Privacy Policy

Updated 3 November 2026

This policy explains how the NCC Cash & Carry website handles information when you browse, sign in or use its shopping features.

Google sign-in

When you choose Continue with Google, Google provides your account identifier, name, email address, email verification status and profile picture. NCC uses these details to identify your signed-in account and display your account information. The website does not receive your Google password or request access to Gmail, Google Drive or your contacts.

Email and password accounts

If you create an account manually, NCC stores your name, email address and a salted password hash in a Cloudflare D1 database. Your original password is not stored. These credentials let you sign in on another device, while baskets remain stored per browser. Manual signup does not verify ownership of the email address. Email/password accounts are separate from Google identities and are not automatically linked by email. Password reset by email is not currently available. Authentication attempts are limited using temporary, hashed email and network identifiers; these rate-limit records expire.

Staff access

Admin credentials are separate from customer accounts. Staff passwords are stored as salted hashes in Cloudflare D1. Admin sessions use a secure, HTTP-only cookie and expire after eight hours. A private, single-use setup invitation is required to create the initial admin. Sign-in attempts are limited; signing out revokes that staff session.

Session and browser storage

After successful sign-in, the server issues a signed, secure, HTTP-only session cookie lasting up to 30 days. Signing out clears that cookie. Your basket and earlier browser-only order requests are stored in this browser. Catalog products, photos, prices, availability and stock reservations are stored in Cloudflare D1 and shared across devices. Staff browsers also cache catalog data for editing. Clearing this website's browser storage removes that local data. New signed-in order requests are stored in Cloudflare D1 and linked to your account identifier, so their status is available across devices. Staff can review new online requests and assign delivery riders. Earlier browser-only requests are not automatically linked to an account.

Order details

The checkout asks for your full name, mobile number, fulfillment choice and delivery address when delivery is selected. New order requests, customer contact details, item/price snapshots, delivery coordinates, order status and rider assignments are stored in Cloudflare D1 for NCC fulfillment. Orders are requests pending staff confirmation and any delivery charge. The server uses current catalog prices and reserves ordered units atomically from available stock. Cancellation releases each reservation once. Earlier orders created before shared inventory do not retroactively change stock. The server checks the selected delivery point against a 5 km straight-line radius from NCC. Customers can retrieve only orders linked to their signed-in account. Authorized admin staff can manage requests; an assigned rider can view the contact and delivery details of their active deliveries.

Location

When you tap Use my current location, your browser asks for location permission. You can decline and select a delivery pin on the map instead. Coordinates are used in your browser to calculate the distance from NCC; there is no background tracking. If you submit a delivery order request, the selected delivery coordinates and distance are saved with that online order in Cloudflare D1. Map tiles are provided by OpenStreetMap, which receives technical requests including your IP address and the map area being viewed. Pickup directions open Google Maps.

Rider accounts and location sharing

Staff can create rider login accounts using a name, phone number and login email, and set a rider password directly, or issue a private, single-use invitation. Admin password resets revoke rider sessions and clear the shared position. Rider passwords are stored as salted hashes; rider sessions use secure, HTTP-only cookies lasting eight hours. Rider accounts have no admin access and can see only their assigned active deliveries. When staff assign a rider, the customer sees the rider name and phone number. Starting a delivery starts GPS tracking and requests browser permission if needed. With the rider’s permission, their latest location is shared with staff and customers with active assigned deliveries approximately every five seconds. Sharing can be stopped or resumed by the rider. It pauses when the page is hidden and resumes on return when tracking is enabled; mobile browser and network restrictions can delay updates. Only the latest position and its accuracy/timestamp are stored, without route history. Positions older than two minutes are hidden. Positions are cleared when sharing stops, the rider signs out, or no delivery remains in progress. Order status events are stored for fulfillment history.

Service providers

Cloudflare hosts this website and processes web requests. Google handles Google sign-in, and OpenStreetMap provides map tiles. They may process technical request information according to their own privacy policies. Google account data obtained through sign-in is used for the account features described here; this website does not use it for advertising or sell it.

Your choices

You can sign out, clear this site's browser storage, and revoke NCC's access through your Google Account's third-party connections settings. Google passwords and verification codes should only be entered on Google's sign-in pages.

Contact

For questions about this website's sign-in and privacy, contact ramzan.ahmad381@gmail.com, the support contact registered for the NCC Google sign-in application.