Cookie & Tracking Policy

These are required for the Platform to function. They cannot be switched off without breaking the service.

These are stored in your browser's local storage rather than as cookies. They stay on your device and are not transmitted with every request.

If you allow notifications, Google Firebase Cloud Messaging issues a registration token for that browser or device. We store it against your account, along with your browser user-agent string, so we can tell you when your order is accepted, picked up and on its way.

• Notifications are off until you explicitly grant permission.
• You can revoke permission at any time from your browser or operating system notification settings. The token is then no longer usable and we prune it.
• A service worker is registered to receive these messages and to keep an installed app on the current version. It stores no personal data of its own.

We record a limited operational picture of how the Platform is being used — the page currently open, the cart being built, and the role of the session. This drives the live operations view an administrator uses to run the service: to see that orders are flowing, that kitchens are online, and that nothing is stuck.

• It is tied to your device identifier and, once you sign in, to your account.
• It is used internally only. It is not shared with advertisers or data brokers.
• These records are short-lived and pruned regularly.
• This is separate from the advertising pixels described below — we do not use cross-site trackers or device fingerprinting of our own.

If you grant location permission, we read your coordinates at two moments only: when checking that your address is inside our delivery radius, and at checkout so the Delivery Partner can find you. We do not track your location in the background and we do not read it when you are not using the Platform. You can decline location access and type your address manually instead.

When you pay, the payment gateway's checkout is loaded in your browser and it sets its own cookies to secure that transaction. Those are governed by the gateway's own policies, not ours.

While we are running an ad campaign, pages also load Google's and Meta's (Facebook and Instagram) own tracking scripts, which set their own cookies on your device — separate from anything KhauGully sets itself.

• What they see. The pages you visit on this site, and — only when you complete an order — that an order happened and its rupee value. We never send them what you ordered, your address, or your name.
• Meta Purchase events. To help Meta match an order back to the ad that led to it, we also send your phone number in irreversibly hashed form (SHA-256) — never as plain text — alongside the order. Meta's own policy governs what it does with a hashed match.
• Why. This is how ad platforms measure whether a campaign led to real orders, so we don't keep spending on ads that aren't working.
• Turning it off. Opt out of Google's ad personalisation at adssettings.google.com, and Meta's at facebook.com/adpreferences. Blocking third-party cookies in your browser stops both from tracking you here at all.

• Clear everything — clear site data for this website in your browser settings. This signs you out and empties your cart.
• Block cookies — you can block them in your browser, but you will not be able to sign in or place an order.
• Turn off notifications — revoke the notification permission for this site in your browser or device settings.
• Turn off location — revoke the location permission and enter your address manually.

For anything about this policy, contact Shoaib Qureshi at support@khaugully.in. For the wider picture of how we handle personal data, see our Privacy Policy.