Privacy Policy
Tiffly customer app (com.tifflybites.customer) · Last updated 12 September 2026
Tiffly is a tiffin kitchen in Sector V, Bidhannagar, Kolkata. This app exists so you can order food from us and have it brought to your door. This page says exactly what the app collects to do that, what it does not, and how to get rid of it.
It is written to match the app's actual behaviour rather than to cover every eventuality. If something here does not match what the app does, the app is wrong and we want to hear about it.
The short version
- We collect what is needed to cook your food and find your door — and, depending on how you sign in, who you are.
- You sign in with your mobile number and a one-time code, sent by MSG91. We never see a password, because there isn’t one.
- We never see or store your card, UPI id or bank details. If you pay online, you enter them directly into Razorpay’s own checkout screen, not ours. Cash on delivery is also available.
- We do not sell your data, we do not use it for advertising, and there is no advertising, analytics or crash-reporting code in the app.
- Location and notifications are both optional. The app asks before using either, explains why first, and works without both.
- You can delete your account from inside the app, or from menu.tifflybites.com/delete-account.
What we collect, and why
| What | Why | Do we have to have it? |
|---|---|---|
| Your mobile number | To sign you in — we send a one-time code to it and check what you type back — and so the person delivering can call you if they cannot find the door. | Required. It is how the app knows it’s you. |
| The one-time code and whether it matched | To confirm the number is really yours before letting you in. | Required to sign in. Sent and checked by MSG91 — see “Who else sees your data” below. |
| Your name | So the kitchen and the person delivering know who the order is for. | Asked for once, the first time you sign in. You can change it later in Account. |
| Your email address | Not collected by the app today. | Not asked for. If your account is from before OTP sign-in existed and was made with Google or an email and password, that email may still be on the account — see “Older accounts” below. |
| Your delivery address, including its map pin | To bring the food to it, and to work out whether it is inside the area we deliver to. We price delivery by distance, so the pin is the address. | Required to place an order. Not required to browse the menu. |
| Your device's location | To put the map pin near you when you add an address, so you do not have to find yourself on a map. Used only while the app is open. | Optional — see below. |
| Your orders | To cook them, to show you your order history, and because a completed order is a financial record we are required to keep. | Required. |
| A notification token for your phone | To tell you when the kitchen has started your order and when it has left. | Optional — see below. |
| Date of birth, gender | Nothing yet. They are fields on the profile screen; both are blank unless you fill them in, and nothing in the app reads them. | Optional, and safely ignored. |
Location
The app asks for location permission once, just after you sign in, and it shows you a card explaining why before your phone's own permission dialog appears. You can say no.
What it does with the answer:
- If you allow it — the app takes a single position fix, uses it to centre the map so the pin starts near you, and asks our server whether we deliver that far. Nothing is saved until you confirm an address yourself.
- If you decline — the map opens on the kitchen instead and you move the pin or type an address. Every part of the app still works.
The app never uses location in the background. It holds no background-location permission, does not track you between orders, and cannot see where you are when it is closed. There is no live map of you and nobody at Tiffly can watch your position.
You can change your mind at any time in your phone's settings — Android Settings → Apps → Tiffly → Permissions, or iOS Settings → Tiffly → Location.
Notifications
The app asks to send notifications once, on the tracking screen after your first order, with a card explaining what it will send before your phone's dialog appears. Declining is a single tap and the app never asks again.
If you allow them, we send you an update when the kitchen accepts your order, when it leaves for your address, and when it arrives — plus a message if the kitchen cannot take the order. That is the complete list. We do not send offers, reminders or marketing of any kind.
To do this, your phone gives us a notification token, which we store against your account and delete when you sign out. You can turn notifications off in the app under Account → Notifications, or in your phone's settings.
Who else sees your data
We do not sell your data and we do not share it with anyone for their own purposes. A small number of services process it on our behalf, and only to make the app work:
- Google Maps Platform — when you search for an address or move the map pin, the text you type and the pin's coordinates go to Google to be turned into an address and back. The requests go through our own server, so your device never talks to Google directly and no identifier of yours is attached.
- MSG91 — sends the one-time code to your mobile number when you sign in, and tells us whether the code you typed back matched. They see your mobile number and the code; they do not see anything else about your account.
- Razorpay — if you pay online, the checkout screen is Razorpay’s own, opened inside the app. Your card, UPI id or bank details go to them, not to us. Razorpay tells Tiffly only whether the payment succeeded and a reference number, which we use to mark the order paid.
- Firebase Cloud Messaging (Google) — carries notifications to your phone.
- Amazon Web Services — hosts our servers and database, in the Mumbai region. Your data stays in India.
Older accounts
Before OTP sign-in existed, the app offered signing in with a Google account or with an email and a password (handled by Firebase Authentication, a Google service). Both were removed from the app in September 2026 in favour of a mobile number and a one-time code. If your account was created either way before then, Google or Firebase may still hold the Google account id or the confirmed email address tied to it, and Firebase may still hold a password we have never seen — we cannot read, change or recover it. Nothing new is sent to either service today.
There is no advertising network, no analytics service and no crash-reporting service in the app. We are not guessing about that: there is no such code in it.
Payment
You can pay cash on delivery, or pay online through Razorpay. Cash is handed to the person who brings your food, at your door. Paying online opens Razorpay’s own checkout screen inside the app — your card, UPI id or bank details go directly to them. Tiffly’s app and servers never see or store a card number, a UPI id or a bank detail; we are told only whether the payment succeeded. If anything calling itself Tiffly ever asks you to type payment details anywhere other than that Razorpay screen, it is not us.
How long we keep it
- Your account and addresses — until you delete your account.
- Your orders — kept even after you delete your account, because a completed order is a financial record. They stop being connected to you: your name, number, email and address are removed from the account, and what is left is the order itself.
- Notification tokens — until you sign out, turn notifications off, or uninstall the app.
Your rights
- See what we hold — your profile, addresses and full order history are all visible in the app.
- Correct it — Account → Edit profile, and Account → Save address.
- Delete it — Account → Edit profile → Delete Account, or from menu.tifflybites.com/delete-account. What deletion does, precisely, is written on that page.
Children
Tiffly is not intended for children under 18 and we do not knowingly collect anything from one. Ordering involves a delivery to a real address and paying cash at the door.
Changes
If we change what the app collects, we will change this page and the date at the top of it before the change ships.
Contact
Tiffly, Sector V, Bidhannagar, Kolkata, West Bengal, India.
Email: tifflybites@gmail.com
Phone and WhatsApp: +91 91470 98525
Write to the address above about anything on this page — what we hold, a correction, or a deletion you cannot do yourself. It is the same address given to Google Play as Tiffly’s support contact, so a reply comes from the people who run the kitchen rather than from a queue.