Policy

Privacy policy

Last updated 24 September 2026

We are a muesli company, not a data company. We collect what we need to get a pouch to your door and to answer you if something goes wrong — nothing else.

What we collect

• Order details — your name, delivery address, phone number and email.
• Order history — what you bought and when, so we can handle refunds and questions.
• Messages — anything you send us by email, phone or Instagram.

We do not ask for your date of birth, gender, or anything else that has nothing to do with delivering muesli.

Payments

Payments are handled by our payment gateway. Your card, UPI or netbanking details go straight to them and are never sent to us or stored on our servers. We only ever see whether a payment succeeded and the amount.

Analytics

We use Google Analytics to see how many people visit and which pages they read — things like "forty people looked at the Honey flavour this week", not who you are. To do that it sets its own cookies and shares your IP address and browser details with Google.

We run no advertising cookies and no ad networks, so nothing here follows you around other websites. If you would rather not be counted, a browser with tracking protection, an ad blocker, or Google's own opt-out add-on will each stop it, and the shop works exactly the same either way.

What is stored in your browser

Apart from the Google Analytics cookies above, we keep a few small values in your own browser's local storage. These stay on your device — they are there so the shop remembers you between visits, and we cannot read them:

When you sign in to order, our backend provider (Appwrite, see below) also keeps a sign-in session in your browser — a cookie, or the cookieFallback value in local storage if your browser blocks that cookie. Unlike the values above, it is sent with each request so we know the order is yours.

Clearing your browser data removes all of these. Nothing breaks — you start with an empty cart and sign in again with your phone when you next order.

Who we share it with

Only the people who have to see it: our courier partner, so they can deliver, and our payment gateway, so they can charge you. We do not sell, rent or trade your details to anyone, ever. We may disclose information if a law or court order requires it.

The website, your account and your orders are hosted with Appwrite (Appwrite Cloud, data centre in Frankfurt, Germany), which stores them on our behalf and sends the one-time sign-in code to your phone. Appwrite processes this data only to run the service for us.

How long we keep it

Order records are kept as long as tax and accounting rules require. After that they are deleted. If you ask us to erase your details sooner, we will do so except where we are legally obliged to retain an invoice.

Your rights

Under the Digital Personal Data Protection Act, 2023, you can ask us to show you the personal data we hold about you, correct anything wrong, or delete it. Write to hello@khaohealthy.in and we will respond within 30 days.

Children

This site is not intended for children under 18. We do not knowingly collect their data.

Changes

If we change this policy we will update the date at the top of this page. Material changes will also be mentioned on the home page.