Security Policy

All traffic between a browser and QDroid is served over HTTPS/TLS via Cloudflare. Data at rest in our database and file storage is encrypted by our infrastructure provider, Supabase, using its managed PostgreSQL and storage encryption.

Business Accounts authenticate with an email address and password via Supabase Auth. Passwords are hashed by Supabase and are never stored or visible to us in plain text. Customers do not need an account or password to place an order.

QDroid runs on Cloudflare (frontend hosting and CDN) and Supabase (PostgreSQL database, authentication, and file storage), and uses Amazon Web Services to deliver order notifications (transactional SMS and push). We do not operate our own physical servers. Access to a Business Account's data is enforced by database-level row-level security policies, scoping every query to the data owned by that account.

The personal data we hold — a Customer's name, phone number, and (for delivery) address, and a Merchant's account details and GST identification number (GSTIN) — is stored securely in Supabase: encrypted at rest, and access-scoped by row-level security so a Business Account can reach only its own data. A Merchant's GSTIN is kept for tax purposes and is not shown on the Customer's receipt. We collect only the data described in our Privacy Policy and do not sell it. Internal access to production data is limited to what is needed to operate and support the Platform.

On the public order page, a Customer's name and delivery address are not shown until the phone number the order was placed with is supplied, so a shared order link does not expose those details on its own. The public order-tracking page returns only a minimal summary and never the name or address.

Push subscriptions and transactional SMS are delivered through Amazon Web Services over secure channels. Customer and Merchant phone numbers are used only to send order-related messages and are never exposed on public pages.

If you believe you've found a security vulnerability in QDroid, please report it to info@vanixqbit.com rather than disclosing it publicly. We will investigate and respond.