Security

Protecting Craves accounts and payments.

Craves separates public customer applications from backend service credentials and verifies payment state on the server. Customers can also help by keeping authentication and payment secrets private.

What Craves will never ask you to send

Your UPI PIN.
Your card CVV.
Your banking password.
A Firebase OTP or account password by email.
Internal Craves API keys, Azure secrets, or provider credentials.

Payment verification

Payment checkout is hosted by Razorpay. Craves treats payment as final only after server-side provider verification or a verified signed provider event; a browser redirect by itself is not trusted as proof of payment.

Report a concern

If you believe your Craves account, order, or payment was accessed without permission, contact support@craves.in. Include the relevant Craves order reference if available, but do not include payment secrets.