Legal
Privacy Policy
1. Who is responsible for your data
The MN Food app and this website are operated by UR "MN FOOD", Mehmedalije Maka Dizdara, Stupine B11, lokal br. 5, 75000 Tuzla, Bosnia and Herzegovina ("MN Food", "we"). For any privacy question write to hallo@appkraft.de.
2. In short
The app exists so you can order food ahead. For that we need your phone number, your name and the contents of your order. If you enter them, we also keep your email, the avatar you picked and your delivery addresses. We also collect technical data about how the app is used and where it crashes, so we can fix it.
We do not sell data, show ads, take payments in the app or hold card details. You can delete your account yourself, in the app, at any time.
3. What we collect and why
You can browse the menu without an account. We only need one when you send an order, because the kitchen has to know who it is cooking for and whom to call if something is unclear.
| Data | Why we process it | Source |
|---|---|---|
| Phone number | Sign-in by SMS code and the identity of your account. Staff see it next to your order so they can call you about that order, and for nothing else. | You enter it at sign-in |
| First and last name | Printed on the order so staff can call you when the food is ready. | You enter it once, at first sign-in |
| Contact about your account or an order. It is not used to sign in and we do not send marketing. | You enter it once | |
| Avatar | A drawn character you pick for your profile. It is not a photo, and we never ask for camera or gallery access. | Chosen in your profile |
| Orders | Items, prices, note, dine-in or takeaway, time, order number and status. Without these an order cannot be prepared or tracked. | Created when you order |
| Delivery addresses | Street and number, entrance, floor, flat, intercom, note and a map point, only while delivery is available in the app and only if you choose to save them. | You enter them in your profile or the cart |
| Device location | A single reading, approximate to street level, only when you tap "Use my current location" in the address form. Never in the background and never without that tap. | Your device, with your permission |
| Notification token | A technical device identifier that lets us deliver the notification when the kitchen accepts your order and when it is ready. | Generated by Google and Apple for your device |
| Usage data | Which screens you open, which actions you take (for example an order sent and its amount), device model, OS and app version, and the name of an error when something fails. It tells us what works and what does not. | The app, release builds only |
| Session recordings | A recording of how the app is used, so we can find where people get stuck. All text and every input field is masked before recording: phone number, name, SMS code and note are not visible. Food photos are. | The Android app, release builds only |
| Crash reports | When the app crashes: device model, version and a technical trace, so we can fix it. | The app |
In analytics and session recordings your account carries a random identifier, never your phone number, name or email. While you browse without an account, that data is not tied to anyone.
4. What we do not do
- We take no payment in the app. You pay on handover, so we hold no card number and no payment data.
- We show no ads and share nothing with advertisers.
- We do not sell or rent data.
- We do not request camera, gallery or contacts access.
- We do not track location in the background. The app does not have that permission.
- We send no newsletters or promotional email or SMS.
5. Who processes data on our behalf
The app would not work without a few services. Each processes data only for the purpose listed here.
| Service | What it does | Where the data is |
|---|---|---|
| Supabase | Database and storage: profiles, orders, addresses, notification tokens and menu photos. | European Union (Frankfurt) |
| Google Firebase Authentication | Sends the SMS code and verifies your phone number at sign-in. Sign-in works only with phone numbers from Bosnia and Herzegovina. | Google, under Google's terms |
| Google Firebase Cloud Messaging and Apple Push Notification service | Deliver order notifications to your device. | Google and Apple |
| Google reCAPTCHA and Play Integrity | During sign-in, check that a real device is requesting the code rather than a script. | |
| Firebase Crashlytics | Collects crash reports. | |
| PostHog | Usage analytics, session recordings and error tracking. | European Union |
| Google Play and Apple App Store | App distribution and updates. | Google and Apple |
MN Food staff see your name, the contents of your order and the phone number attached to it, because without them the order cannot be prepared and handed over. When delivery is available, the courier sees the name, address and phone number for that delivery.
6. How long we keep data
- Account (phone number, name, email, avatar, addresses): until you delete it.
- Orders: kept as the restaurant's business record. When you delete your account they remain without your name, phone number, note and delivery address, so they can no longer be linked to you.
- Phone number attached to an order: deleted when you delete your account.
- Notification token: deleted when you sign out or delete your account.
- Usage data, session recordings and crash reports: kept by the processors for at most 12 months, then deleted automatically.
7. Your rights
Under the Law on Protection of Personal Data of Bosnia and Herzegovina, and for users in the European Union under the GDPR, you have the right to:
- Access the data we hold about you and receive a copy.
- Correct inaccurate data. Name and email cannot be changed in the app, so write to us for that.
- Delete your account. Fastest in the app: Profile → Delete account, confirmed with an SMS code. Instructions are on the account deletion page.
- Object to, or ask us to restrict, processing based on our legitimate interest, which is the case for analytics.
- Withdraw the notification or location permission in your phone's settings, at any time.
- Complain to the Personal Data Protection Agency of Bosnia and Herzegovina (azlp.ba).
We answer requests within 30 days. To make sure a request comes from you, we may ask for confirmation from the phone number the account is registered to.
8. Children
The app is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has created an account, tell us and we will delete it.
9. Security
All traffic between the app and our servers is encrypted (HTTPS). Each user can read only their own data, enforced by the database rather than the app. The phone number attached to an order is visible only to staff, and notification tokens are readable only by the service that sends notifications. No system is completely secure, but this limits what a single mistake could expose.
10. This website
The site is static. It has no cookies, analytics or forms. Fonts load from Google Fonts, so Google sees your device's IP address when they load. Links to Google Play and the App Store lead to Google's and Apple's pages, where their policies apply.
11. Changes to this policy
If we change something, we will publish the new version here with a new date at the top. For larger changes, such as a new service processing data, we will also tell you in the app.
12. Contact
UR "MN FOOD"
Mehmedalije Maka Dizdara, Stupine B11, lokal br. 5
75000 Tuzla, Bosnia and Herzegovina
hallo@appkraft.de · +387 64 46 06 606