Privacy
HatchX is used by people at work, and most of what it holds is their employer's business records rather than anything about them personally. This page says exactly what is stored, why it is there, and who can reach it.
Last updated 31 October 2026
The short version
We store the phone numbers and names needed to run deliveries, the addresses being delivered to, and the orders, production and payments the collective records. We do not sell any of it, we do not advertise, and there is no tracking or analytics SDK in the app.
Each collective's data lives in its own separate database. We do not pool customers into one table. A collective's staff can only reach their own collective's records.
What is stored
| Data | Why |
|---|---|
| Name and mobile number — staff | Signing in, and recording who entered an order or took a payment. |
| Name and mobile number — customers | Knowing whose order it is, and reaching them about a delivery. Where a customer orders over WhatsApp, their WhatsApp id is stored so replies reach the right chat. |
| Delivery addresses | Society and business addresses, with a map pin and pincode, so a route can be planned. These are places, not homes of named individuals. |
| Orders, deliveries, payments | The collective's business records. Quantities, prices, what was collected and what is owed. |
| Delivery photographs | A photo of what arrived at a collection point, so a disputed delivery can be settled. Stored in a private bucket and viewable only through short-lived signed links. |
| Notification token | A token for the handset, so a rider's phone can be told a new order has arrived. It identifies the installation, not the person. |
Location
When a rider plans a run, the app asks for the phone's location so it can order the stops nearest-first and show how far each one is. That position is used on the device and is not stored or sent to us. Declining the permission does not stop the app working; distances are simply hidden until a starting point is picked by hand.
A collective can save a starting point — usually the farm or depot a run begins from. That is a place the collective chose, and it is stored with their settings.
The camera
The camera is used for one thing: photographing a delivery at a collection point. The app does not read the photo library.
What we do not do
- No advertising, and no sale or sharing of data with advertisers or data brokers.
- No analytics or tracking SDK in the app.
- No profiling, and no automated decisions that affect anyone.
- No location history.
Who can see it
- The collective
- Their own staff, limited by role — a delivery rider sees the day's run, not the books.
- Shivora.ai
- We operate the service, so our engineers can reach a collective's data when they ask us to fix something, and to keep the service running. We do not look at it otherwise.
- Our processors
- Supabase (database and storage), Expo (delivery of push notifications), Render (the API service) and Vercel (this site). Each processes data only to provide its service.
How long
Business records are kept for as long as the collective is a customer, and afterwards for as long as they or the law require them to keep their books. Delivery photographs are kept with the delivery they belong to. A notification token is deleted when that person signs out of the handset.
Your choices
Accounts in HatchX are created by a collective's own admin, not by signing up. If you want your details corrected or removed, the quickest route is your collective's admin, who can do it directly. You can also write to us and we will act on it, and pass on anything that is the collective's to decide.
Contact: privacy@shivora.ai
Children
HatchX is a tool for work and is not directed at children.
Changes
If this policy changes in a way that matters, we will say so here and update the date at the top.