Privacy policy

Awan Farms delivers fresh dairy and pantry staples in Lahore. Our address is Barki Road, Lahore.

This policy explains what we collect through this website, why we collect it, and who else handles it. It applies to this website and to the orders, subscriptions and deliveries arranged through it.

If anything here is unclear, ask us through the contact form.

We collect what an order or a subscription needs in order to reach you and be billed correctly, and nothing beyond that.

Your account

Your full name, phone number and email address. We need a name to address the delivery, and a phone number or email so we can reach you about it and so you can sign in.

Your delivery address

The recipient's name, a phone number, the address line and the city. This is what the delivery is routed to.

Your password

If you set one, we store only a scrambled form of it. The password itself is never stored and cannot be read back, by us or by anyone else.

Your orders and subscriptions

What you ordered and how much, your delivery dates and whether each delivery happened, and the invoices and payments that follow. This is what your bill is built from, and what lets you see your own history.

Your Google profile photo

Only if you choose to sign in with Google. It is used as your account picture. If you sign in with a password instead, we never receive it.

A message you send us

If you use the contact form, we receive the name, email address, topic and message you type, so that we can reply.

We use it for these purposes only:

Fulfilling your order

Preparing what you ordered and getting it to your address on the day you chose.

Billing and invoices

Working out what you owe from the deliveries that actually happened, and producing your bill.

Your account and signing in

Keeping you signed in, and showing you your own orders, subscriptions and addresses.

Emails we have to send

Sign-in links, password-reset links, and passing on a message you submit through the contact form.

Keeping the site secure

Limiting repeated sign-in, sign-up, password-reset and contact-form attempts, so that an account cannot be attacked by guessing.

We use a small number of outside services to run the site. These are all of them.

Supabase

Our database. It is hosted in Seoul, South Korea, which means the information described above is stored outside Pakistan.

Netlify

Hosts the website and runs its server code.

Cloudinary

Stores the product and article photographs shown on the site. No customer photographs are uploaded to it.

Resend

Sends the emails described above. It handles the email address the message is going to, and the contents of that message.

Google

Involved only if you choose to sign in with Google. If you sign in with a password instead, Google is not used.

WhatsApp

The site places links that open a WhatsApp chat. Opening one is your action. The site does not send anything to WhatsApp on its own.

Our delivery partner

To bring an order to your door, our delivery partner is given the recipient's name, the phone number and the delivery address for that delivery.

Some of these services store information outside Pakistan. Our database is in South Korea, and the hosting, image and email services operate internationally.

Sign-in cookie

Keeps you signed in for 30 days. Clearing it signs you out. Without it you would have to sign in again on every page.

Basket cookie

Remembers what is in your basket for 30 days. Scripts on the page cannot read it. It holds only product identifiers and quantities — prices are never kept in it, and are always read fresh from our database.

Wishlist

Saved in your browser's own storage, on your device. It is never sent to us.

No analytics or tracking

There is no analytics service, no advertising pixel and no third-party script anywhere on this site. The site also instructs your browser to connect back only to this site, so nothing is quietly reported elsewhere as you browse.

These are measures that are built into the site today, not intentions:

Passwords are never stored

A password is put through a one-way scrambling function before it is saved, and only the scrambled result is kept. Signing in compares against that result, so the password itself never exists in our database.

Encrypted connection

The site is served over HTTPS, and instructs browsers to use HTTPS for a year ahead and to upgrade any insecure request.

Sign-in sessions

Your session is held in a signed cookie that scripts on the page cannot read, and it expires after 30 days.

Separated access

Customer, administrator and rider areas are separate. The administrator area is checked twice — once before the page is reached, and again inside every administrator action — so access never depends on a single check.

You only ever see your own records

An order, subscription or address is fetched by your account identifier together with the record identifier. Asking for someone else's record simply returns nothing.

Prices are calculated on our server

Prices and totals are read from our database when an order is placed, never taken from your browser, so what is stored on your device cannot change what you are charged.

When something is removed in the app, it is marked as removed and kept, rather than erased. This is so that order and billing history stays complete and a past bill can still be explained.

Password-reset links are the exception: they expire, and each one can be used only once.

Delete a saved address

From the addresses page in your account, at any time.

Pause or cancel a subscription

From your account, at any time, without asking us.

Remove your account or your information

There is no button for this yet. Send the request through the contact form and we will act on it.

This page describes how the site works today. When the site changes in a way that affects what is written here, we update this page and change the date at the top.

For any question about this policy, or to ask us to remove your information, use the contact form.

Awan Farms, Barki Road, Lahore.

See also our terms of service.