Privacy Policy

• Account details: name, email address, and phone number, collected via our authentication provider, Clerk, when you sign up.
• Location: the neighbourhood/area you set for discovery, and — only with your explicit consent — a precise pickup location. We use OpenStreetMap and Nominatim (not Google Maps) to look up and display places; we never sell or share your location with advertisers.
• Activity data: the communities you join, campaigns you pledge to, and orders you pick up, so the app can show your history and let Captains fulfil your order.
• Device and usage data: app version, device type, push-notification token, and product-analytics events (via PostHog) used to understand feature usage — these are configured to avoid capturing free-text or sensitive inputs.
• Communications: messages you send us for support, and your notification-channel preferences (WhatsApp, SMS, push, in-app).

We do not knowingly collect payment card or bank details — pilot-stage purchases are settled in cash directly between you and a Captain at pickup.

• To create and secure your account, and to let you sign in.
• To rank and show campaigns, communities, and products near you.
• To let a Captain identify and hand you your order at pickup.
• To send transactional messages about your pledges, campaigns, and pickups (see §4 of our Terms of Service).
• To understand how the app is used, so we can fix problems and improve it.
• To detect abuse, and to meet our legal and accounting obligations.

We don’t use your personal data to serve third-party advertising, and we don’t sell it.

Location is the most sensitive data we handle. Coarse location (your chosen area/city) is needed to rank nearby campaigns and is asked for at sign-up. Precise location, when you grant it, is used only to help a Captain find your pickup spot and is stored only for as long as your account is active. You can change or clear your saved location at any time in the app, and it is permanently removed if you delete your account (see §6).

• Captains, who see the name, phone number, and pickup details of buyers pledged to their campaign — only what’s needed to fulfil the order.
• Service providers who process data on our behalf under contract: Clerk (authentication), our WhatsApp/SMS business solution provider (transactional messages), Expo (push notifications), and PostHog (product analytics).
• Legal authorities, if required by law or to protect the rights, safety, or property of Mandali, our users, or the public.

We do not sell personal data to third parties.

The web app uses essential cookies/local storage to keep you signed in and remember your chosen area, and analytics identifiers (PostHog) to understand feature usage. We don’t use third-party advertising trackers.

We keep your account data for as long as your account is active. You can delete your account at any time from Settings › Danger zone in the app, or by emailing hello@mymandali.com. When you do, we soft-delete your profile and scrub stored location data, and your account becomes inactive. We retain pledge and order records in anonymised form where required for accounting and legal record-keeping, even after account deletion.

Under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Withdraw consent (for example, for precise location or marketing messages) at any time;
• Request erasure of your data, subject to our legal retention obligations (§6);
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity;
• Lodge a grievance with us, and escalate to the Data Protection Board of India if unresolved.

To exercise any of these rights, email hello@mymandali.com. We aim to respond within 30 days.

We use industry-standard measures — encryption in transit, access controls, and audit logging of sensitive actions — to protect your data. No system is completely secure, and we encourage you to keep your account credentials confidential.

Mandali is intended for users 18 and older and is not directed at children.

We may update this Privacy Policy from time to time. If we make material changes, we’ll notify you in the app or by email before they take effect.

For privacy questions, data requests, or grievances, email hello@mymandali.com. Sunday Fruit Club is registered in [City], [State], India.