Privacy Policy

GhorerRanna is a meal service operating in Dhaka, Bangladesh. You sign up once, tell us about your household and food preferences, and we arrange recurring everyday meals for you — breakfast, lunch and dinner — cooked by a local home chef and delivered to your address.

We are not a restaurant and we do not cook the food ourselves. Meals are prepared by independent home chefs and, where relevant, delivered by independent riders. GhorerRanna operates the platform that collects your plan details, connects you with a chef, and coordinates the service.

This policy applies to the GhorerRanna website and app at ghorerrannaapp.com (including www.ghorerrannaapp.com) and ghorerranna.lovable.app. In this policy, "we", "us" and "GhorerRanna" mean the GhorerRanna service.

We collect only what we need to run the service:

• Account information. Your email address, and a password if you sign up with email. If you sign in with Google or Apple, we receive account information from that provider instead of a password (see section 4).
• Contact and delivery details. Your name, phone number and delivery address, as you enter them during meal setup or in your account.
• Household and meal plan details. How many adults and children you are feeding, your chosen plan length, your diet choice, foods you want avoided (including anything you type in the "other" field), and your preferred breakfast, lunch and dinner times.
• Subscription and service records. Your plan status, the plan price, the name of the home chef you have been connected with, any cancellation request, notes our team records about your plan, and the date your plan was created or edited.
• Meal feedback. Your responses to our "how was breakfast / lunch / dinner" prompts, including the reason you select when a meal was not good.
• Orders and order history. If you use the marketplace ordering part of GhorerRanna, we store your orders, the items ordered, the delivery address used, order status, and messages you send to a chef about a dish or an order.
• Payment-related records. We do not process card payments and we never store card numbers. For marketplace orders paid with bKash, we store the bKash number you sent from and the transaction ID you enter, so our team can verify the payment. Meals may also be paid for in cash on delivery or arranged directly, in which case we record only that the payment was received.
• Communications. Notifications we send you inside the app, and emails we send for sign-up confirmation, password reset and service updates, together with delivery status records for those emails.
• Push notification data. If you allow notifications, we store the push subscription issued by your browser or device so we can send meal-time and status alerts. It contains no message content and no contact details.
• Chef and rider information. If you join as a home chef or rider, we collect the profile, kitchen, contact, payout and availability information you submit, plus records of the orders you fulfil.
• Technical information. Our hosting and backend providers automatically process standard technical data such as IP address, browser and device information, and request logs, to deliver and secure the service. We do not run advertising or third-party analytics trackers.

We use the information above to:

• create your account and sign you in securely;
• set up, price, edit and manage your meal plan;
• connect you with a suitable local home chef — our team does this manually;
• tell your chef what to cook, and what to avoid, for your household;
• coordinate delivery to your address at your chosen meal times;
• send you sign-in emails, plan updates, meal-time prompts and notifications;
• collect and act on your meal feedback so future meals suit you better;
• fulfil marketplace orders and verify payments where a payment reference is submitted;
• respond to your questions, complaints and cancellation requests;
• detect and prevent fraud, abuse and misuse of the service;
• keep the service secure, working and improving; and
• comply with legal obligations and resolve disputes.

We do not sell your personal information, and we do not use it for third-party advertising.

GhorerRanna offers "Continue with Google" as a way to sign in. Google Sign-In is used only for authentication — to create your GhorerRanna account and to let you sign back into it.

What we receive. When you choose Google Sign-In, Google returns basic profile information from your Google Account, using the standard openid, email and profile scopes only. That is:

• your name;
• your email address (and whether Google has verified it);
• your profile picture, if your Google Account has one; and
• your unique Google account identifier.

What we do not access. We do not request or receive access to Gmail, Google Drive, Google Contacts, Google Calendar, Google Photos, YouTube or any other Google service or data. We cannot read, send or manage anything in your Google Account.

Why we receive it and how it is used. Your name and email identify your GhorerRanna account, let us contact you about your plan, and let you sign in again without a password. Your Google account identifier links your sign-in to the correct account. A profile picture, if provided, is only shown back to you inside your own account.

Where it is stored. This information is stored in our managed backend and authentication database (Supabase, hosted on infrastructure operated by Supabase and its cloud providers), together with the rest of your account record.

Whether it is shared. Google user data is not sold, rented or transferred for advertising, and it is not shared with home chefs, riders or any other user. It is only accessible to our authentication and hosting providers acting on our behalf, and to GhorerRanna staff who need it to operate the service or where the law requires disclosure.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. You can revoke GhorerRanna's access at any time from your Google Account permissions page; you can also ask us to delete your GhorerRanna account (section 8).

Apple Sign-In, where offered, works the same way: we receive only the name and email address (or Apple private relay address) Apple provides for authentication.

We share information only where it is needed to deliver the service:

• Home chefs. The chef preparing your meals receives what they need to cook and hand over your food — your name, delivery address, phone number, household size, meal times and the foods you want avoided. They do not receive your password or your Google account identifier.
• Delivery riders. Where a rider delivers your order, they receive your name, delivery address and phone number, and the delivery details for that order.
• Payment verification. Where you pay by bKash, the reference details you submit are reviewed by GhorerRanna staff and the relevant chef to confirm the payment. We do not send your personal information to a card processor, because we do not process card payments.
• Service providers. Supabase provides our database, authentication and file storage; Lovable provides hosting and the managed sign-in flow for Google and Apple; our email and web-push delivery providers send the messages you receive. They process data on our instructions.
• Legal and safety. We may disclose information where required by law, to enforce our Terms, or to protect the rights and safety of users, chefs, riders or GhorerRanna.

We do not sell your information to third parties.

Your information is stored in a managed Supabase (PostgreSQL) database with row-level security policies, so records are readable only by the account they belong to and by authorised staff roles. Access to administrative tools is restricted to specific accounts. Traffic to the site and backend is encrypted in transit over HTTPS, and passwords are stored only as hashes by our authentication provider — we never see them.

We use reasonable technical and organisational safeguards appropriate to the size of our service. No online service can be completely secure, so we do not claim our systems are 100% secure. If a breach affects your information, we will act on it and notify you where required.

We do not currently operate fixed automatic deletion periods for most records. We keep your information for as long as reasonably necessary to provide the service, and afterwards for as long as needed to meet legal obligations, resolve disputes, verify payments, prevent fraud and abuse, and maintain business records. Cancelling a plan does not immediately erase its history; the record is marked as cancelled so we can honour any follow-up. When information is no longer needed, we delete it or remove its link to you.

You can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong or out of date;
• delete your account and the personal information we hold about you;
• stop sending you notifications or non-essential emails; and
• withdraw consent you gave, such as permission to send push notifications.

You can edit your plan details, contact information, meal times and preferences yourself at any time from your GhorerRanna account, and you can turn off notifications in your browser or device settings. For anything else, email us at hello@ghorerranna.com from the address on your account and we will respond. Deleting your account may end an active meal plan.

We use only what is needed to keep you signed in and to make the app work. Your sign-in session is stored on your own device (in browser storage, and in a session cookie during server-side rendering) by our authentication provider, along with small local values that remember app preferences, such as which screens you have already seen. If you install GhorerRanna as an app, a service worker caches files on your device so the app loads quickly and works offline.

We do not use advertising cookies, tracking pixels or third-party analytics cookies.

GhorerRanna is intended for adults. Accounts may only be created by people aged 18 or over, and we do not knowingly collect personal information directly from children.

An adult account holder can tell us that meals are for a household that includes children — during setup you can indicate how many older and younger children you are feeding, so the chef cooks the right amount. That is household information provided by an adult; it is not a child creating an account or using the service independently, and we do not ask for a child's name, contact details or any other identifying information. If you believe a child has created an account, email us and we will remove it.

We may update this policy as the service changes. The effective date at the top of the page always shows the current version. For significant changes we will notify you in the app or by email to the address on your account. Continuing to use GhorerRanna after an update means you accept the updated policy.

For any privacy question, request or complaint — including access, correction or deletion — email ghorerrannaapp@gmail.com. GhorerRanna operates in Dhaka, Bangladesh.