Privacy Policy

What Data We Use

Cake Designs & Preferences

Your in-progress cake customisations, favourites, cart items, and app settings are stored on your device using local storage while you're designing. Once you place an order, that cake's design becomes part of the order record stored on our servers, so it can be prepared correctly and referenced later (order history, re-ordering, ratings).

Contact & Order Information

When you place an order, the name, phone number, and delivery or pickup details you enter are sent to and stored on our servers to process the order, and are shared with the assigned bakery so they can fulfil it. This information is not shared with anyone else.

Camera Access & Edible Images

If you choose to upload an edible image for your cake, the app requests camera or photo library access. The image is resized on your device before upload, then stored on our servers (in a private, access-controlled location) so the bakery can print it and so it's available if you reorder.

Ratings & Photos

If you rate a completed order and choose to attach a photo, the rating and photo are stored on our servers and may be shown (without your name) to help other customers choose a bakery.

Location Data

Location access is requested only to help set your delivery address when placing an order. If you place a delivery order, that address is stored on our servers as part of the order record; it is not tracked continuously and is not used for any purpose beyond fulfilling that order.

Motion & Gyroscope

The app uses device motion sensors to create a subtle 3D parallax effect on the cake preview. This data is processed in real-time and never stored or transmitted.

What We Do NOT Collect

• No passwords — signing in uses a verification code sent to your phone number by WhatsApp or SMS, and you can still order as a guest without creating an account
• We do not ask for your email address to place an order, and we only store it if you enter it yourself in the "notify me when a bakery launches near you" form
• No advertising identifiers, tracking pixels, or third-party analytics
• No cookies for cross-site tracking
• Anonymous in-app usage events (e.g. which screens you open) are recorded, but stay on your device only and are never uploaded

Where Your Data Is Stored & Third-Party Services

Order, contact, and image data described above is stored on Supabase, the backend infrastructure provider Qaalab uses to host its database and servers. Supabase processes this data on our behalf as our infrastructure provider; it does not use it for its own purposes. The other third parties that receive any data are the map services used at checkout when you choose to set a delivery location:

• OpenStreetMap — when you tap "Find my location" or use the map, your approximate or precise location and IP address are sent to OpenStreetMap (map tiles) and its Nominatim service (to look up your address). This happens only at your request.
• unpkg — the map (Leaflet) library loads from the unpkg CDN, which therefore receives your IP address. Display fonts and 3D assets are bundled in the app, so no other CDN is contacted.

No personal data is sent to these two services beyond what is technically required (location for geocoding, IP for content delivery).

Data Sharing

When you share a cake design (via screenshot or link), you are using your device's native share sheet. Qaalab does not intercept, store, or process shared content.

When you place an order, your order details and delivery information are shared only with the assigned bakery for fulfilment purposes, and (in summary, aggregated form) used to calculate and settle the bakery's payout for orders they've completed.

Children's Privacy

Qaalab does not knowingly collect personal information from children under 13. The app's cake design features can be used by anyone without providing personal data.

Changes to This Policy

We may update this privacy policy as new features are added. Changes will be reflected on this page with an updated date. Continued use of the app constitutes acceptance of the updated policy.