Privacy Policy

Steel Box ("we", "our", or "us") operates the Steel Box mobile application and the website steel-box.in (collectively, the "Service"). This page informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this policy.

1. Information We Collect

1.1 Information you provide

• Account information: first name, last name, display name, gender, email address, mobile number, and password (stored as a bcrypt hash — we never see your actual password).
• Food posts: dish names, descriptions, quantities, pickup instructions, photos, and pickup location.
• Chat messages: text messages exchanged with other users regarding a pickup.
• Reviews: star ratings and comments you leave after a pickup.

1.2 Information collected automatically

• Location data: your device's approximate or precise location, only when you explicitly grant permission, used to show food within 3–5 km of you and to tag your food posts with a pickup location.
• Device information: a unique device token (Firebase Cloud Messaging token) so we can send you push notifications.
• Usage data: non-personally-identifiable telemetry such as when you open the app, screens visited, and crash reports.

2. How We Use Your Information

• To provide and maintain the Service (matching food posts with nearby users).
• To verify your identity via mobile OTP.
• To notify you about pickup requests, order updates, chat messages, and reviews.
• To allow communication between food posters and recipients.
• To improve the Service based on usage patterns and crash reports.
• To detect, prevent, and address technical issues, abuse, or violations of our Terms.

3. Third-Party Services

We share limited data with the following trusted third parties, only as needed to operate the Service:

We do not sell your personal data. We do not share your data for advertising purposes. We do not permit third parties to use your data for their own commercial purposes.

4. Data Retention

We retain your account information for as long as your account is active. Food posts expire automatically based on the expiry window you set (up to 72 hours). Chat messages are retained for as long as the underlying order exists. Reviews are retained indefinitely to preserve community trust records.

When you delete your account, all your personal data is deleted within 90 days, except where we are legally required to retain it (for example, to comply with financial or regulatory record-keeping obligations, if applicable).

5. Your Rights

• Access: you can view your profile, food posts, orders, chats, and reviews at any time within the app.
• Correction: you can update your display name and profile details from the Profile screen.
• Deletion: you can request deletion of your account and associated data by (a) using the "Delete account" option within the app, or (b) emailing privacy@steel-box.in from your registered email.
• Objection / Restriction: you can disable specific data collection (e.g., location) by revoking the permission in your device settings, though some features will stop working.
• Portability: on request, we will provide you with a machine-readable export of your data within 30 days.

6. Location Data

Steel Box uses your device's foreground location to (a) find food shared within a 3–5 km radius and (b) tag food you post with a pickup location. We never track your location in the background. You can revoke this permission at any time from your device settings.

7. Photos

When you attach a photo to a food post, we upload it to secure object storage (Cloudflare R2 or equivalent). The photo is visible only within the Steel Box app to users searching in your area. Photos are deleted when the food post expires or is removed.

8. Children's Privacy

Steel Box is not intended for use by children under 13. We do not knowingly collect personally identifiable information from anyone under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with personal data, please contact us so we can take appropriate action.

9. Security

We take reasonable measures to protect your information, including:

• All traffic between the app and our servers is encrypted using HTTPS/TLS.
• Passwords and OTPs are stored as bcrypt hashes; we cannot read them, only verify them.
• Authentication uses JSON Web Tokens with a 30-day lifetime.
• Login attempts are rate-limited and accounts are automatically locked after repeated failures.
• Server access is restricted to authorized personnel only.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

10. International Data Transfers

Your information may be processed in countries other than your own, including where our service providers (Twilio, Google, Cloudflare) operate. By using the Service, you consent to this transfer.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Material changes will also be communicated via an in-app notice or email.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

• Data Controller: Shivaramakrishna Dyavanapelli
• Address: Classic Enclave, Madhuranagar, Hyderabad 500038, India
• Email: privacy@steel-box.in
• Phone: +91 94900 84376
• Website: steel-box.in
• Account deletion: Request account deletion