Privacy policy
Last updated 9 November 2026
Ithuru is an app for reserving surplus food from shops, bakeries and restaurants in Colombo and collecting it at the counter. This policy explains what we collect when you use it, and why.
Ithuru is made by Abdulla Ehsan at Pledge Automations, who is responsible for your data ("we" in this policy). It covers the Ithuru app for iPhone and Android and these web pages. We follow Sri Lanka's Personal Data Protection Act, No. 9 of 2022.
In short
- We collect what the app needs to reserve a bag, run your pickup and help when something goes wrong.
- No ads, no tracking across other apps or websites, and we never sell your data.
- Stores see your first name and last initial with your pickup code, never your number or email.
- You can delete your account and data at any time from Profile in the app.
What we collect
Your account
Your mobile number if you sign in with a code by text message, or the name and email address Apple or Google share with us if you sign in with them. We also keep the name you show to stores and an account ID.
Your orders
The bags you reserve, the store, the pickup time, the amount, how you paid, and whether you collected it. Also the ratings and comments you leave after a pickup, your invite code and any Ithuru credit.
Location, if you allow it
Your phone's location is used on your phone to show bags near you. We don't store where you are. If you're outside the areas we cover and tap "Count me in", we store that point rounded to about 1 km, with your account if you're signed in so each person counts once, to know where to bring stores next.
Saved stores and alerts
The stores you save and the bags you ask us to tell you about.
Problem reports
When you report a problem with an order: the reason, your note and our reply.
Notifications
Pickup reminders are scheduled on your phone. To send alerts from saved stores, we store your device's push token, linked to your account until you sign out or delete it. You can turn each kind of alert off in Profile.
If you sign up a business
The business name, your name and phone number, the address, the first bag you plan to sell and, if you tap "I'm at the shop now", the shop's location. We use this to call you, check the shop and set it up.
Business sign-up steps
While a business signs up, the app records which steps were reached, with a random install ID. These events are anonymous: never linked to an account, a name or a number. We use them to make the sign-up shorter.
What we don't collect
- Card numbers. Card payments, when they're offered, are handled by PayHere, and we never see or store your card details.
- Your contacts, photos, microphone or anything outside the app.
- Advertising IDs. The app has no ads and no third-party analytics or tracking tools.
What stores and other customers see
The store you reserve from sees your first name and last initial, the bag, the pickup time and your pickup code. Your rating and comment are shown on the store's page with the same first name and initial.
Who else handles your data
We use a few services to run Ithuru. They handle your data only to provide their service to us.
- Supabase hosts our database and sign-in, on servers in Mumbai, India.
- A text message provider sends sign-in codes to your number.
- Apple and Google provide Sign in with Apple and Google, deliver notifications and show the map (Apple Maps on iPhone, Google Maps on Android).
- Expo passes our notifications on to Apple and Google, using your push token.
- PayHere, a Sri Lankan payment company, takes card payments when they're offered.
We may share data when the law requires it, or to protect customers and stores from fraud. If Ithuru is ever sold or merged, this policy would continue to apply to your data.
On your phone
Your recent orders are kept on your phone so your pickup code works without signal. They're removed when you sign out.
How long we keep it
We keep your data while you have an account. When you delete your account (Profile, then Delete account), we cancel any reservation you still have and delete your account and sign-in details. The stores' records of your past orders, which they need for their accounts, stay with your name replaced by "Former customer", and so do your review comments. "Count me in" points stay without your account, and anonymous sign-up events are kept until we no longer need them.
Your rights
You can ask to see the data we hold about you, correct it, delete it, or withdraw your consent to anything we do with it. Most of it you can change or delete in the app. For anything else, email hellopledgeteam@gmail.com from the email on your account, or tell us the number you sign in with. If you're not happy with our answer, you can complain to Sri Lanka's Data Protection Authority.
Keeping it safe
Everything between the app and our servers is encrypted. Database rules mean each customer can read only their own orders and each store only its own pickups. Only the people who run Ithuru can see the rest.
Children
Ithuru is meant for adults buying food. If you're under 18, please use it with a parent's or guardian's permission.
Changes
If we change this policy, we'll update the date at the top. If a change affects how we use data you've already given us, we'll tell you in the app first.
Contact
Questions about your data: hellopledgeteam@gmail.com.