Privacy Policy

1. About Donut and This Policy

Donut is a smart virtual mall. It brings hundreds of official brand stores into a single app so you can browse, compare and buy across brands without installing each store's app. Shopping happens inside Donut's in-app browser, and the order itself is placed with the store you chose.

This policy explains what Donut collects, why, who we share it with, and the control you have over it. It covers the Donut app and donutapp.in.

It does not cover the stores you shop on through Donut. When you sign in to a store or place an order with it, that store is handling your data under its own privacy policy — exactly as it would if you had opened its own app or website.

2. Information You Give Us

• Your mobile number, verified by OTP — this is how you sign in
• Profile details you choose to add, such as your name, email address and profile picture
• Your UPI ID, so we can pay your cashback out to you
• Delivery addresses you save, if you use address autofill at checkout
• What you write to us — support requests, bug reports, price-drop claims, feedback and ratings

3. Information We Look Up to Set Up Your Account

When you verify your mobile number, Donut may fetch publicly available information linked to that number — such as your name and UPI ID — from authorised sources. We ask for your agreement on the OTP screen before this happens.

We do this for two reasons only: to confirm the number belongs to you, and to make your first cashback payout faster by pre-filling your UPI ID. You can correct or remove anything we pre-fill from your profile at any time.

4. Your Shopping Activity Inside Donut

Rewards only work if Donut can tell that an order actually happened. So, while you browse a store inside Donut, the app recognises a small set of specific things on the page:

• Which store you opened, and when
• Whether you reached a product, cart or checkout page
• Whether an order was placed successfully — and if so, the order ID and order amount shown on the confirmation page

This recognition runs on your device, using our own engine. Only the resulting shopping event — store, order ID, amount, time — is sent to our servers, because that is what a cashback claim is made of.

We do not log your keystrokes, read what you type into forms, capture your screen, or collect the pages you visit outside a partner store.

5. Features That Read a Page Because You Asked Them To

Some features need the content of the page you are on. Each of them runs only when you tap it:

• Wishlist — saves the product's name, image, price and link so you can find it again
• Price tracking — re-reads the price of a product you saved, on a schedule, and alerts you when it drops
• Ask AI — sends the product details from the page you are viewing to our AI service so it can answer your question about that product
• Price-drop claim — captures the product page you are claiming on, as evidence for your claim
• Shopping calculator — reads prices and pack sizes on the page and calculates entirely on your device; nothing is sent to us
• Address autofill — scans the checkout form on your device to find the right fields and fills in the address you saved. What you or the form contains is not sent to us

6. The In-App Browser, Logins and Cookies

Donut's in-app browser works like any other browser. When you sign in to a store, that store sets cookies, and those cookies are stored in the browser on your own device — which is why your store logins, saved addresses and wishlists on that store keep working across sessions.

Donut never receives your store passwords. We do not have access to your account on any store.

Stores may also set their own cookies and use their own analytics inside their pages, just as they would in any browser. You can clear this at any time by signing out of the store or clearing the app's browsing data.

7. Device and Technical Information

We collect basic technical data so the app runs well and so we can fix what breaks:

• Device model, operating system version, app version and language
• Network type and connection quality, which we use to load stores faster
• Crash reports and error logs
• A push notification token, if you allow notifications
• Usage events inside Donut — screens opened, stores tapped, searches made — in aggregate, to understand what people find useful

8. Permissions We Ask For — and the Ones We Never Do

Donut asks for a permission only when a feature needs it, and only when you use that feature:

• Notifications — order updates, reward alerts and price-drop alerts
• Microphone and speech recognition — voice search. Your speech is converted to text by your phone's own speech service (Google on Android, Apple on iOS) under their policies. We keep the search text, not the audio
• Camera — only when a store's page asks for it, for example to scan something during checkout
• Photos — only if you attach a screenshot to a bug report or set a profile picture
• Location — only if you use a feature that offers location-based deals. It is optional and Donut works fully without it

We do not ask for access to your SMS, your contacts, your call logs, your screen contents, or accessibility services. Donut has no ability to read your messages or watch your screen.

9. How We Use Your Information

• To create and secure your account, and to sign you in
• To track your orders for cashback and pay your rewards out
• To sell and deliver gift cards you buy
• To personalise what you see — recommended stores, offers and products
• To send you order, reward and price-drop updates
• To answer your support requests and investigate claims
• To detect and prevent fraud, abuse of rewards, and misuse of the app
• To fix crashes, measure performance and improve the app
• To meet our legal and tax obligations

10. Payments — What We Never Touch

Donut does not collect or process the money you pay a store. You pay the store directly, through the store's own payment page and payment gateway, exactly as you would in its own app. Just like in a real mall, you pick the store and you pay the store.

We never collect or store your card number, CVV, expiry, net banking credentials, UPI PIN, or bank account password. No screen in Donut asks for them.

The only payment detail we hold is the UPI ID you give us so we can send your cashback to you.

11. Who We Share Information With

We do not sell, rent or trade your personal information. We share only what a specific job needs:

• Affiliate and tracking partners — so your order is credited to Donut and your cashback can be paid. They receive a click reference and order details, not your identity
• Our payout partner — your UPI ID, name and payout amount, to transfer your cashback
• Gift card issuers and brands — the details needed to issue the card you bought
• Cloud hosting, analytics, crash reporting and messaging providers (including Google Firebase) who run parts of our infrastructure
• Our AI service provider — only the product page content you send through Ask AI
• Authorities, when the law requires it, or to protect the rights and safety of our users

Everyone we work with is bound to use your data only for the purpose we gave it to them for.

12. Security and How Long We Keep Data

Information travels to us over encrypted connections and is stored on access-controlled servers. Data we collect is processed by our systems, not read by people, except when a human genuinely has to look — for example when you raise a support ticket or a reward claim.

We keep your account data for as long as your account is active. Reward, payout and gift card records are kept longer where tax and accounting law requires it. When we no longer need something, we delete it or anonymise it.

13. Your Rights

Under India's Digital Personal Data Protection Act, you can:

• Ask what personal data of yours we hold and how we use it
• Correct or complete anything that is wrong or out of date
• Ask us to erase your data and delete your account entirely
• Withdraw a consent you gave us earlier — this stops future processing based on it
• Nominate someone to exercise these rights if you are unable to
• Raise a grievance with us and get a response

You can delete your account yourself: open Profile, scroll to the bottom and tap Delete account. That screen lists exactly what is erased and the payout records we are required to keep. Deletion is immediate and permanent, and it cancels any reward you have not been paid yet, since payouts go to the UPI ID we are about to erase. See Account & Data Deletion for the full steps.

For anything else — or if you can no longer sign in — write to support@donutapp.in from your registered email or with your registered mobile number, and we will act within the timelines the law sets.

14. Children

Donut is meant for people aged 18 and above. We do not knowingly collect personal data from children. If you believe a child has created an account, write to us and we will remove it and its data.

15. Stores and Other Third-Party Content

Donut takes you to real stores, and stores link onward to payment pages, delivery partners and their own third parties. We do not control what those pages collect. When you leave Donut's own screens and start dealing with a store, that store's privacy policy governs. We suggest reading it for any store you shop with regularly.

16. Changes to This Policy

We will update this policy as Donut changes. When we do, we will revise the "Last updated" date at the top of this page, and we will tell you in the app if the change is significant. Continuing to use Donut after an update means you accept the revised policy.

17. Contact and Grievances

Questions about your data, or unhappy with how we handled it? Reach our Grievance Officer at support@donutapp.in, or use Contact Us in the app. We aim to acknowledge every privacy request within 48 hours and resolve it within the period prescribed by law.

Grievance Officer, INRBox Private Limited
Email: support@donutapp.in