TownCrave

Privacy Policy

Effective 25 October 2026. This policy explains what TownCrave collects, why, who sees it, how long we keep it, and how we protect it. It applies to the TownCrave website, the TownCrave app, and everyone who uses them: customers, shops and restaurants, service providers, riders and affiliates.

Our promises

• We collect the least we need to take, deliver and settle orders, and to check that sellers, riders and affiliates are who they say they are.
• We never sell your information, rent it, or share it for advertising. We do not build advertising profiles and we do not use your data for credit scoring.
• Your phone number and address are shared only for an order, only with the shop and rider handling it, and they disappear from their screens when the order closes.
• ID documents are private. They are never public links, only authorised TownCrave staff can open them, and every opening is recorded.
• You stay in control. You can see, correct and delete your information, and you can stop sharing your location at any time.

Pakistan does not yet have a general data protection law in force. We follow the right to privacy in Article 14 of the Constitution, the Prevention of Electronic Crimes Act 2016 (PECA), and the standards in the draft Personal Data Protection Bill. When a data protection law comes into force, we will follow it and update this policy.

Who is responsible

TownCrave, Dunyapur, Punjab, is responsible for your information. Our grievance officer handles privacy questions, requests and complaints. Contact details are at the end of this page.

What we collect and why

Who	What we collect	Why
Customers	Name, mobile number, password (stored only as a secure hash, never readable), or Google account name and email if you use Google sign-in	To create your account and let the shop and rider handling your order reach you
Customers	Orders: items, prices, shop, delivery landmark, delivery or pickup, discount code, ratings and complaints	To process and deliver each order, keep a receipt, and handle refunds and complaints
Customers (optional)	A delivery pin, only if you choose to share your location at checkout	To help the rider find you
Sellers	Business name, category, area, hours, prices, photos, shop location if added, and the owner's mobile number	To show your shop to customers and riders
Sellers, riders, affiliates	Food businesses: their Punjab Food Authority licence. TownCrave riders: their driving licence and bike papers. CNIC images only if you were asked to upload them by hand (for example, when the ID check could not be used)	To verify who you are and that you may sell or deliver
Sellers, riders, affiliates (ID check)	From the ID check run by Didit: your name, the last 4 digits of your CNIC, and whether the check passed	To confirm the CNIC is real and belongs to the person signing up. Your CNIC photos and selfie go to Didit, not to TownCrave. We never store your full CNIC number, and we do not receive or keep the photos or the selfie
Affiliates and riders	Payout details: JazzCash or Easypaisa number, or bank name, IBAN or account number and account title	To pay you
Riders	Live location from your phone, only while you have an order on the way	To show that customer where their order is
Everyone	IP address, and basic device and browser information	Security: stopping fraud, abuse and password guessing

We do not collect your contacts, photos (except the ones you upload), microphone, call logs, SMS messages or location in the background. If we ever need something new, we will update this policy and tell you first.

How we use it, and what we never do

We use your information only to run TownCrave: to create your account, take and deliver orders, show shops their orders, pay shops, riders and affiliates, check identities, answer complaints, keep the service safe, and meet legal duties.

We never:

• sell, rent or trade your information;
• use it for advertising, or let advertisers or data brokers use it;
• show your phone number or address to other customers;
• let a shop or rider keep your details for marketing (our seller and rider terms forbid it);
• make a final decision about you by machine alone. The automatic ID check helps our staff; a person at TownCrave makes the final verification decision.

Who can see your information

• The shop you order from sees your name, items and order details. It sees your phone number and landmark only after it accepts the order, and your phone number is hidden again once the order is closed.
• The rider delivering your order sees your name, phone number, landmark and delivery pin for that order only, after taking the delivery.
• You (customer) see the rider's first name, phone number and live position while your order is on the way.
• Affiliates see the names and progress of businesses they brought, never the owners' phone numbers.
• TownCrave staff see account and order records only to run the service and handle complaints. Only authorised staff can open CNIC, licence and bike-paper images, and every time they do, it is logged.
• Service providers that run parts of TownCrave for us, each only for its own job: Cloudflare (hosting, database and file storage), Didit (ID check for sellers, riders and affiliates: it receives your CNIC photos and selfie, checks them, and keeps them under its own privacy policy and retention rules), Google (only if you sign in with Google), OpenStreetMap (map tiles for the delivery map) and Google Fonts (website text). Some of these providers process data outside Pakistan. They are bound by their own security and privacy commitments and may not use your data for their own purposes.
• Authorities, only when Pakistani law requires it, such as a valid request under PECA 2016 or a court order. We check each request and share only what it lawfully requires.

Live location tracking

• Location is collected only from riders, only while a delivery is marked "on the way", about every 10 seconds, and only while the rider has the TownCrave page open.
• Only the customer of that order and TownCrave staff can see it. The shop sees the rider's name, not the position.
• The rider's position and the customer's delivery pin are deleted within 24 hours after the order is delivered or cancelled. We keep only the pickup and delivery times.
• Riders are told before sharing starts, and it stops automatically when the delivery ends. A rider can stop sharing at any time by closing the page or turning location off.

How we protect your information

• Encrypted connections: every connection to TownCrave uses HTTPS, and browsers are told to use only secure connections.
• Passwords: stored only as salted PBKDF2 hashes, never in readable form. Changing your password logs out your other devices.
• Logins: login tokens are stored only as hashes. Repeated wrong passwords, codes and staff logins are blocked for a while.
• Documents: ID images are kept in private, encrypted storage with no public address. They are opened only by authorised staff, and each opening is logged.
• Website protections: strict security headers stop other websites from framing TownCrave or running unknown scripts on it.
• Least access: each person sees only what their role needs, and staff access is recorded.

No system is perfectly secure. If a breach puts your information at risk, we will tell affected people as soon as we can, aiming for within 72 hours of finding out, explain what happened and what to do, and report it where the law requires.

TownCrave will never ask for your password by phone, WhatsApp or SMS, and never asks you to pay into a personal account. The joining fee is paid only to TownCrave's official account shown in the app. If someone asks you for your password or for money in TownCrave's name, do not pay, and tell our grievance officer.

Cookies and storage on your device

The website and app store a login token on your device so you stay logged in, and remember small settings such as your cart. We do not use advertising or tracking cookies, and we do not use analytics that follow you across sites. Google sign-in (if you use it) and the map and font providers above may receive your IP address when your device loads them.

How long we keep it

Information	How long
Rider live location and customer delivery pin	Up to 24 hours after the order closes
Order records and receipts	6 years, for tax and dispute records
CNIC, licence and bike-paper images	While the account is active, then deleted within 90 days after it closes, unless needed for an open complaint or legal matter
ID check result (name, last 4 CNIC digits, pass or fail)	While the account is active, then deleted with the account
Payout details	While the account is active; payout records 6 years
Customer account (name, phone)	Until you delete your account
Login sessions	Up to 60 days, or until you log out
Records of staff actions (verifications, document views)	6 years, as an audit trail
Security logs (wrong-password and abuse counters)	Up to 90 days

Your rights

You can:

• see and correct your name and phone number in Account;
• get a copy of the information we hold about you;
• delete your account in the app or website (Account, then Delete my account). Your name, phone number, email, password, Google link, ID check and your own ID documents are removed. Past order records are kept without your contact details, as the law requires;
• withdraw consent for optional things, such as sharing your delivery pin, at any time;
• object to a use of your information you think is unfair, or ask us to restrict it while we look into it;
• complain to our grievance officer. We reply within 15 days. If you are not satisfied, you can go to the courts, and for cybercrime you can report to the National Cyber Crime Investigation Agency (NCCIA).

To make a request, contact the grievance officer below from the phone number on your account, or tell us how to confirm it is you. We will not charge you.

Children

TownCrave accounts are for people aged 18 or over. Sellers, riders and affiliates must be 18 or over and hold a valid CNIC. If we learn that someone under 18 has an account, we close it and delete their information.

Changes to this policy

We post the new version here with its date. For important changes, such as collecting new kinds of data or sharing it in a new way, we tell you in the app at least 7 days before they apply.

Contact and grievance officer

Questions, data requests and complaints go to TownCrave's grievance officer, who replies within 3 working days.

Business name	To be published
Address	To be published
Grievance officer	To be published
Email	support@towncrave.com
WhatsApp / phone	To be published
Hours	To be published

TownCrave, Dunyapur, Punjab, Pakistan.