs, background location, accessibility services, or “display over other apps” permissions.
4. How we share information
We share the minimum information necessary, and only with the parties below:
- The restaurant you ordered from — receives your name, phone number, the items you ordered, your delivery instructions (if any) and the receipt image you uploaded for MoMo payments. They need this to prepare and deliver your order.
- Everyone using the App — restaurant names, logos, cover photos and menus are public inside the App.
- Nobody you report — reports are private; the restaurant or user you report is not told who reported them.
- Our service providers (listed in section 5) — process data only on our instructions and under written contracts.
- Law-enforcement or courts — only when we have a valid legal request under Ghanaian law, or when we believe in good faith that disclosure is necessary to prevent harm.
- A successor entity — if gFOOD is acquired, merged with another company, or transferred, your information may move with the App. We will notify you and the new operator must honour this policy.
We do not sell, rent or trade your personal information.
5. Third-party services we rely on
| Service | Purpose | Privacy policy |
|---|---|---|
| Render | Hosts our backend API. | render.com/privacy |
| MongoDB Atlas | Stores account, order and support data. | mongodb.com/legal/privacy-policy |
| Cloudinary | Hosts uploaded receipt, menu, restaurant cover and logo images. | cloudinary.com/privacy |
| Firebase Cloud Messaging (Google) | Delivers Android push notifications. | firebase.google.com/support/privacy |
| Expo Push Notifications | Routes notifications from our server to FCM / APNs. | expo.dev/privacy |
| Apple Push Notification service | Delivers iOS push notifications. | apple.com/legal/privacy |
6. Payments & mobile-money receipts
The App supports two payment methods:
- Cash on delivery — no payment information is collected by the App.
- Mobile Money (MoMo) — you transfer the order total directly to the restaurant’s MoMo number using your normal MoMo app or USSD code. The App never sees, stores or processes your MoMo PIN, balance or any banking credential. After the transfer, you may upload a screenshot of the confirmation so the restaurant can verify it; that image is stored only against your order.
7. Push notifications
When you grant notification permission, your device generates an anonymous push token which we associate with your account. We use it only to send:
- Order status updates (placed, accepted, preparing, ready, delivered, cancelled).
- (Restaurant owners only) Alerts for new incoming orders.
- (Admins only) Operational alerts such as new restaurant registrations.
You can revoke notification permission at any time from your device settings. The token is deleted from our backend when you log out or uninstall the App.
8. Data retention
- Account & profile — kept while your account is active.
- Order history — kept for as long as your account is active so you can review past orders. After account deletion, anonymised order summaries (date, total, restaurant) may be retained for accounting and tax purposes for up to seven (7) years, as required by Ghanaian tax law.
- Receipt images — retained for 90 days after the order is completed, then automatically deleted from Cloudinary.
- Support chat — retained for 12 months after the last reply, then deleted.
- Server access logs — retained for 30 days.
- Push tokens — deleted on logout, uninstall, or after 60 days of inactivity.
9. How we protect your data
- All traffic between the App and our backend uses HTTPS / TLS.
- Passwords are stored as one-way bcrypt hashes; we cannot recover your password and we do not log it.
- API endpoints that return personal or order data require a valid JSON Web Token (JWT) bound to your account.
- Admin and restaurant-owner endpoints additionally check role membership server-side on every request.
- Our backend runs on a managed cloud platform with isolated networking and routine security patching.
No internet service is 100 % secure. If we ever discover a personal-data breach affecting you, we will notify you and the Ghana Data Protection Commission within the timelines required by Act 843.
10. Your rights and choices
Under Ghana’s Data Protection Act, 2012, you have the right to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or out of date.
- Delete your account and personal data (see next section).
- Object to or restrict processing in certain cases.
- Lodge a complaint with the Ghana Data Protection Commission (dataprotection.org.gh).
To exercise any of these rights, e-mail us using the details in section 15. We respond within 30 days.
11. Account & data deletion
You may delete your account at any time. Two ways:
- Inside the App — tap your profile picture, then Account & privacy → Delete account. The action is irreversible.
- By e-mail — send a request from the address you used to register to the contact in section 15. We confirm by reply within 7 days and complete deletion within 30 days.
What deletion removes:
- Your account record (name, phone, password hash).
- Your push notification tokens.
- Your support chat history.
- Your saved cart.
What may survive deletion (and why):
- Anonymised order records — for accounting and tax compliance, kept for up to seven years, with your name and phone replaced by deleted.
- Server access logs containing your former account ID — for up to 30 days, then auto-deleted.
12. Children
The App is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has created an account, please contact us and we will delete the account and any associated data.
13. International transfers
Our backend, database and image storage are operated by service providers whose data centres may be located outside Ghana (typically in the United States or the European Union). Where we transfer your personal data internationally we rely on the recipient’s contractual commitments to apply protections at least equivalent to those required by Act 843.
14. Changes to this policy
We may update this policy from time to time. When we do, we will change the Effective date at the top and, for material changes, notify you inside the App or by push notification. Continuing to use the App after the effective date of an updated policy means you accept the changes.
15. Contact us
For privacy questions, data-access requests, or account-deletion requests:
- E-mail: abudustephen72@gmail.com
- App package: com.gfood.app
- Location: Accra, Ghana
If you are unsatisfied with our response you may complain to the Ghana Data Protection Commission.