Today's lunch batches close at 1:30 PM. Pre-order now to secure fresh portions.
RotiRozi
RotiRozi
Friends feedTiffin
Sign inJoin
Home/Privacy policy
Zero-Trust Security & Cryptographic Architecture
Last updated: October 30, 2026

Privacy Policy & Data Protection

At RotiRozi, we believe trust is the cornerstone of home cooking. We treat your personal identity, kitchen verification assets, and live delivery coordinates with institutional cryptographic security. This Privacy Policy outlines how our architecture collects, encrypts, and isolates your data.

Looking for our commercial terms & fee policies?View Terms of Service

AES-256 KYC Encryption

CNICs, utility bills, and face photos are stored using AES-256 encryption at rest and accessible only to vetted compliance admins.

Pseudonymous Handles

Reddit-style unique usernames protect customer legal names from public disclosure in reviews and social feeds.

SHA-256 Token Rotation

Refresh tokens are hashed cryptographically with automatic MongoDB TTL cleanup to eliminate session hijacking risks.

1KYC Verification Security & Cryptographic Storage

Institutional-Grade AES-256 Storage & Admin Isolation

All sensitive identity assets—including National Identity Cards (CNIC front and back), residential utility bills (used exclusively to verify domestic kitchen addresses), driving licenses, and live facial verification selfies—are encrypted immediately upon ingest using AES-256 encryption at rest and transmitted over authenticated TLS 1.3 encrypted tunnels.

To eliminate insider threats, credential stuffing, and data leakage, RotiRozi enforces three architectural invariants across its KYC handling pipeline:

  • Strict Admin Route Isolation (Rule 1): Administrative verification endpoints (/api/v1/admin/*) are isolated from customer/public infrastructure. Zero social or third-party OAuth authentication is permitted on admin routes. Only internal, pre-seeded administrators with hardware-bound credentials can review KYC documents.
  • Zero Commercial Monetization: Under no circumstances are KYC documents, national identity numbers, or domestic utility bills sold, leased, or shared with third-party advertisers, data brokers, or marketing networks.
  • Immutable Access Logging: Every operational interaction with a KYC document is recorded in an append-only audit trail logging the reviewing administrator's internal ID, timestamp, IP address, and moderation rationale.

2Pseudonymous Identity & Public Profiles

We believe ordering food should not expose your real-world identity to strangers. On signup, customers are automatically provisioned a Reddit-style unique username (such as @BriskBiryani482 or @CrispyKarahi192):

  • Public Separation: Your legal name and email address are never displayed publicly on reviews, photo galleries, or discovery feeds. Only your chosen handle and community display name are visible.
  • Phone Number Protection: Your phone number is strictly shared with the assigned delivery courier solely for the active order window to ensure delivery handoff. Once delivered, the dispatch link terminates.

3Delivery Coordinates & Map Pin Privacy

When you pinpoint your delivery location using our map interface:

  • Purpose-Bound Coordinate Use: Latitude and longitude coordinates are utilized exclusively to: (a) verify that a home chef's configured delivery radius covers your home, (b) calculate dynamic delivery fees, and (c) provide navigation routing to the rider.
  • Zero Background Tracking: RotiRozi does not collect persistent background geolocation when your browser tab or app is closed. Location data is queried on-demand only when setting or updating an address.

4Social Graph & Anti-Spam Handshake Privacy

Unlike conventional social networks that publish public contact lists or scrape your contact book:

  • No Public Directory: RotiRozi does not maintain a publicly searchable member directory. Strangers cannot cold-browse your profile, friend list, or order history.
  • Ephemeral WhatsApp Handshakes: Friend invitations generate a single-use 6-digit numeric PIN and secure URL token with a strict 48-hour expiration TTL in MongoDB. Once claimed, the token is permanently retired.
  • Verified Review Privacy: While reviews are visible on a kitchen's public storefront under your handle, friend-specific endorsement badges (e.g. "Ayesha often orders from this kitchen") are only visible to users within your mutual accepted circle.

5Session Security, Cryptographic Tokens & Auto-Cleanup

Authentication state is protected by defense-in-depth token cryptography:

  • Short-Lived Access Tokens: Access tokens expire within 15 minutes, limiting the attack window in the event of an intercepted bearer token.
  • SHA-256 Refresh Token Hashing: Raw refresh tokens are never stored in plain text in our database. We store cryptographically salted SHA-256 hashes.
  • Automated TTL Invalidation: MongoDB TTL indexes automatically prune expired sessions and single-use password reset OTPs from database collections within 10 minutes of expiration.

6Your Data Rights & Retention Controls

You maintain full sovereignty over your personal data:

  • Right to Rectification: You may edit your display name, username, contact phone, saved delivery addresses, and taste preferences anytime via your account settings.
  • Right to Erasure (Account Deletion): You may request permanent account deletion by emailing privacy@rotirozi.com. Upon verification, your profile, saved addresses, and session credentials will be purged from our active operational systems within 30 days, retaining only legally mandated tax/accounting transaction records required under Pakistani law.
Data Protection & Security Officer

Direct all privacy inquiries and data requests to privacy@rotirozi.com.

Read Terms of Service →