PRIVACY POLICY

• Account info: name, email, phone number, password (hashed). Required to use the app, earn rewards, and save favorites.
• Order history: what you ordered, when, from which store, how you paid. Used for order support, refunds, and to show you your past orders.
• Payment info: we do not store full card numbers. Payment is processed by Stripe and Apple/Google Pay. We store only the last 4 digits and card brand for display.
• Location: only when you use the "find a store near me" feature or place a delivery order. We do not track your location in the background.
• Device info: device type, OS version, app version. Used to debug crashes and improve the app.
• Camera access: only when you scan a QR code or upload a photo for a profile avatar. We don't access the camera at any other time.

• To process and fulfill your orders.
• To provide customer support and process refunds.
• To award and track CRUNCH Rewards points.
• To send order confirmations, status updates, and important account notifications.
• To send marketing emails and push notifications — only if you opt in. You can opt out at any time in the app or by clicking unsubscribe in any email.
• To improve our menu, app, and store operations.
• To comply with legal obligations (tax records, health inspections, etc.).

• We do not sell your personal data to anyone.
• We do not share your data with advertisers.
• We do not use your data to train AI models or sell aggregated profiles.
• We do not read your messages, contacts, or anything else not listed above.
• We do not track your location in the background when the app is closed.

We share data only with the vendors we need to run the business:

• Stripe — processes payments. They receive your card data directly; we never see it.
• Twilio — sends SMS order updates. Receives your phone number only for the duration of the order.
• SendGrid — sends email. Receives your email address and the content of the email being sent.
• Delivery partners (Uber Eats, DoorDash, Grubhub, Postmates) — receive your name, address, phone, and order details only when you order through them.
• Google Maps — for store locator. Receives your approximate location only when you use the locator.

We do not share data with any other third parties without your explicit consent, except where required by law.

• Account info: until you delete your account.
• Order history: 7 years (required for tax and audit purposes).
• Payment records: 7 years (last 4 digits only; no full card numbers ever stored).
• Marketing data: until you opt out, then deleted within 30 days.
• Rewards points: expire 12 months after your last order (see Rewards page for details).

You can request a copy of all the data we hold about you, request corrections, or delete your account entirely. Email privacy@crunch.com and we respond within 30 days. Deleting your account also deletes your rewards points and order history (except records we're legally required to keep, which are anonymized).

You must be 13 or older to create a CRUNCH account. We do not knowingly collect data from children under 13. If you believe a child has provided us personal data, email privacy@crunch.com and we will delete it.

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Passwords are hashed using bcrypt. Access to customer data is restricted to authorized employees with a business need. We undergo annual security audits by an independent firm. If we ever experience a data breach, we notify affected customers within 72 hours of discovery.

We update this policy when we change how we handle data. We notify all account holders by email at least 30 days before material changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this policy? Email privacy@crunch.com or write to us at: CRUNCH Foods Inc., Attn: Privacy, 142 Main Street, Metro City, MC 00010.