Privacy Policy — inn
Introduction
inn helps customers discover local restaurants, gyms, brands and supplement products, save places, place orders with participating shops, and follow community posts. This policy explains what information the inn Customer app uses, where it is sent, who receives it, and what controls are currently available. It applies to the Android package above and the corresponding Customer app on other platforms.
Information we collect
When you use the app, information may be sent to Firebase, Google Maps Platform, Google Places, or the shop you choose. The app does not include an advertising SDK, Firebase Analytics, Firebase Crashlytics, or Firebase Performance Monitoring in the reviewed Customer dependency set.
Account information and authentication
Firebase Authentication and inn account records process your Firebase account ID, display name, email address when supplied by your sign-in method, authentication provider information, and profile details. Profile details can include a contact phone number, verified phone number, gender selection, an optional date of birth, interests, and a profile photo URL supplied by a sign-in provider. Your Firebase account ID is also used to protect and associate your account data.
You can create or access an account using the enabled email/password or Google sign-in flows. Firebase handles authentication credentials; the app does not store your password in its customer profile document. Phone verification is used when a verified phone number is needed for ordering. The production provider setup reviewed on 24 September 2026 did not list Apple Sign-In as enabled. An Apple sign-in code path exists in the app, but Apple should be treated as unavailable unless the operator enables and verifies it for a release.
Date of birth (optional)
In Account → Edit profile you may choose to add a date of birth, and you may remove it at any time. It is optional: you do not need it to sign up or use inn. It is stored as a calendar date (year, month, day) in your private Customer profile, only for managing your account. inn does not use it to verify your age, and does not show it to shops, community users, or other customers. It is not used for marketing, advertising, or personalization, and it is not included in orders or community posts. Only your own signed-in account can read it through the app.
Addresses and location
You may enter and save a delivery address. Address details can include an area, street, building, floor, apartment, landmark, delivery note, label, and an optional map pin with latitude and longitude. You may delete saved addresses individually. You can also enter a delivery area manually; a saved address or precise pin is not needed for pickup.
If you grant foreground location permission and choose a location feature, the app can read your current location to sort nearby places or position a map. The current-location value used for nearby sorting is held in app memory by that feature. When map features are used, location and map requests are sent to Google Maps Platform. Google Maps Platform states that it receives information including search terms, IP addresses, and latitude/longitude coordinates, and may use and retain it to provide and improve Google products and services. See Google Maps Platform Terms and Google's Privacy Policy.
When you save a delivery address or place a delivery order, the selected address and any selected pin are stored with the address or order. A delivery order sends the necessary destination information to the shop selected for fulfillment. Location permission is foreground-only; the Customer app does not request background location.
Orders and delivery information
If you place an order, inn and the selected shop process the shop, order items, quantities, prices and totals, order status, and the name and verified phone number needed to fulfill it. Delivery orders may also include the chosen delivery destination and notes. Pickup orders do not need a delivery address. Order records include a cash-on-delivery payment-method value; the Customer app does not collect card numbers, bank account details, or online payment credentials. Payment is arranged directly with the selected shop.
Orders are stored in Firebase/Cloud Firestore. The selected shop can read the order information needed to prepare and fulfill that order. You can view your order history in the app, but there is no customer-facing control to delete a single order. If you delete your account, completed, rejected and cancelled orders remain with the shop in the limited form described under “Account and data deletion”.
Community and user-generated content
Customers can browse and follow communities. The app only permits accounts approved as community contributors to submit posts. A submitted post can contain text and up to six photos. The post stores the author's account ID and display-name snapshot. It does not include the author's email or phone number in the post content.
Posts are stored in Cloud Firestore and submitted images in Cloud Storage. Published posts can be seen by community users. Published image objects use publicly readable URLs, so anyone who has a published image URL may be able to access that image outside the app. Do not upload private or sensitive images. Community content remains available until it is removed through moderation or its author deletes their account.
Before posting, contributors must accept the community contributor terms; the acceptance and its date are stored with the account. Any Customer can report a post or its author. A report stores the reporter's account ID (never shown to the author or to other users), the reason and optional details, and is reviewed by the inn team. Any Customer can block an author; the block list is private to that Customer. The Customer app has no direct-message, chat, comment or reply feature.
Notifications and device identifiers
If you enable notifications, Firebase Cloud Messaging provides a device token. The app stores that token with an installation identifier, platform, and language under your account so Firebase can route order, community, and service announcements to the correct device. The app attempts to remove the device registration when you disable notifications or sign out. That cleanup is best-effort.
The Android Google Maps SDK also generates a Maps SDK-specific pseudonymous identifier and automatically sends request/device metadata, IP address, crash metrics, and (when map camera APIs are used) map interaction events such as panning and zooming. Google says it uses these data to maintain and improve its services. These SDK data are separate from Firebase Analytics or Crashlytics, neither of which is included in the reviewed Customer dependencies.
Search and places
Marketplace search text is sent to an authenticated Cloud Function to retrieve matching places and products. The Customer app does not save a search history. The function logs result count, query length, and request duration; it does not log the raw marketplace query in its normal success log.
When you search for an address or place, the typed query and a Places session token are sent to a Customer Cloud Function, which sends the query to Google Places. The app does not save the typed address-search history. Google Maps Platform's terms say it may receive and retain search terms, IP addresses, and coordinates to provide and improve its services; Google's retention period for a particular request is not set by inn.
Photos, files and other data
The reviewed Customer app lets approved community contributors upload photos. It does not provide a general document, video, or audio upload feature. Product and merchant images are viewed by the app and are not uploaded by the customer.
The app does not intentionally collect a user's contacts, calendar, installed-app list, health records, fitness activity, or browsing history. It does not provide health tracking, medical advice, diagnosis, or treatment.
How information is used
- Create, authenticate, secure, and manage your account.
- Show your profile and saved preferences, including a date of birth if you add one.
- Find nearby places and display maps when you choose those features.
- Search the marketplace and resolve address/place suggestions.
- Create, display, and fulfill orders.
- Store and show saved addresses and favorites.
- Publish and moderate community posts.
- Deliver notifications you enable.
- Maintain, secure, and troubleshoot the app and its backend services.
Service providers and processors
The Customer app uses Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, and Firebase Cloud Messaging. Google operates those services for authentication, hosting, app functionality, and message delivery. Google Sign-In is used as an authentication provider. Google Maps Platform and Google Places provide maps, map data, and place search; their terms also describe Google's own use and retention of Maps Platform request data to provide and improve Google services. The app uses Google Fonts for typography, which may make font requests to Google's font service.
These providers may process information under their own terms and privacy notices. A shop is a recipient of information for an order you submit to it, not a Firebase processor. Community content is shown to other users as described above.
Data sharing
- The shop you select: order items and totals, your name and verified phone number, and, for delivery, the destination and delivery notes, so the shop can fulfill your order.
- Community users: the text, photos, and display-name snapshot you submit to a community.
- Google and Firebase services: authentication, storage, backend processing, messaging, maps, places, and related service operation. Google Maps Platform may use and retain Maps/Places request data to provide and improve Google services.
- Authorities or other parties where legally required: to comply with applicable law or protect rights and safety.
The Customer app has no advertising SDK and does not use customer information to target third-party ads. This does not mean that information is never shared; the recipients and transfers above are part of the service.
Data security
The app and its Firebase and Google service connections use HTTPS/TLS for data in transit. Firestore and Storage security rules restrict access to account records and service operations. Published community image URLs are publicly readable as described above. No system can be guaranteed completely secure, and the app does not provide end-to-end encryption.
Data retention
Account, address, favorites, notification, order, and community records are stored in Firebase services until you delete them, delete your account, or they are removed through moderation. Place-search counters used to prevent abuse expire after two days where the operator has enabled automatic expiry. Device-registration removal on sign-out or notification disable is best-effort.
The operator has not documented a complete retention schedule for account, order, community, or service logs. Google Maps Platform separately states that it may use and retain Maps Platform request data under its terms and privacy policy. Specific provider retention periods vary by service and are not represented here as a single duration.
Account and data deletion
You can delete your account in the app (Account → Delete account) or on the web at https://g7-eco-prod-108310.web.app/account-deletion/ by signing in with the same method you use in the app. For your security you may be asked to sign in again first. If an order is still in progress, you can delete your account after it is completed or cancelled.
Deletion is permanent and happens when you confirm. We delete your sign-in account, profile (including your date of birth, if you added one — the whole profile record is deleted), saved addresses, favorites, notifications and device registrations, community memberships and contributor access, blocked-author list, and the community posts and photos you published. We keep completed, rejected and cancelled orders as the shop's sales record — the items, prices, status and dates — after removing your name, phone number, account ID, order and item notes, delivery address, and any cancellation or rejection text. We keep a record that an account was deleted and when, identified only by a one-way hash of the account ID. Reports you filed are kept for moderation without your identity or the details you typed. Operational logs may contain your account ID for up to 30 days.
No fixed retention period has been set for the retained order records and the deletion record described above. We remove the identifying fields and personal text listed above, but the remaining items, prices, dates and status are not anonymous: the shop that received an order may still be able to recognise it. If you can no longer sign in, contact the privacy contact below to request deletion.
You can also remove only your date of birth without deleting your account: in Account → Edit profile choose “Remove birthday”. This removes the field from your profile.
Children and age policy
inn is not designed or marketed for children under 13. The app does not require a date of birth and does not use the optional date of birth to verify age or screen users by age. If you believe a child under 13 has provided personal information, contact the operator using the completed privacy contact below so the request can be reviewed.
International processing
Customer Cloud Functions are deployed in the me-west1 region. The repository does not establish the production Firestore or Cloud Storage data locations. Google and Firebase services may process information in other countries; the exact location depends on the service configuration and provider. Google Maps Platform request data is handled under Google's Maps Platform terms.
Your choices and rights
You can edit supported profile fields, add or remove your optional date of birth, remove saved addresses and favorites, opt out of notifications, and deny or revoke location permission in your device settings. You may exercise any access, correction, deletion, objection, or other rights available under laws that apply to you by contacting the operator.
Changes to this policy
The operator may update this policy when the app or its data practices change. The “Last reviewed” date above will be updated when the policy changes. Material changes should also be communicated through the app or another appropriate channel.
Contact and privacy inquiries
Developer/operator legal name: Anas Alnaser
Privacy contact: anasalnaser24@gmail.com
App: inn
Android package: com.g7ecosystem.customer