Bulbasaur
Privacy & security
Your details are encrypted in transit, kept for this restaurant alone, and never sold. Here is exactly what that means.
Encrypted end to end in transit
Every page and every order you place travels over HTTPS — the padlock in your browser’s address bar is this. Nobody on the café Wi-Fi, or anywhere between your phone and us, can read it.
No password to lose
You sign in with a one-time code sent to your phone. There is no password stored anywhere, so there is no password for anyone to steal, guess, or reuse against you on another site.
We never see your card
Payment happens at the counter, with Bulbasaur directly. Your card number, UPI PIN and bank details never reach this app — all we record is which method the bill was settled by, so the restaurant’s own books add up.
What is actually stored
Your name, your mobile number, an email only if you chose to add one, and the orders you have placed here. A birthday, a gender and what you eat, only if you filled those in yourself — all optional, and all can be cleared. If you turned notifications on, the anonymous address your browser gave us to reach it. That is the whole list.
This restaurant, and no other
Your account here belongs to Bulbasaur. A different restaurant using the same app cannot see your name, your number or your order history — each one holds its own record of you, and nothing on this app can show one restaurant another’s.
Signing in once, not everywhere at once
Verifying your number once means you don’t have to do it again at the next restaurant. What is carried across is the fact that this phone was verified, the name you gave, and — if you filled them in — your birthday, gender and what you eat, so you are not asked for the same details at every place you order from. Your orders, your email and everything else stay with the restaurant you gave them to.
You can undo any of it
Change or clear your email, birthday, gender and diet on the profile page — clearing a field removes it rather than hiding it. Switch notifications off in settings — that stops the sending, it does not just hide it. Sign out to remove this device’s access. To have your details deleted altogether, ask Bulbasaur and they will action it.