1. Introduction
Richo ("Richo", "the app", "we", "us", or "our") is a Cash-on-Delivery online-shopping app operated by The Soft Mechanic. Through the app you can browse products, place orders, and have them delivered in and around Barbigha (pincode 811101), India.
This Privacy Policy explains what personal information the Richo app collects, how we use it, who we share it with, and the choices and rights you have. It applies to the Richo Android app (package com.thesoftmechanic.richo) and the services provided through it.
By using Richo, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the app.
2. Information We Collect
We only collect information that is needed to run your account and fulfil the orders you place. Specifically:
2.1 Account information
- Name (required) — you provide this when you create your account, or it is taken from your Google account name if you sign in with Google. It is used on your profile and on your orders.
- Phone number (required) — verified by a one-time password (OTP) sent by SMS through Firebase phone authentication. A verified phone number is required to place a Cash-on-Delivery order.
- Email address (optional) — you may add an email during sign-up, or it may be provided if you sign in with Google. It is used only as an alternative way to look up your registered account at login. Your account works with a phone number alone; an email is not required.
- Profile photo / avatar (optional) — if you choose to add a profile picture, it is selected using your device's system photo picker (no storage permission is requested). The image is reduced in size and stored on your device and, in encoded form, in your private profile record in our backend. It is used only to personalise your profile and is not shown to other shoppers.
2.2 Delivery addresses
When you add a delivery address, we collect the details you enter: recipient name, address line, city, pincode, contact phone number, and an optional address label (for example "Home" or "Work"). These are used to deliver your orders.
2.3 Order and purchase history
When you place an order, we collect the items, quantities, prices, order totals, the Cash-on-Delivery amount, and order status, together with the delivery details for that order. This lets you track your orders and lets the seller fulfil them.
2.4 Notification token (device identifier)
We collect a Firebase Cloud Messaging (FCM) push token for your device so we can send you order-status notifications (for example, when your order is confirmed or out for delivery). This token is a messaging identifier — it is not used for advertising or tracking.
2.5 Account identifier
The app creates a Firebase account identifier (uid) for you, including an anonymous identifier used for browsing before you sign in. This identifier links your data (profile, addresses, orders) to your account.
2.6 Technical and connection data
The app itself does not read your device's hardware identifiers. However, when the app connects to our backend service provider (Google Firebase), standard technical information such as your IP address and connection timestamps is necessarily processed by that provider to deliver the service and to protect it against abuse (via Firebase App Check / Google Play Integrity). We do not use this to build advertising or tracking profiles.
2.7 Information stored only on your device
Your shopping cart and wishlist are stored only on your device and are not transmitted to us. Cart contents leave your device only at the moment you place an order (at which point they become part of your order history). The in-app "Richo AI" helper works fully offline; anything you type into it stays on your device and is not sent anywhere.
2.8 What we do NOT collect
To be clear, Richo does not collect:
- Your location. The app requests no location permission and uses no GPS or location services. Your delivery pincode is simply a value you type into an address, not a device location.
- Device or hardware identifiers such as Android ID, device model, brand, or manufacturer.
- Payment card, bank, or UPI details. Richo is Cash-on-Delivery only — you pay cash to the delivery agent when your order arrives. The app does not collect, enter, or store any card number, CVV, expiry, bank account, or UPI information.
- Analytics, crash-reporting, or advertising data. The app contains no analytics SDK, no crash-reporting SDK, and no advertising SDK, and it shows no third-party ads.
- Camera, microphone, contacts, calendar, SMS/call logs, or health data.
3. How We Use Your Information
We use the information above to:
- Create and manage your account and sign you in (phone OTP or Google Sign-In).
- Show your profile and personalise it with your optional photo.
- Take, process, and deliver your Cash-on-Delivery orders to your chosen address.
- Let you view and track your order and purchase history.
- Send you order-related notifications through the push token.
- Keep the service secure and prevent fraud and abuse (for example, phone verification and request attestation).
We do not use your information for advertising, and we do not sell your personal information.
4. Sharing and Third Parties
We share your information only where it is needed to run the service or fulfil your order:
- Sellers / merchants and delivery agents. To deliver an order you place, we share the relevant delivery name, phone number, delivery address, and the order contents with the seller/merchant who fulfils that order and their delivery rider. This is used solely to prepare and deliver your order.
- Google Firebase (our backend/service provider). Your data is stored and processed using Google Firebase services — Cloud Firestore (database), Firebase Authentication (sign-in), and Firebase Cloud Messaging (notifications), together with Firebase App Check / Google Play Integrity for security. Google acts as our infrastructure/service provider (a data processor) and processes this data on our behalf to operate the app.
- Google Sign-In. If you choose to sign in with Google, Google's sign-in service handles that authentication.
We do not share your data with any advertising network, analytics provider, or data broker, and we do not sell or rent your personal information to anyone.
Payments: Richo uses Cash on Delivery only. There is no payment gateway in the app and no card, bank, or UPI details are collected or stored, so no such payment data is shared with anyone.
We may disclose information if required to do so by law, or to protect our rights, users, or the public where permitted by applicable law.
5. Data Security
All data sent between the app and our backend travels over encrypted connections (TLS/HTTPS) provided by Google Firebase. The app additionally uses Firebase App Check (Google Play Integrity on release builds) to help ensure that requests come from the genuine app. While no method of transmission or storage is completely secure, we take reasonable measures to protect your information.
6. Data Retention and Deletion
We keep your account information, addresses, and order history for as long as your account exists and as needed to provide the service, resolve delivery issues, and meet legal or record-keeping obligations.
You can update your name, photo, and delivery addresses at any time within the app. You can also permanently delete your account and personal data from within the app: open the Profile tab and tap Delete account. Signing out ("Logout") only clears data cached on your device and does not by itself delete your account.
Alternatively, to request deletion of your account and personal data, email us at thesoftmechanic.help@gmail.com from the email or with the phone number associated with your account. We will verify your request and delete your account and associated personal data, except where we are required to retain certain records by law.
7. Children's Privacy
Richo is a general commerce app intended for adults and is not directed at children. It is not intended for use by anyone under 18 years of age (and in any case not by children under 13). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at the email below so we can remove it.
8. Your Rights
Depending on your location and applicable law, you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information (you can edit much of this directly in the app);
- Request deletion of your account and personal data;
- Withdraw optional information you have provided (for example, remove your email or profile photo).
To exercise any of these rights, contact us using the details in Section 10. We will respond in line with applicable law.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where appropriate, provide notice within the app. Your continued use of Richo after an update means you accept the revised policy.
10. Contact Us
If you have any questions, requests, or concerns about this Privacy Policy or your personal data — including account or data deletion requests — contact:
The Soft Mechanic — Richo
Email: thesoftmechanic.help@gmail.com