Hill Water Privacy Policy

Effective date: 2026-10-17

Controller/operator: Hill Water

Privacy contact: hillwaterug@gmail.com

Accounts and profile information

Hill Water uses Supabase Auth and Google sign-in. Apple sign-in applies only when enabled by the operator; it is not currently active. We handle account identifiers, email, display name, phone and supplied avatar for account access, contact and fulfilment. Application roles come from the protected database profile, not Google metadata or a URL.

Addresses and location

We store customer delivery addresses and voluntarily selected precise delivery pins. Customers are NOT continuously live tracked. Current device location is requested only through an explicit location/map action, and a pin can be provided manually.

Driver operational precise location, accuracy, heading/speed and timestamps are used only for authorized delivery/dispatch work while online and with platform permission. Offline/sign-out stops the client reporting session. Device/network failures can interrupt location reporting; the service does not invent a live position. Customer-facing continuous Driver tracking is not offered.

Orders, operations and notifications

We handle server-created order references, items/prices, totals, status/history, payment records, delivery snapshots, assignments, route/issue/service records, inventory events and security/audit records. In-app notifications and preferences support operational updates. They are not an advertising analytics feed or a claim of system push delivery.

Images and processors

Authorized Admins may upload product images into private Supabase Storage for the catalogue. These are business artwork, not a public personal-photo service. Supabase processes authentication, database, Storage and authorized Realtime events. Google processes Google sign-in; Apple processes sign-in only if later enabled. Hill Water maps use OpenStreetMap data and map tile services when map views are opened. Location information is used only for the delivery and operational purposes described in the Privacy Policy.

This privacy, terms, and account-deletion resource is hosted using Cloudflare Pages. Hill Water uses Supabase for application authentication, database, storage, and related backend infrastructure.

Opening external navigation, phone, WhatsApp, sharing or legal links uses the selected device/browser application and that provider. Those services have their own policies. HTTPS and restricted access reduce risk, but no system can promise absolute security.

Device sessions and security

The app SDK can persist Supabase session tokens on the device/browser. Protect shared devices and sign out when finished. The external deletion portal keeps its Supabase session and PKCE verifier in tab-scoped session storage and strips Google provider tokens before persistence. It has no analytics scripts. Temporary product-image signed URLs remain bearer links until expiry. Database RLS and protected server functions remain the data-security boundary; no service-role credential is delivered to the app or public portal.

Permanent account deletion

Use Delete Account in your profile/settings or the external Account Deletion page. Both require a verified signed-in account and explicit confirmation. This is permanent deletion, not deactivation. No one can delete an account merely by supplying an email address. Pending requests can be cancelled before personal-data cleanup begins. Account deletion requests are processed after identity verification and operational checks. Active orders, delivery assignments, or required staff reviews may need to be resolved before deletion can complete.

We remove the original profile identity, personal saved addresses/pins, favourites, recurring preferences, personal notifications, operational location and login identity. Retained order/operational records are re-linked to an unrelated non-login identifier; contact names, phone, address, notes, precise location and payment reference/fingerprint details are removed or replaced with non-personal removal markers. Monetary/item/status/history evidence is not blindly cascade-deleted. Minimal deletion audit records contain request identifiers, times and safe result categories, not deleted personal identity.

Staff requests undergo secure operational review. Active orders/assignments must first be resolved; company media with identifying uploader keys requires secure ownership rehoming before deletion can finish. The final active Super Admin is protected until another authorized Admin is available. If database cleanup succeeds but login removal requires retry, the account is unavailable and the request is not falsely reported complete. Apple-linked identities require a server-side revocation adapter before processing; Apple sign-in is not currently enabled.

Deleting the Hill Water identity does not delete your Google or Apple account. Hill Water does not retain Google provider tokens for revocation. You can manage the provider's app authorization through its own account controls.

Retention and privacy rights

Personal profile information is removed or de-identified when deletion is completed. Certain de-identified order, accounting, fraud-prevention, security, and audit records may be retained where reasonably necessary for legitimate business or legal obligations.

Some necessary commercial, accounting, fraud-prevention and audit records remain de-identified. Residual combinations of operational facts can still carry re-identification risk; de-identification is not a guarantee of irreversible anonymity. Backup copies and infrastructure/provider logs require the operator's retention and restoration controls; request completion is not a promise of instant backup erasure.

Subject to applicable law, users may request access to, correction of, or deletion of their personal information and may contact Hill Water regarding privacy questions or requests.

Contact hillwaterug@gmail.com about privacy, corrections or deletion status. Do not send passwords, OAuth codes, payment authorization or secrets. Important policy changes will be reflected in the effective date and communicated under the reviewed service terms.

Payments

Live Relworx/mobile-money settlement is not active. Current MTN/Airtel payment simulation is not a real charge, wallet verification or settlement. Payment readiness is a separate public-distribution blocker.