Privacy

Last updated 20 October 2026

This page explains what we collect, why, who else handles it, how long we keep it, and what happens when you delete your account. In short: we collect what we need to sell you food, deliver it and keep your account safe.

What we collect

• Your account: name, email address, mobile number and password (stored scrambled — we cannot read it). If you turn on two-step sign-in, the secret your authenticator app uses, stored encrypted.
• Passkeys: the passkey's public key, its provider name, and when it was added and last used. Your fingerprint and face never leave your device.
• Your addresses: the delivery addresses you save, with the recipient's name and phone number.
• Your orders: what you bought, when, what you paid, where it went and any note for the courier.
• Your payments: from Paystack we keep only the payment's reference, its status, the amount and fees, the currency, how you paid (for example card or bank transfer), when you paid, and your card's brand and last 4 digits.
• Signing in: your IP address, your browser and device, and your approximate location (a city and country worked out from your IP address) when you sign in, so we can warn you about a sign-in that isn't you.
• Reviews: the reviews you write. They appear on the product page with your first name and the first letter of your last name (for example "Ada O.").
• Problem reports: when you report a problem with a delivered order — the items, what was wrong, your note and the photos you send.
• Saved items and stock alerts: the products you save, and the products you ask us to tell you about when they are back in stock.

What we do not collect

We never see or store your full card number, PIN, CVV or bank login. Those go directly to Paystack, our payment provider. Paystack tells us only your card's brand and last 4 digits, so we can show which card a refund goes back to.

Why we hold it

• To take your order and deliver it to the right place.
• To send you your receipt and order updates.
• To let you see your own order history in My Account.
• To refund you and to put right a problem with an order.
• To keep your account safe — for example, to tell you about a sign-in from a new device or place.
• To keep proper business records.

Who we share it with

Only the companies we need to run the shop, each for its own part of the job:

• Paystack — to process your payment. Paystack keeps its own records of your payments under its own privacy policy; deleting your FTK Foods account does not delete them.
• Our delivery partners — your name, address and phone number, so they can deliver to you.
• Resend — sends our emails: receipts, order updates and account notices.
• Twilio — sends the text message that confirms your mobile number.
• Cloudflare R2 — stores photos: our product photos and the photos you send with a problem report.
• Render — runs our server.
• Vercel — runs our website and passes your requests to our server.
• MongoDB Atlas — holds our database.

We do not sell your information to anyone, and we do not pass it to advertisers.

How long we keep it

• Your account: until you delete it.
• Orders and payments: kept for our business records. If you delete your account, your name and contact details are removed from them.
• Problem-report photos: deleted 90 days after the report is closed, and never kept more than 180 days after you send them.
• Sign-in history: deleted after 365 days.
• The devices you sign in on: removed 400 days after a device was last used.
• Emails we send you: once an email is sent, our copy of your address and of what it said is deleted, and the note that it was sent goes after 30 days. If an email can't be delivered, that note stays until our team has dealt with it, then 90 days more.
• Codes we send you: deleted when they expire. The mobile number a code was sent to is kept for up to 24 hours, to limit how many codes can be sent.

Staying signed in

We store a small amount of information in your browser to keep you signed in while you shop. If you are inactive for 15 minutes we sign you out automatically, to protect your account on shared devices.

Deleting your account

You can delete your account yourself at any time in My Account. When you do:

• Your name, email address, mobile number, addresses, password, two-step sign-in, passkeys, devices, notifications, saved items, stock alerts and reviews are deleted, and you are signed out everywhere.
• Your orders and payments are kept for our records, with your name, email address, phone numbers, address and courier notes removed.
• Any problem report you sent is kept, so an open one can still be refunded or replaced, but your name, email address and note are removed and its photos are deleted.
• Your sign-in history keeps only what happened and when — never your IP address, browser, device, location or email address — and is deleted after 365 days.
• We send one last email to your address to confirm it.
• Paystack keeps its own records of your payments.

One exception: if a payment reaches us that matches no order, we keep the email address Paystack gives us with it, so we can refund it. It is not linked to any account, so deleting your account does not remove it.

Your choices

• You can see and update your details at any time in My Account.
• You can download your details, addresses, orders and their payments, problem reports, reviews (with any reply from us), the reviews you marked helpful or reported, your cart and "Save for later" list, saved items, stock alerts, notifications, passkeys, two-step sign-in status, and sign-in and device history in My Account (Download my data).
• You can delete your account yourself at any time in My Account.

Getting in touch

For anything about your information, contact us using the details on the Contact Us page.