Privacy Policy

Tokrey is an online grocery and everyday-essentials store. Through the Tokrey mobile application you can browse products, place orders, choose a delivery address, track your orders and manage your account.

This Privacy Policy explains what personal information we collect when you use Tokrey, why we collect it, who we share it with, and the choices and rights you have over it.

Tokrey is operated by Tokrey ("Tokrey", "we", "us", "our"), of M.A. Jinnah Road Okara.

This policy applies to the Tokrey mobile application and to the Tokrey services accessed through it. It does not apply to any third-party website or service that you may reach from a link inside the app.

If you have any question about this policy or about how your information is handled, contact us at support@tokrey.com.

By creating an account or placing an order with Tokrey, you confirm that you have read and understood this Privacy Policy.

We collect information that you give us directly, information generated when you use the service, and a limited amount of technical information created automatically when your device communicates with our servers.

2.1 Account Information

When you register for a Tokrey account we collect:

• Full name
• WhatsApp mobile number — this is your sign-in name
• Password — sent to our servers over an encrypted connection and kept there only as a one-way scrambled value (a hash), which nobody, including us, can read back
• Email address — optional; only if you choose to add it to your profile
• Preferred language for messages

We use your WhatsApp number as your sign-in identifier. To confirm that the number is yours when you register, and when you reset a forgotten password, we send a one-time code to it by WhatsApp. The code is stored only in scrambled form, expires after a short time and works once.

2.2 Delivery Address Information

When you add a delivery address we collect:

• Address label (for example "Home" or "Work")
• House and street
• Landmark (where provided)
• City
• Contact name and phone number for the delivery
• Whether the address is your default delivery address

You may save more than one address. Saved addresses are linked to your account and are visible only when you are signed in.

2.3 Order Information

When you place an order we collect and retain:

• The products and quantities ordered
• Prices, discounts and any coupon applied
• Order totals, including delivery charges where applicable
• The delivery address selected for that order
• The payment method selected
• Order status and its history (for example placed, processing, shipped, delivered, cancelled)
• The order number, date and invoice

Order records, including the delivery address recorded at the time of the order, are retained as part of your purchase history.

2.4 Customer Support Messages

If you contact us through the in-app contact form, we collect the name, subject and message that you write, together with the email address or phone number you give and any order number you choose to include. If you are signed in, the message is also linked to your account. We use this information to answer you.

2.5 Shopping Basket Information

Your basket is kept on your device while you shop. It is sent to our servers only when we need to price it and check stock, and when you place an order.

2.6 Technical and Log Information

The Tokrey app itself does not contain any analytics, advertising, behavioural-tracking or crash-reporting software, and does not collect device identifiers, contacts, photos, or usage-profiling data.

However, as with any internet service, when your device communicates with our servers those servers may automatically record technical information, including:

• IP address
• Date and time of the request
• The service or resource requested
• Basic connection information sent by your device as part of a standard network request

This information is generated by the act of connecting to our servers rather than collected by the app, and is used for operating, securing and troubleshooting the service.

2.7 Information Stored on Your Device

Some information is kept locally on your device and is not, by itself, sent to us:

• Your sign-in session, held in the operating system's secure storage (the Android Keystore-protected storage or the iOS Keychain)
• Your basket, until you place the order or empty it
• Your choice of city and language, and whether you have already seen the introduction screens
• Cached product and banner images, so the app loads faster and uses less data
• Invoice PDF files that you choose to download

You can remove all of this by signing out, clearing the app's storage, or uninstalling the app.

2.8 Information We Do Not Collect

To be explicit, the Tokrey app does not collect:

• Your device's GPS or precise location
• Your contacts, photos, camera, microphone or files, other than an invoice you choose to save
• Credit or debit card numbers (see section 4)
• Advertising identifiers or cross-app tracking data

We use the information described above to:

• Create and manage your account, including signing you in and out
• Confirm your WhatsApp number by sending a one-time code
• Reset your password when you request it
• Show you products, categories and prices, and let you search the catalogue
• Keep your basket on your device between visits
• Process and fulfil your orders, including applying any coupon
• Deliver your orders to the address you selected
• Keep you informed about your order, including status updates in the app and by WhatsApp
• Generate invoices and maintain your order history
• Answer your questions when you contact customer support
• Operate, maintain and improve the app and our services
• Detect, investigate and prevent fraud, abuse and security incidents
• Diagnose technical problems and monitor the reliability of the service
• Comply with applicable law, including tax, accounting and consumer protection obligations

We do not use your personal information to build advertising profiles, and we do not sell your personal information.

Tokrey currently offers Cash on Delivery where it is available for your order and delivery area. With Cash on Delivery you pay the delivery agent at the time of delivery.

Tokrey does not collect, process or store credit card numbers, debit card numbers, CVV codes or bank account details in the application.

We record only which payment method was selected for an order, and the status of that order.

The Tokrey mobile application does not use cookies; it keeps you signed in with a protected sign-in token on your device. Our website uses only the cookies it strictly needs to keep you signed in and to remember your basket.

Neither the app nor the website uses advertising cookies, analytics cookies, tracking pixels, or any cross-site or cross-app tracking technology.

Address information that you provide. When you select your city and enter a delivery address, you are telling us where you would like your order delivered. We store and use that information to check whether we deliver to your area, to calculate delivery charges, and to deliver your order.

Device location. The Tokrey app does not request or access your device's GPS or precise location. It does not include any location or geolocation software, and it does not request location permission from your device.

Your city selection and your saved addresses are the only location-related information we hold, and both are provided by you.

We share personal information only where it is necessary to provide the service, or where we are legally required to. Specifically:

7.1 Service and Infrastructure Providers

We use third-party providers to host our servers, store data, deliver product images, and send WhatsApp messages such as verification codes and order updates. These providers process information on our behalf and under our instructions, including cloud hosting and database services, cloud object storage and content delivery used to store and serve product and banner images, and a messaging provider used to send WhatsApp messages to the number you registered.

7.2 Delivery Partners

To deliver your order we share the information necessary to complete delivery, which typically includes your name, delivery address, phone number and order details.

7.3 Payment Providers

Not applicable while Cash on Delivery is the only payment method offered.

7.4 Legal and Safety

We may disclose information where we reasonably believe it is required to:

• Comply with a law, regulation, legal process or enforceable government request
• Enforce our terms, including investigating potential breaches
• Detect, prevent or address fraud, security or technical issues
• Protect the rights, property or safety of Tokrey, our customers or the public

7.5 Business Transfers

If Tokrey is involved in a merger, acquisition, reorganisation or sale of assets, personal information may be transferred as part of that transaction. We will take reasonable steps to ensure it remains protected, and will notify you where required by law.

7.6 What We Do Not Do

We do not sell your personal information, and we do not share it with third parties for their own advertising or marketing purposes.

We take reasonable technical and organisational measures to protect your information, including:

• Encrypted communication — communication between the app and our servers uses HTTPS/TLS
• Secure credential storage on your device — your sign-in session is stored in the operating system's protected storage (Keychain on iOS and encrypted storage on Android) rather than in ordinary app files
• Password protection — passwords are kept on our servers only as one-way hashes, and repeated wrong attempts lock sign-in for a short time
• Access controls — account information, saved addresses, order history and notifications are accessible only to the signed-in account they belong to; requests for another account's data are refused by our servers
• Session expiry — sign-in sessions expire and must be renewed
• Restricted internal access — access to customer data by our staff is limited to those who need it to operate the service

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will act in accordance with applicable law.

We keep personal information only for as long as it is reasonably necessary for the purposes described in this policy, including:

• Account information — while your account is active
• Delivery addresses — while saved to your account, or until you delete them
• Order records and invoices — for as long as required to provide order history, handle returns and disputes, and meet tax, accounting and other legal obligations
• Customer support messages — for as long as needed to resolve your enquiry and keep a record of it
• Server and security logs — for as long as needed for security monitoring and troubleshooting

When information is no longer needed, we delete it or anonymise it. Please note that records associated with completed orders generally must be retained even after an account is closed, in order to meet legal and accounting requirements.

Subject to the law that applies to you, you may have the right to:

• Access the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete your personal information, where deletion is legally permitted
• Object to or restrict certain processing of your information
• Withdraw consent where our processing is based on your consent
• Request information about how your data is processed and who it is shared with
• Data portability, where that right applies to you
• Complain to your local data protection authority

Much of this can be done directly in the app: you can view and update your profile, and add, edit or remove your saved delivery addresses at any time.

For anything else, contact us at support@tokrey.com. We will respond within the period required by applicable law. We may need to verify your identity before acting on a request, to make sure we do not disclose your information to someone else.

Where we cannot fully action a request — for example because we are legally required to retain records of completed orders — we will tell you why.

Deleting a saved address. You can delete any saved delivery address from the Saved Addresses screen in the app. Deleting an address removes it from your account for future orders. It does not alter the address recorded against orders you have already placed, which forms part of the order record.

Deleting your account. You can delete your account yourself in the app: Account, then Delete account. You can also request it on our website at https://tokrey.com/delete-account or by writing to support@tokrey.com. Deletion is refused while one of your orders is still open or while store credit is owed to you; we will tell you which.

When your account is deleted, we remove or anonymise your profile information, WhatsApp number and saved addresses. As explained in section 9, records relating to completed orders — including invoices and the delivery details recorded at the time — generally must be retained to meet legal, tax and accounting obligations, and to resolve any dispute relating to those orders.

Tokrey is intended for adults who are able to enter into a binding contract and place an order. It is not directed at children.

We do not knowingly collect personal information from children below the minimum age that applies in your jurisdiction without the consent or involvement of a parent or guardian where the law requires it.

If you believe that a child has provided us with personal information, please contact us at support@tokrey.com and we will take appropriate steps to delete it.

Tokrey relies on third-party providers for parts of its infrastructure. These may include cloud hosting, database services, object storage and content delivery for product images, and a messaging provider for WhatsApp verification codes and order updates.

These providers act as processors on our behalf. We share with them only the information they need to perform their function. We may also update or change providers over time as the service evolves.

Tokrey does not currently integrate advertising networks, analytics platforms, social media SDKs, or third-party tracking services in the mobile application.

Your information may be stored or processed on servers located outside the country in which you live, depending on where our infrastructure providers operate.

Where information is transferred across borders, we take reasonable steps to ensure it continues to be protected in a manner consistent with this policy and with applicable law.

We may update this Privacy Policy from time to time to reflect changes to the service, to our practices, or to legal requirements.

When we update it, we will revise the "Last Updated" date at the top of this document and publish the updated version in the app and, where available, on our website.

Where a change materially affects how we use your personal information, we will provide additional notice, and obtain your consent where the law requires it.

We encourage you to review this policy periodically.

If you have any question, concern or request about this Privacy Policy or about your personal information, please contact us:

• Store name: Tokrey
• Legal entity: Tokrey
• Privacy email: support@tokrey.com
• Support email: support@tokrey.com
• Business address: M.A. Jinnah Road Okara
• Website: https://tokrey.com
• Effective date: 22 OCT 2026

You can also reach us through the Contact Us screen in the Tokrey app.