Privacy Policy

1. Introduction

TruDiet is an online grocery store selling flours, grains, salts, sweeteners and other pantry staples, along with a "Create Your Atta" service that mills custom flour blends to order on a fresh chakki. Our website lets you browse products, search the catalogue, add items to a cart, build and save custom mixes, create an account, save delivery addresses, place orders and track their progress.

This policy applies to everyone who uses the TruDiet website: visitors who browse without signing in, registered account holders, and customers who place orders. It covers the personal information we collect through the website, the reasons we collect it, how it is stored and shared, and the choices and rights you have over it.

In this policy, "TruDiet", "we", "us" and "our" refer to the TruDiet business operating this website. "You" refers to the person using the website.

2. Information We Collect

We collect only the information needed to run the store, fulfil your orders and keep your account secure. The categories below describe what the application actually collects.

2.1 Information you provide

• Full name — provided when you create an account, save a delivery address or place an order.
• Email address — used as your login identifier when you register with email and password, or received from Google when you sign in with Google.
• Phone number — required so we and our delivery partner can reach you about your order. Guests who order without an account provide a contact phone number at checkout.
• Delivery address — address lines, area, city, state, postal code and optional delivery instructions.
• Password — if you register with email and password, your password is handled and stored in hashed form by our authentication provider. TruDiet staff never see your password.
• Custom atta mixes — the ingredients, proportions, grind preference and quantity you choose, including mixes you choose to save to your account.
• Order notes and support messages — anything you write in order notes, or send us by email or WhatsApp when you contact support.

2.2 Account information

When you create an account, we store an account identifier issued by our authentication provider, together with a profile record holding your name, phone number and, where provided by Google sign-in, your profile picture URL. The account identifier is what links your saved addresses, saved mixes, cart and order history to you, so that only you can see them. A small number of accounts also carry an internal staff or administrator role, which controls access to the order and milling management screens.

2.3 Order information

When you place an order we record: the order number, the products and custom mixes purchased, quantities, unit prices, discounts, delivery charge, taxes and order total; the date and time of the order; the order status and its status history; the chosen delivery option and time slot; the payment method and payment status; a snapshot of the delivery address and contact details as they were at the time of the order; and any notes you added. We keep an address snapshot with the order so that your invoice and delivery record stay accurate even if you later edit or delete the saved address.

This information is necessary to accept the order, mill and pack the goods, deliver them to the right place, answer your questions afterwards and keep proper business and accounting records.

2.4 Cart information

Your cart holds the products, pack sizes, quantities, prices and any custom mix configurations you have selected. While you are signed out, the cart is kept in your browser's local storage on your own device. When you sign in, the cart is saved against your account in our database so that the same cart appears on your phone, tablet and computer. Cart data is used only to run the shopping experience and to prepare the order you choose to place.

2.5 Automatically collected information

Like most websites, our hosting and infrastructure providers automatically record standard technical information when a page or data request is made. This can include your IP address, browser type and version, device and operating system, the pages requested, referring pages, and the date and time of the request. Our application also captures error and diagnostic information when something goes wrong, so we can find and fix faults. This technical data is used for security, abuse prevention, reliability and troubleshooting.

We do not run Google Analytics, advertising pixels or third-party marketing trackers on this website.

3. Google Sign-In and Google User Data

TruDiet offers "Continue with Google" as an optional way to sign in, alongside email and password. Using Google sign-in is entirely your choice; you can always create a TruDiet account with an email address and password instead.

3.1 What we receive from Google

When you choose Google sign-in and approve the request on Google's consent screen, we receive a limited basic profile from Google:

• Your name, as it appears on your Google account
• Your email address and whether Google has verified it
• Your Google profile picture URL, if your account has one
• A unique Google account identifier for your account

We request only the standard email and profile scopes needed to sign you in. TruDiet does not request, receive or access your Gmail messages, Google Drive files, Google Contacts, Google Calendar, Google Photos or any other Google service or data.

3.2 How we use Google user data

• To authenticate you and confirm you control the Google account
• To create your TruDiet account the first time you sign in
• To sign you in to the correct existing account on later visits
• To fill in your name and profile picture on your TruDiet profile, so that checkout can prefill your name
• To associate your cart, saved addresses, saved mixes and order history with the correct account
• To send you order-related messages at your email address where needed

3.3 What we do not do with Google user data

• We do not sell Google user data to anyone.
• We do not transfer Google user data to third parties except to the infrastructure providers that operate our authentication and database on our behalf, or where the law requires it.
• We do not use Google user data for advertising, ad targeting, ad personalisation, credit assessment or lending purposes.
• We do not use Google user data to build profiles for purposes unrelated to the TruDiet store.
• We do not allow humans to read this data except where you have asked for support, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

3.4 Revoking Google access

You can disconnect TruDiet from your Google account at any time from your Google account's security settings, under third-party apps with account access. Revoking access stops future Google sign-ins but does not by itself delete your TruDiet account — see section 12 for deletion.

4. How We Use Personal Information

• Create, operate and secure your TruDiet account
• Authenticate you, including through Google sign-in
• Keep your cart in sync across your devices
• Price, accept, mill, pack and fulfil your orders
• Arrange and complete delivery to your address
• Contact you about an order, a delivery or a problem with it
• Respond to your support requests by email or WhatsApp
• Maintain your order history and saved custom mixes
• Manage stock levels and internal milling operations
• Detect, investigate and prevent fraud and misuse of the store
• Protect the security and integrity of accounts and the website
• Diagnose faults and improve the website's functionality
• Keep business, tax and accounting records
• Comply with applicable legal and regulatory requirements

We do not sell your personal information, and we do not use it for third-party advertising.

5. Legal Basis and Purpose of Processing

We process personal information because it is:

• Necessary to provide the service you asked for — running your cart, account and custom mix builder.
• Necessary to perform our contract with you — accepting, milling, delivering and supporting your order.
• Necessary for our legitimate interests — securing accounts, preventing fraud and abuse, keeping the site reliable, and maintaining internal records.
• Required to comply with legal obligations — for example tax and accounting record-keeping and responding to lawful requests.
• Based on your consent — where consent is required, such as choosing to sign in with Google or choosing to save an address or a mix. You may withdraw consent at any time, which will not affect processing already carried out.

6. Information Sharing

TruDiet does not sell your personal information. We share it only with the parties below, and only to the extent reasonably necessary.

• Authentication provider — our authentication service verifies your credentials and issues your session. If you use Google sign-in, Google acts as the identity provider and receives the fact that you are signing in to TruDiet.
• Hosting, database and file storage providers — they store and process account, order, address and catalogue data on our behalf so the website can operate.
• Delivery personnel and logistics partners — they receive the recipient's name, phone number, delivery address, delivery instructions and the order contents needed to complete the delivery. They do not receive your account credentials or full order history.
• WhatsApp messaging — our support button opens a WhatsApp conversation with our business number, and order notifications may be delivered to our own business number through WhatsApp's business messaging service. Anything you send us over WhatsApp is also handled under WhatsApp's own privacy terms.
• Professional advisers and authorities — where disclosure is required by law, regulation, court order or a lawful government request, or is needed to establish, exercise or defend legal claims.
• Business transfer — if the business or part of it is reorganised, merged or sold, customer information may transfer as part of that transaction, subject to this policy.

Our service providers are permitted to use the information only to deliver their service to us, and are expected to keep it confidential and secure.

7. Hosting, Database and Infrastructure

The TruDiet website runs on managed cloud infrastructure. Account records, profiles, saved addresses, carts, saved custom mixes, orders and catalogue data are stored in a managed PostgreSQL database provided by Supabase, which also provides our authentication service. Product and packaging images are held in managed cloud file storage. These providers process and store data on our behalf under their own security and privacy commitments.

For security reasons we do not publish details of our internal configuration, credentials or keys. Access to production data is limited to the small number of people who need it to operate the store.

8. Payment Information

TruDiet currently accepts Cash on Delivery. No online payment gateway is integrated into the website at this time.

As a result, TruDiet does not collect or store card numbers, CVV codes, UPI PINs, net-banking credentials or any other sensitive payment credentials through this website. What we record against an order is limited to the payment method chosen, the payment status (for example pending or paid), and the amounts involved.

If we introduce online payments in future, payment details will be handled directly by the regulated payment provider, TruDiet will receive only transaction references and status information, and this policy will be updated with the provider's name and the data involved before the feature goes live.

9. Cookies and Browser Storage

We use only the browser storage that the store needs to work. We do not use advertising cookies or third-party analytics cookies.

• Authentication session storage — our authentication provider stores your session token in your browser so you stay signed in between pages and visits.
• Cart storage — your cart is kept in your browser's local storage while you are signed out, and synced to your account once you sign in.
• Sign-in redirect — during a Google sign-in we briefly store the page you came from in session storage, so we can return you there afterwards.
• Support tooltip preference — we store a small flag so the WhatsApp help tooltip is only shown once.

You can clear or block cookies and site storage in your browser settings. If you do, sign-in and the shopping cart will not work correctly, because these features depend on that storage.

10. Data Security

• All traffic to and from the website is encrypted in transit using HTTPS/TLS.
• Passwords are never stored in plain text; they are hashed by our authentication provider, and Google sign-in means no password is handled by us at all.
• Database row-level security policies restrict every customer record — your profile, addresses, cart, saved mixes and orders — so that it can only be read by your own authenticated session.
• Administrative screens are protected by database-enforced roles, not just by hidden links, so staff functions cannot be reached by an ordinary account.
• Privileged service credentials are kept server-side only and are never exposed to the browser.
• Sensitive operations such as placing an order run as controlled server-side functions with validation and idempotency checks.
• Errors are logged and monitored so faults and unusual activity can be investigated.

We take these measures seriously, but no website or internet transmission can be guaranteed to be completely secure. Please use a strong, unique password and tell us promptly if you believe your account has been compromised.

11. Data Retention

We keep personal information only for as long as it is reasonably needed for the purpose it was collected for. Different categories are kept for different periods:

• Account, profile and saved mixes — kept while your account is active, and deleted when you close your account, subject to the exceptions below.
• Saved addresses — kept until you delete them or close your account.
• Cart contents — kept while the cart is active; replaced when you check out or clear it.
• Orders, invoices and order snapshots — retained for as long as required for accounting, tax, warranty, dispute resolution and legal compliance purposes, even after an account is closed.
• Support conversations — kept for a reasonable period so we can handle follow-up questions.
• Technical and error logs — kept for a short period for security and troubleshooting, then removed or overwritten.

When information is no longer needed, it is deleted or anonymised.

12. Account and Data Deletion

You can ask us at any time to delete your TruDiet account and the personal information associated with it. The website does not currently offer a self-service delete button, so requests are handled by our team:

• Email care@trudiet.in from the address registered on your account, with the subject "Delete my account", or
• Message us on WhatsApp at +91 91199 03675.

We may ask you to confirm your identity before acting, so that no one else can delete your data. We aim to acknowledge requests within a few working days and to complete them within 30 days.

On deletion we remove your login record, profile, saved addresses, saved custom mixes and cart. Completed order records are retained in a reduced form where we are required or reasonably need to keep them for accounting, tax, fraud prevention, dispute resolution or legal compliance; where possible these are disassociated from your account. You can also ask us to correct any inaccurate information rather than delete it.

13. Your Rights

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Update your own account details, addresses and saved mixes directly from your account pages
• Request deletion of your account and personal information
• Withdraw consent where our processing relies on it
• Ask how and why your personal information is processed and who receives it
• Object to or ask us to restrict certain processing
• Exercise any further rights available to you under applicable law

To exercise any of these rights, contact us using the details in section 19. We may need to verify your identity first, and we will respond within the time limits set by applicable law.

14. Children's Privacy

TruDiet's store is intended for people who can lawfully enter into a purchase contract, and accounts and orders should be created by an adult or with the consent and supervision of a parent or guardian. We do not knowingly collect personal information from children where such collection is restricted by applicable law. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

15. Third-Party Links and Services

The website relies on the third-party services described in this policy — Google (sign-in only), Supabase (authentication, database and file storage), our website hosting provider, WhatsApp (support messaging and order notifications to our own business number) and our delivery personnel. Their handling of information is governed by their own privacy policies and terms.

Our pages may also contain links to external websites we do not control. We are not responsible for the content or privacy practices of those sites; please read their policies before providing information to them.

16. International Data Processing

Our infrastructure and service providers operate global cloud platforms, so your information may be processed or stored on servers located outside the state or country you live in. Wherever it is processed, it remains protected by this policy and by the contractual and security commitments of the providers we use.

17. Security Incidents

We maintain reasonable technical and organisational safeguards to prevent unauthorised access to personal information. If a security incident affecting personal information occurs, we will investigate it, take steps to contain and mitigate the impact, correct the underlying cause, and notify affected users and the relevant authorities where applicable law requires it.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the website, our services, our providers or the law — for example if online payments are introduced. When we do, we will publish the revised policy on this page and update the effective date at the top. Where a change materially affects how we use your information, we will provide additional notice as required by applicable law. Continuing to use TruDiet after an update means you accept the revised policy.

19. Contact Us

If you have questions about this Privacy Policy, want to exercise your rights, or wish to raise a privacy concern, please contact us:

• Email: care@trudiet.in
• WhatsApp: +91 91199 03675 (+919119903675)
• Support hours: Monday to Saturday, 10:00 am to 6:00 pm IST

We aim to acknowledge privacy enquiries within a few working days and to resolve them as quickly as we reasonably can.

This policy describes the TruDiet website as it operates on the effective date shown above.