App Privacy Policy

Published by: POTHAK.LK (PVT) LTD

Registered address: Ganemulla Road, Kadawatha, Sri Lanka

Privacy contact: [email protected]

Phone: +94 726366000

Website: https://pothak.lk

Last updated: 03 October 2026

1. Introduction

This Privacy Policy explains how POTHAK.LK (PVT) LTD collects, uses, stores, shares and protects your personal information when you use the pothak.lk mobile application (the “App”). It also describes the choices and rights you have.

The App is a shopping application for the pothak.lk online bookstore. It lets you browse books, search the catalogue, save books to a wishlist, add books to a cart, create an account, place and track orders, pay for orders, write product reviews, and manage your profile and delivery addresses.

Please read this policy together with our Terms & Conditions. By downloading, accessing or using the App, you acknowledge that you have read and understood this Privacy Policy.

2. Scope

This policy applies to personal information processed through the App and the App’s supporting backend service (the “pothak.lk API”).

It does not cover:

The pothak.lk website or any WooCommerce/WordPress storefront, which may have its own privacy notice.
Payment pages operated by our payment provider (see Section 7), which process your card details under their own privacy policy.
Third-party services you reach by following links from the App.

3. A note on what the App does not do

To be clear about the App’s actual behaviour:

The App does not collect your location and requests no location permission (no precise or approximate location, no background location).
The App does not access your camera, photos, microphone, contacts, calendar, files, SMS or call logs, and does not upload images or documents from your device.
The App does not contain any attendance, clock-in/clock-out, staff, induction, training or certificate features.
The App does not use advertising identifiers, third-party advertising SDKs, or third-party analytics/tracking SDKs.
The App does not use biometric authentication. (A default “Face ID” text string may appear in the iOS build metadata because it ships with a standard secure-storage library, but no biometric data is requested, accessed or stored.)
The App does not sell your personal information.

4. Information we collect

4.1 Information you provide to us

Data	When	Why
First name, last name	Registration; editing your profile	Create and identify your account; address you in the App; print on orders and reviews
Email address	Registration; login; password reset	Account identifier and login; account and order communications; password recovery
Password	Registration; login; password change	Authentication. Transmitted over an encrypted connection directly to our WordPress store’s authentication service on each login or password change. We do not store your password, or any hash of it, in our database at all — WordPress is the sole system of record for your password.
Phone number (optional)	Registration; profile; delivery address	Order and delivery coordination
Delivery / billing addresses — recipient name, address lines, city, state/province, postcode, country, phone, “default” flag	Adding an address; checkout	Fulfilling and delivering your orders
Order information — books ordered, quantities, prices, subtotals, shipping fee, discounts/coupon codes, payment method chosen, order status, and any customer note you add	Placing and managing an order	Processing, fulfilling, delivering, invoicing and supporting your orders; showing your order history and tracking
Product reviews — star rating and optional written comment	Submitting a review for a book from a delivered order	Publishing reviews on the relevant book. Reviews are public and are shown next to your first and last name.
Device push token (if you allow notifications)	Once you sign in, if you grant notification permission	Delivering order-status push notifications to your device via Firebase Cloud Messaging
Support / correspondence	If you contact us	Responding to your query and keeping a record of it

4.2 Information collected automatically

The App itself contains no analytics or tracking SDKs. When the App communicates with the pothak.lk API, our servers and infrastructure providers process standard technical data needed to deliver and secure the service:

IP address, request date/time, requested URL, HTTP response, user-agent string — kept in server logs for security, abuse prevention, rate-limiting and debugging.
Search terms you type in the App — sent to the pothak.lk API to look up matching books. Because the search term forms part of the requested URL, it is also recorded in the server logs described above, and search results may be cached briefly. Searching is not tied to your account, and we do not build a search profile about you or use search terms for advertising.
Error/diagnostic data — if a server-side error occurs, technical details of the request may be recorded by our error-monitoring provider (see Section 7) to help us fix faults.
Authentication tokens — after you sign in, the backend issues short-lived access and refresh tokens. These are stored on your device in the platform secure store (Android Keystore / iOS Keychain) and sent back to our API to keep you signed in.

We do not collect device advertising IDs, and we do not build advertising or cross-app tracking profiles.

4.3 Information stored only on your device

Guest cart and guest wishlist. If you use the App without signing in, the books you add to your cart or wishlist are stored locally on your device only. When you sign in, these items are sent to the pothak.lk API so your cart and wishlist follow your account; the local copy is then cleared.
Cached profile. A copy of your basic account details is cached on the device so the App can display your profile while offline.

4.4 Information from third parties

Book catalogue data is sourced from our WooCommerce/WordPress store and shown in the App. This is product information, not your personal data.
Payment status for card payments is returned to us by our payment provider after you complete (or cancel) a payment — for example “paid”, “unpaid” or “failed”, together with the related order reference. We do not receive your full card number from the provider.

4.5 Payment information

If you choose card payment at checkout, the App opens our payment provider’s secure hosted checkout page (in an in-app browser window). You enter your card details directly on the payment provider’s page. We and the App do not see, collect or store your card number, expiry date or security code. If you choose Cash on Delivery, no payment card information is collected at all.

5. How we use your information

Create and manage your account and keep you signed in.
Show your cart, wishlist, profile and saved addresses, and sync them to your account across devices.
Process, fulfil, deliver, invoice and support your orders, including sharing delivery details with our fulfilment store and couriers, and enabling order tracking and cancellations.
Take payment for your orders through our payment provider, and record whether an order is paid.
Publish product reviews you choose to submit, shown with your name.
Communicate with you about your account and orders (for example, password-reset emails and order-status updates) and respond to support requests.
Secure the service — authenticate requests, prevent fraud and abuse, apply rate limits, and keep audit and error logs.
Comply with law — meet tax, accounting, consumer-protection and other legal obligations, and respond to lawful requests.
Maintain and improve the App — diagnose faults and fix bugs using technical/error logs.

Legal bases (where the EU/UK GDPR or similar laws apply). We rely on: performance of a contract (operating your account, processing orders and payments); legitimate interests (securing the service, preventing abuse, fixing faults, publishing reviews attributed to their authors); consent (any optional messaging you opt into; you can withdraw it at any time); and legal obligation (tax, accounting and regulatory record-keeping).

We do not carry out advertising profiling or automated decision-making that produces legal or similarly significant effects about you.

6. Device permissions

The App is designed to work with the minimum possible access to your device.

Android permissions requested:

INTERNET and ACCESS_NETWORK_STATE — required to communicate with the pothak.lk API and to detect whether you are online.
POST_NOTIFICATIONS (Android 13+) / notification permission (iOS) — requested once you sign in, so we can show order-status push notifications. You can decline or later revoke this in your device settings without affecting any other App feature.

The App does not request the location, camera, microphone, contacts, storage/photos, SMS, phone, calendar, Bluetooth, nearby-devices, biometric or background-activity permissions.

7. How we share your information

We share personal information only as described below. We do not sell your personal information, and we do not share it for third-party advertising or cross-context behavioural advertising.

7.1 Service providers (processors / sub-processors)

These providers process data on our behalf, under contract, only to provide services to us:

Provider	Role	Data involved
Supabase (managed PostgreSQL database & hosting)	Primary data store for the pothak.lk API	Account details, addresses, orders, reviews, carts, wishlists
Redis / Upstash (in-memory cache & rate-limiting)	Performance and abuse-prevention layer for the API	Cached catalogue/search data; session-related keys; request counters
OnePay (Sri Lanka payment gateway, onepay.lk)	Processing card payments on its own hosted checkout page	Your card details are provided by you directly to OnePay under OnePay’s privacy policy; we receive only payment status and the order reference
WooCommerce / WordPress store (the pothak.lk fulfilment storefront)	Order fulfilment, delivery and customer records; source of the book catalogue; source of some imported product reviews	Customer name, contact details, delivery address, and order contents are synced for fulfilment
ImageKit (image delivery/optimisation CDN)	Serving and resizing book cover images	Serves product images; your device’s IP address is visible to the CDN when images load
Error-monitoring provider (e.g. Sentry)	Server-side error and performance monitoring	Technical details of failed API requests, which may include IP address and request metadata
Cloud hosting / delivery infrastructure for the pothak.lk API	Running the backend service	All data in transit to and from the API
Firebase Cloud Messaging (FCM) (Google)	Delivering order-status push notifications to your device	Your device’s push token; the notification title/body sent to it
Google Play	App distribution, updates and crash reporting on Android	Standard Google Play install/technical data under Google’s policies

Push notifications: once you sign in, if you grant notification permission, the App registers your device’s push token with our backend, which sends order-status push notifications to it via Firebase Cloud Messaging (FCM). You can decline or revoke notification permission at any time in your device settings; this only stops push notifications and does not affect any other App feature or the in-app notification list.

7.2 Others

Couriers / delivery partners engaged (by us or by the fulfilment store) to deliver your order receive the delivery name, address and phone number.
Professional advisers, auditors and authorities where necessary to comply with law, exercise or defend legal claims, or enforce our Terms.
A successor entity if we are involved in a merger, acquisition, financing or sale of assets — subject to this policy or a policy at least as protective.

8. Where your data is stored and international transfers

Our infrastructure providers may store and process data on servers located outside your country of residence. Where personal data is transferred internationally and data-protection law requires it, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses or an equivalent mechanism) with the relevant providers. You may contact us at [email protected] for more information about these safeguards.

9. Data security

All traffic between the App and the pothak.lk API is encrypted in transit using HTTPS/TLS. The App does not permit unencrypted (cleartext) connections in production.
We do not store your password, or any hash of it, in our database. Every login and password change is authenticated directly against WordPress (pothak.lk), our sole system of record for passwords, over an encrypted connection.
Authentication tokens on your device are held in the platform secure store (Android Keystore / iOS Keychain).
Access tokens are short-lived. Changing your password, resetting it, or deleting your account revokes every session on every device immediately — both access and refresh tokens stop working at once rather than expiring on their own.
Access to production data is restricted to authorised personnel and providers on a need-to-know basis, and the API applies rate limiting and other abuse protections.

No method of transmission or storage is completely secure. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authority where required by law.

10. Data retention

Account data (name, email, phone, addresses, cart, wishlist, notifications, reviews you wrote in the App): kept while your account exists. Deleted outright once we process an account deletion request — not deactivated, not anonymised, and not held for any further period: the records themselves are removed (see Section 12).
Order and transaction records: the App does not keep order records of its own — the copy it holds is deleted together with your account. The order itself is recorded by the pothak.lk store, which is the seller of record and keeps it as part of its accounting records. We do not delete those on a fixed schedule and we do not put an end date on them here, because the period is set by law rather than by us: they are kept for as long as the tax, accounting, audit and consumer-protection rules that apply to us require (a period measured in years, not days), and for as long as any related dispute, refund, warranty or payment claim could still be brought or is still open.
Product reviews: reviews you wrote in the App are deleted with your account. Reviews published on the pothak.lk website are held by the store.
Server, security and error logs: kept only as long as we need them for security, abuse prevention and fault diagnosis, and then deleted or overwritten on our hosting and error-monitoring providers’ own retention schedules. They are technical records of individual requests, not part of your account record, and they are not used to rebuild a profile of you.
On-device data (tokens, guest cart/wishlist, cached profile): removed when you sign out or delete your account, and when you delete the app data or uninstall the App.

11. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

Access — request a copy of the personal information we hold about you.
Correction — correct inaccurate or incomplete information (you can edit your name, phone and addresses directly in the App).
Deletion — request deletion of your personal information (see Section 12).
Restriction / objection — ask us to restrict or stop certain processing based on legitimate interests.
Portability — receive certain information in a structured, commonly used, machine-readable format.
Withdraw consent — where processing is based on consent, withdraw it at any time (this does not affect prior processing).
Complain — lodge a complaint with your local data-protection authority. In Sri Lanka this is the Data Protection Authority established under the Personal Data Protection Act No. 9 of 2022; in the EU/UK, your national supervisory authority.

To exercise any of these rights, contact us at [email protected]. We will respond within the period required by applicable law (generally within 30 days) and may need to verify your identity. These rights are subject to legal exceptions — for example, we may need to keep certain order records for accounting and legal reasons.

12. Account and data deletion

Account deletion is handled by people, not automatically by the App or the web, and it is not instant. It has two parts, which our app team and the pothak.lk store team coordinate: the app team removes the data held by the App, and the store team handles your store account (including your website login) and the store’s order records.

We do it this way on purpose. Deletion cannot be undone, so it is carried out by a person who has the request in front of them rather than by a button that acts on its own.

How to start it

In the App: open Profile → Settings → Delete Account and confirm. This emails our support team from your account’s registered address; your account stays active until the request is processed.
By email: send a request from your registered email address to [email protected] with the subject “Delete my account”.
On the web, without the App: go to https://pothak.lk/delete-account and submit the form. This reaches our team the same way and covers both the App’s data and your store account.

We aim to process a request within the period required by applicable law (generally 30 days), though most requests are handled sooner. Once processed, deletion cannot be undone.

What is deleted

Once your request is processed, the following records are removed, not deactivated, hidden or held for a further period.

From the App’s database:

Your profile — name, email address, phone number, avatar.
Your saved delivery addresses.
Your shopping cart and your wishlist.
Your in-app notifications and your push notification device tokens.
Reviews you wrote in the App.
The App’s copy of your past orders.
Every sign-in session, on every device. All access and refresh tokens are revoked at the moment of deletion and stop working immediately, rather than expiring on their own.

From the pothak.lk store (handled by the store team):

Your pothak.lk store (WooCommerce/WordPress) customer account, including its website login, profile and saved billing details. Deleting it ends your ability to sign in on the pothak.lk website.

Until your request is processed, your account and its sessions remain active — submitting a deletion request does not sign you out or clear anything on your device. Data held on your own device (sign-in tokens, cached profile, guest cart and wishlist) is cleared when you sign out, and in any case disappears when you clear the App’s data or uninstall it.

Because your account record is removed rather than flagged, your email address is released and you may register again with it at any time. The new account starts empty.

What is retained, and why

The App keeps nothing of yours once deletion is processed. Order and transaction records are different: the pothak.lk store, as seller of record, keeps its own record of each order. They are records of a completed commercial transaction and are needed for accounting and bookkeeping, tax records, refunds and returns, warranty and consumer-protection claims, and payment dispute resolution.

Ordinary server, security and error logs may briefly contain technical records of your requests; they are not an account record and age out on their own.

How long the retained records are kept

We do not set a fixed retention period for the store’s order records, and we will not promise you a date by which they disappear, because the period is not ours to choose: they form part of the store’s accounting records and are kept for as long as the tax, accounting, audit and consumer-protection rules that apply to us require, and for as long as a related dispute, refund, warranty or payment claim could still arise or remains open. In practice this is a period measured in years. See Section 10.

Everything listed under “What is deleted” above is removed when your request is processed and is kept for no period after that — there is no grace period and no recovery window during which the account could be reinstated. Deleted records may persist for a short while in our database provider’s routine encrypted backups, which exist only for disaster recovery, are never used to restore a deleted account, and age out on the provider’s own cycle.

A full description of this process is published at https://pothak.lk/delete-account for Google Play’s data-deletion disclosure.

13. Children’s privacy

The App is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.

14. Third-party links and services

The App may link to external pages (for example, the payment provider’s checkout page or the pothak.lk website). Those services are governed by their own privacy policies, and we are not responsible for their practices. We encourage you to review them.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date, publish the new version at https://pothak.lk/app-privacy-policy, and, where appropriate, notify you in the App or by email before the change takes effect. Your continued use of the App after an update means you accept the revised policy.

16. Contact us

POTHAK.LK (PVT) LTD
Privacy enquiries: [email protected]
Customer support: [email protected]
Phone: +94 726366000
Postal address: Ganemulla Road, Kadawatha, Sri Lanka

App privacy policy