# Google Play Data Safety — MenuKosh

Internal reference for filling out the Play Console **Data Safety** form. Not
public-facing (the public-facing equivalent is `/privacy-policy`). Contains
no secrets — safe to keep in the repo.

## How this was produced

MenuKosh's Android presence is a **Trusted Web Activity (TWA)** — a thin
Android wrapper around this Laravel web app, generated externally via
PWABuilder (see `PLAY_STORE_SUBMISSION.md`), not a native codebase living in
this repository. There is no `AndroidManifest.xml`, Gradle build, or `.aab`
in this repo to statically audit — confirmed by search, not assumed.

So this table is built from what **is** verifiable here: the Laravel
database schema (what's actually collected), the app's own JavaScript (which
browser APIs it calls, since those are what a TWA's permission prompts map
to), and a full-text search for analytics/ads SDKs (none found). Anything
that depends on the *packaged Android build specifically* — the final signed
permission list, the signing certificate fingerprint — is marked TODO below;
re-verify those directly in the Play Console after each PWABuilder package
is generated, rather than assuming this document alone is sufficient.

## Data collection & sharing table

| Data category | Specific data | Source | Collected? | Shared? | Required/Optional | Purpose | Retention | Encrypted in transit | Deletion method | Code / evidence |
|---|---|---|---|---|---|---|---|---|---|---|
| Personal info | Name | Owner/staff registration; customer checkout | Yes | No (see note 1) | Required | Account mgmt / order fulfilment | See TODO (retention) | Yes (HTTPS) | `/data-deletion` request | `users`, `orders`, `bookings`, `leads`, `reviews` tables |
| Personal info | Email address | Owner/staff registration; some public forms | Yes | No | Required (owner/staff), Optional (customer forms) | Account mgmt, support | See TODO | Yes | `/data-deletion` request | `users.email`, `leads.email`, `bookings.customer_email` |
| Personal info | Phone number | Owner/staff registration; customer checkout/booking/review | Yes | No | Required (owner/staff), Optional/Required varies (customer) | Order/booking fulfilment, contact | See TODO | Yes | `/data-deletion` request | `orders.customer_phone`, `bookings.customer_phone`, `leads.phone`, `reviews.reviewer_phone` |
| Personal info | Physical address | Delivery orders only | Yes | No | Required for delivery orders only | Order fulfilment | See TODO | Yes | `/data-deletion` request | `orders.delivery_address` (free text, not GPS) |
| App activity | In-app actions (orders placed, bookings made) | Normal app usage | Yes | No | Required | Core app functionality | See TODO | Yes | `/data-deletion` request | `orders`, `bookings` tables |
| App activity | App interactions / login activity | Login, logout, failed login | Yes | No | Required (security) | Fraud/abuse prevention, security audit | See TODO | Yes | Not user-deletable (security audit log); see Privacy Policy §K/L | `activity_logs` table |
| Financial info | Purchase history | Subscription payments; order payment status | Yes | Yes — Razorpay (payment processor) | Required | Payment processing | See TODO | Yes | N/A — no raw card/UPI/bank data stored | `payments` table (razorpay_payment_id, razorpay_order_id, amount, status only) |
| Financial info | Card/bank/UPI details | — | **No** | — | — | — | — | — | — | Confirmed: not stored, not transmitted to MenuKosh servers — Razorpay handles this directly |
| Device or other IDs | IP address | Every request | Yes | No | Required | Security, abuse prevention | See TODO | Yes | Not individually user-deletable (security log) | `activity_logs.ip_address`, various `ip_address` columns |
| Device or other IDs | Advertising ID | — | **No** | — | — | — | — | — | — | No ads SDK present — confirmed by codebase search |
| Location | Precise or approximate location | — | **No** | — | — | — | — | — | — | No `navigator.geolocation` call anywhere in the codebase — confirmed by search |
| Photos | User-uploaded images | Restaurant logo, cover, menu-item photos | Yes | No | Optional | Displaying the restaurant's menu/branding | See TODO | Yes | Deleted when replaced; `/data-deletion` for full removal | `ImageUploadService`, standard `<input type="file">` — no camera-capture API used |
| Messages | — | — | **No** | — | — | — | — | — | — | No in-app messaging; WhatsApp links open the WhatsApp app itself, outside MenuKosh |

**Note 1 — sharing**: the *restaurant* a customer orders from can see that
customer's own order/booking data (this is the product's core function, not
third-party sharing). No data is sold, and no advertising/analytics network
receives any of the above.

## Verified absent (checked directly in code, not assumed)

- Google Analytics, Firebase Analytics, Facebook Pixel, AdMob, Mixpanel,
  Hotjar, Segment — no matches anywhere in the codebase.
- Geolocation API (`navigator.geolocation`) — not used.
- Camera API (`getUserMedia`) — not used; file uploads go through a standard
  file-picker input, not an in-app camera capture flow.
- Contacts, SMS — not used.

## Web APIs actually used (map to Android runtime-permission prompts under a TWA)

| Web API | File(s) | Android-side effect |
|---|---|---|
| `Notification.requestPermission()` | `resources/views/partials/order-notifier.blade.php` | POST_NOTIFICATIONS prompt (Android 13+) — for new-order alerts |
| `navigator.vibrate()` | `resources/views/partials/order-notifier.blade.php` | VIBRATE — normal-protection, auto-granted, no user prompt |
| `navigator.clipboard` | Coupon code copy, QR link copy, tracking-link copy (several files) | No permission prompt |
| `navigator.share()` | `resources/views/customer/order-track.blade.php` | Opens native Android share sheet, no permission prompt |
| `<input type="file">` | Logo/cover/menu-item upload forms | Opens system file/photo picker; may offer camera as one of several picker sources, but does not itself request the CAMERA permission |

## TODO before each Play Console submission

- [ ] Confirm the actual signed `.aab`'s declared permissions (via Play
      Console's own pre-launch report) match the table above exactly —
      this document describes intent, the Play Console report is the
      ground truth for what actually shipped.
- [ ] Fill in specific data-retention periods once approved by
      legal/business (see matching TODO in `/privacy-policy`).
- [ ] Confirm hosting/database physical region for the "data processing
      location" field in the Data Safety form (see matching TODO in
      `/privacy-policy`).
- [ ] If push notifications via a native channel (rather than the web
      Notification API) are added in future, re-audit this document —
      that would introduce a Firebase Cloud Messaging dependency not
      currently present.
- [ ] Re-run the "verified absent" search above before each release in
      case a dependency update silently introduces an analytics SDK
      transitively.