Privacy Policy

Nuggit (“nuggit”, “we”, “us”) operates a daily meal delivery service in Hyderabad, Telangana, India. This policy explains what personal data we collect, why we collect it, and the choices you have. It applies to our mobile app and to getnuggit.com.

What we collect

Almost everything here exists so we can cook and deliver your meals. The one exception is advertising measurement, which has its own section below.

Account details. When you sign in with Google or Apple we receive your name and email address from that provider, along with a stable identifier that lets us recognise you on your next sign-in. We never receive your Google or Apple password. If you choose to hide your email address when using Sign in with Apple, we store only the relay address Apple gives us.
Contact number. Your phone number, so our delivery partner can reach you if they cannot find your door.
Delivery address. Your area, building, address lines and — only if you explicitly grant location permission — your precise coordinates. Coordinates are used to give the delivery partner an accurate map pin. Granting location access is optional; without it we use your typed address instead.
Food preferences. Your dietary choice (vegetarian, eggetarian or non-vegetarian), household members you add, and the meals you skip, swap or rate.
Wallet and order history. Your credit balance, top-ups, meals taken and refunds.
Device token for notifications. If you allow notifications, we store the push token your device issues so we can tell you when your meal is on its way.
Advertising measurement. When you visit getnuggit.comwe set two cookies from Meta — the company behind Facebook and Instagram — and Meta receives your IP address, the user-agent string your browser sends, and which pages you looked at. We never send Meta your name, email address or phone number. The section below explains this in full.

What we do not collect

We do not store your card, UPI or bank details. Payments are processed entirely by our payment provider, Razorpay, and we receive only a confirmation that a payment succeeded and its amount.

We do not sell your personal data. We do run advertising measurement on this website — but we never send an advertising company your name, email address or phone number. The next section says exactly what does get sent, and how to stop it.

Cookies and tracking

Signing in stores a token in your browser, not a cookie. The four cookies described here are the only ones on this site, and none of them is an advertising cookie set by a third party on their own domain — all four are set on getnuggit.com.

We advertise nuggit on Facebook and Instagram, and we need to know which of those ads actually bring people who subscribe. Otherwise we are guessing, and guessing is expensive. To find out, we run Meta’s measurement tool — the “Meta Pixel” — on getnuggit.com.

It sets two cookies on our own domain, _fbp and, if you arrived here by clicking one of our ads, _fbc. Both are random identifiers for your browser. Neither contains anything about you.
It tells Meta which pages you viewed, along with your IP address and the user-agent string your browser sends to every website.
Our server sends Meta the same events a second time, so the measurement still works when a browser blocks the script. It sends the same information and nothing more.

What we deliberately leave out.Meta’s tools can be set up to receive a customer’s email address, phone number and name in scrambled form, so that person can be matched to their Facebook or Instagram account. We have that switched off. Meta gets the browser identifiers above and nothing else. If you happen to be signed in to Facebook or Instagram in the same browser, Meta can still recognise you — that is how their own cookies work and we cannot prevent it — but it does not learn who you are from us.

Session recordings.Separately, we use Microsoft Clarity to watch how the site and the app are actually used — which buttons get tapped twice because nothing happened the first time, where people give up part-way through ordering. It replays your visit as an anonymous, wordless outline of the page: it records where you moved, tapped and scrolled, not who you are.

It sets two cookies on our own domain, _clck and _clsk. Both are random identifiers — one for your browser, one for the visit. Neither contains anything about you.
Everything you type is hidden before it leaves your device.Anything you enter into a box — your address, phone number, name — is replaced with blank characters in the recording, and so is the text we display back to you. Masked content is never uploaded, so it is not something Microsoft holds and we chose not to look at; it never reaches them.
Microsoft receives the outline of the page, your IP address and the user-agent string your browser sends to every website. It is not used to advertise to you.
The nuggit app does the same thing on your phone, under the same rules. It is off in every build except the one we publish to the App Store and Play Store.

How to turn it off

Any content blocker stops both— uBlock Origin, Brave’s shields, or Firefox’s strict tracking protection. Blocking third-party cookies alone is not enough, because all four are set on our own domain. The site works normally with the pixel and the recording blocked; nothing here is gated on either.
At Meta. Facebook and Instagram let you see what businesses have sent them about you, disconnect it from your account, and limit how it is used for ads: Settings → Accounts Centre → Your information and permissions.

How we use it

To cook, schedule and deliver your meals, and to hand your address to the delivery partner assigned to your order.
To run your wallet — crediting top-ups, charging for meals taken, refunding meals you skipped.
To notify you about your delivery, and about changes to your subscription.
To respond to you when you contact support.
To plan how much food to cook, using aggregate counts rather than individual records wherever possible.

Who we share it with

We share the minimum necessary with the companies that help us operate:

Razorpay, our payment provider, for processing top-ups.
Our notification provider, for delivering push messages.
Our hosting and database providers, for storing this data.
The delivery partner assigned to your order, who sees your name, address and phone number, for that delivery only.
Meta Platforms, for the advertising measurement described above. Meta receives browser identifiers, your IP address, your user-agent string and which pages you viewed. It does not receive your name, email address, phone number or delivery address. Meta processes this outside India, including in the United States and Ireland.

We may disclose data where required by Indian law.

How long we keep it

We keep your account data for as long as your account is open. When you delete your account we erase it immediately: the account and the records listed on Delete your accountare removed from our database at the moment you confirm. There is no grace period, and the deletion cannot be reversed — by you or by us. Records we are legally required to retain, such as tax and payment records, are kept for the period the law requires.

The advertising measurement described above is a separate matter. Meta holds that data under its own retention rules, which we do not control. Because none of it carries your name, email address or phone number, there is no nuggit account for us to look up and delete over there — deleting your nuggit account does not touch it, and we would be lying if we said otherwise. You can clear it yourself from Facebook or Instagram: Settings → Accounts Centre → Your information and permissions.

Your choices

Delete your account. Open the app and go to Account → Delete Account. This is available directly in the app, does not require contacting us, and takes effect immediately. See Delete your account for the full steps and exactly what is erased.
Turn off notifications. Revoke the permission in your device settings at any time; we stop sending and drop your token.
Turn off location. Revoke the permission in your device settings. The app falls back to your typed address.
Access or correct your data. Edit your profile and address in the app, or write to us at the address below.
Turn off advertising measurement.Use a content blocker — the exact steps are under Cookies and tracking above. Nothing in nuggit stops working if you do.

Children

nuggit is for adults. It is not directed at children, we do not knowingly collect data from anyone under 18, and we do not knowingly include them in advertising measurement. Indian law draws that line at 18; the app stores are written around 13, so we hold ourselves to the higher one. If you believe a child has given us data, contact us and we will delete it.

Security

Data is transmitted over encrypted connections and stored on managed infrastructure with access restricted to the people who need it to operate the service. No system is perfectly secure, but we take reasonable steps to protect your information.

Changes

If we change this policy we will update the date at the top of this page, and tell you in the app if the change is significant.

Contact

Questions about your data, or a request to access or delete it? Email hello@getnuggit.com and we will respond within 30 days.