Privacy policy

1.Data we collect

• Account: name, email address, password (stored only as a hash, never in plain text), language, role (customer or cook), photo and phone number if you add them.
• Cook profile: public information (display name, bio, specialties, neighbourhood, dish photos, opening hours) and private information (exact address and location).
• “Verified kitchen” check: documents you choose to upload (ID, certificates, kitchen photos), kept in private storage.
• Reservations: dish, date, time, pickup or delivery, delivery address and phone, note, status history and applied promotion.
• Messages, reviews, reports, favourites and event requests.
• Technical data: the cookies described below, your IP address (security and rate limiting) and, if you turn on push notifications, the technical address of your device provided by your browser.

2.Why we use it

• To provide the service: account, search, reservations, messaging, reviews.
• To send necessary emails: address verification, password reset, order updates, reminders (can be turned off in Settings).
• To keep the platform safe and moderated: abuse prevention, handling reports.
• To suggest dishes you may like, based only on your activity on DarFood.
• To produce aggregate statistics that help us improve the platform.

We do not sell your data and do not show targeted advertising.

3.Cooks' address and location

A cook's exact address is never public. The map and profiles only show the neighbourhood and an approximate position, shifted by several hundred metres.

The exact address is shared with a customer only for a pickup, once the cook has accepted the reservation. A customer's delivery address is visible only to the cook of that order.

Metadata of uploaded photos (including GPS location) is removed automatically.

4.Who can see your data

• Other users: your public profile, dishes and reviews.
• The customer and the cook of a reservation: the information needed for the order and their messages.
• DarFood administrators: for support, moderation and cook verification.
• Our technical providers (hosting, email delivery, image storage), acting only on our instructions.
• Public authorities, when required by law.

5.Cookies

• hc_session: keeps you signed in. HttpOnly cookie (not readable by scripts), limited lifetime, removed when you sign out.
• hc_locale: remembers your language (1 year).

We use no advertising cookies and no third-party analytics. The map loads OpenStreetMap tiles: their servers receive your IP address to display them.

6.Retention

• Account and profile: as long as your account is active.
• Notifications: 90 days.
• Verification and password-reset links: deleted automatically when they expire.
• Reservations, messages and reviews: kept as long as needed for the service, dispute handling and our legal obligations.
• Verification documents: until you delete them from your cook space or delete your account.
• Devices registered for push notifications: until you turn them off, sign out on that device or delete your account.

7.Security

Encrypted connections (HTTPS), hashed passwords, HttpOnly session cookies, permission checks on every request and restricted access to private documents. No system is flawless: tell us quickly if you think your account has been compromised.

8.Your rights

You can access and correct your data (Settings page), object to reminder emails and push notifications, and delete your account yourself (Settings › Delete my account): your personal information is then erased and order history is kept anonymously. These rights apply under Tunisian Organic Law No. 2004-63 of 27 July 2004 on personal data protection and, where applicable, the GDPR.

You can also lodge a complaint with the National Authority for the Protection of Personal Data (INPDP).

9.Minimum age

DarFood is only for people aged 18 or over.

10.Changes

We may update this policy. The date of the last update is shown at the top of the page; we will let you know about significant changes.