Privacy policy

To deliver an order we collect only what delivery requires:

• Your name.
• Your email address — used to confirm your order.
• Your mobile number — the courier uses it before delivery.
• Your delivery address, including landmark, city, state and PIN code.
• The products and quantities you ordered, and the amount payable.

We do not ask for your date of birth, gender, card details or bank details. Because we only offer Cash on Delivery, no payment instrument ever passes through this website.

To stop automated abuse of our order system we record, alongside each order, a one-way cryptographic hash of your IP address and of your mobile number, plus your browser's user-agent string. The hashes cannot be reversed to recover the original values; they exist so we can count requests without storing what made them.

We also keep short-lived counters of request timings for rate limiting. These are automatically deleted after 24 hours.

We measure how this site is used so we can fix what is broken and make it easier to buy from. This is our own first-party measurement — the data stays on our server, is never sent to an advertising network, and is never sold.

We ask before collecting anything beyond a page count. If you choose “Essential only”, we record which pages were opened, and — separately, to stop automated abuse of our order system — a one-way hash of your IP address and the first half of it (for example “103.21.x.x”). Nothing else: no location, no browser or device details, and no record of what you clicked or how far you scrolled.

If you accept analytics, we additionally record:

• Which pages you viewed, in what order, and roughly how long for.
• Your device type, operating system, browser and screen size.
• An approximate location — country, state and city — worked out from your IP address by our hosting provider. We never ask your device for GPS location.
• How you reached us: the site that linked to you, or the campaign tag in the link.
• Buttons and links you clicked, and how far down a page you scrolled.

Your IP address itself is never stored. We keep only a one-way hash of it, plus the first half of the address (for example “103.21.x.x”), which is enough to spot a flood of automated orders from one network and not enough to identify a household. Analytics records are deleted after 90 days.

You can change your mind at any time, right here, and withdrawing is exactly as easy as agreeing was. If your browser sends a “Do Not Track” or Global Privacy Control signal, we honour it and never ask.

• We do not use advertising trackers, marketing pixels, or any third-party analytics service. Our measurement is entirely first-party and self-hosted.
• We do not request your precise location, camera, microphone, contacts or files.
• We do not sell, rent or share your personal information with third parties for marketing.
• We do not publish customer orders, and there is no public way to look up an order by its ID.

Your cart is stored in your own browser's local storage as a list of product IDs and quantities — no prices, no personal details. Your order confirmation is held briefly in session storage so the confirmation page can display it, and is cleared when you close the tab. You can clear both at any time through your browser settings.

• Our courier partner, which needs your name, address and mobile number to deliver the parcel and collect payment.
• Our own operations spreadsheet, so the team can pack and dispatch your order. Access to it is restricted to KESHME staff.

Order records are retained for as long as we need them to fulfil the order, handle returns, and meet tax and accounting obligations. Rate-limiting data is deleted within 24 hours.

To ask what we hold about you, to correct it, or to request deletion, email support@keshme.example. We may need to keep records we are legally required to retain.