Privacy Policy

1. Who we are

[Company legal name] ("Zovii") is the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 (DPDP Act). This policy explains how we handle it in the Zovii app and website.

We ask for your consent in the app before we collect data, in English and Hindi. You can withdraw it at any time (see Your rights).

2. What we collect

• Phone number: used to sign you in. We store it as a one-way hash plus an encrypted copy. It is never shown to anyone.
• Profile: first name, date of birth, gender, who you want to see, Looking For, Right Now plans, zone and area, bio, vibe tags, habits and your photos. Private photos, if you add them, are shown only to people you share them with in a chat, and only while that chat is open.
• Verification selfie: a gesture selfie taken in the app. It is used only by our review team and automated face checks to confirm you match your photos and are 18+. It is never shown on your profile and is kept only as long as needed for review and safety [retention period to confirm].
• Location: while you use the app, it sends your location at most every 30 minutes (never in the background). Matching and distance use only a coarse area of about 1 km. Your exact location is stored encrypted for 90 days, only for safety investigations and lawful requests, and is never shown to other users.
• Contacts (only if you turn on Hide from contacts): your phone contacts are turned into one-way hashes on your phone. We keep only the hashes to hide you from those people, never the raw numbers or names.
• Activity: Connects sent and received, chat messages (including chats that were later removed), blocks, reports, post-date check-in answers and your settings.
• Device and technical data: device ID, app version, push token, IP address, crash reports and usage events.

3. What we never show

Other users never see your phone number, email, exact location, home or work address, last name (unless you add it) or exact last-seen time. Distance is shown only in bands (such as "2–4 km"), and activity only as "Active today" or "Active this week".

4. Why we use it

• To create your account and sign you in.
• To show you to people nearby and rank Discover based on your preferences.
• To deliver Connects, chats and notifications.
• To verify profiles and check age.
• To keep people safe: detect spam, scams and paid services, review reports, and keep a private trust score that no user can see.
• To fix bugs and understand, in aggregate, how the app is used.
• To meet legal duties, such as answering valid requests from law enforcement.
• To investigate safety complaints and crimes: a small number of senior staff can open your chats and exact location history, only with a written reason. Every time they do is recorded with their name.

We do not sell your personal data and we do not use it for third-party advertising.

5. Sensitive information

What you are Looking For, who you want to see and anything you share about your sexual orientation is treated as sensitive. It is used only inside Zovii for matching and is never shared with third parties, including analytics and advertising partners.

6. Who we share it with

Other users see only your profile and what you send them. We use a small set of service providers (Data Processors) who process data on our instructions and under contract:

• Amazon Web Services, Mumbai region: hosting, database, and automated photo and face checks.
• Cloudflare: photo storage (R2) and secure connections to our servers. Photos may be stored in Cloudflare data centres outside India [region to be confirmed before launch].
• MSG91: sends sign-in codes by SMS (receives your phone number only).
• Truecaller (Android, only if you tap “Continue with Truecaller”): confirms your phone number instead of a code, and shares your name with us so we can suggest it at sign-up. We keep only your number; your name is saved only if you keep it on your profile.
• Sentry: crash and error reports.
• PostHog: product analytics. It never receives your phone number, name or message text.

Sentry and PostHog receive only a random account ID with technical and usage data, and may process it outside India [region to be confirmed before launch].

• Expo push service (with Apple and Google): delivers notifications. Notifications never contain names or message text.

We share data with police or courts only when Indian law requires it (see Grievance Redressal).

7. Where it is stored and how it is protected

Your account data (profile, chats, phone number and location) is stored in India, in the AWS Mumbai region. Photos are stored with Cloudflare R2 and are never public: each is shown through a short-lived private link. Data is encrypted in transit; photos, your phone number and your exact location are encrypted at rest. Only trained staff can see personal data, only what they need for a task, and every admin action is logged. Private chats and exact location can be opened only by senior staff, with a written reason, for a limited time.

8. How long we keep it

• While your account is open, we keep your data so the service works.
• Exact location: 90 days, then erased automatically.
• When you delete your account, you disappear from the app at once and your messages disappear from the other person’s chat. Your profile and photos are erased after 30 days; until then, signing in again with your number lets you restore your account, or erase it straight away and start a new one. As Indian law requires (IT Rules 2021), your chats, exact location history and phone number are kept securely for a further 180 days after deletion, only for lawful requests and safety investigations, and then erased.
• If an account is banned, we keep a minimal record (hashed phone number and device ID) so the person cannot rejoin.
• Reports and moderation records may be kept longer where needed for safety or by law [period to confirm].

9. Your rights

• Access and export: Settings → Terms, privacy and your data → Download my data.
• Correction: Edit profile, at any time.
• Deletion: Settings → Delete account. You can also delete single photos.
• Withdraw consent: turn off Hide from contacts, notifications or read receipts in Settings, or delete your account. Withdrawing consent may stop some features from working.
• Grievances: write to our Grievance Officer at grievance@zovii.in. You may also complain to the Data Protection Board of India.
• Nominate someone to exercise your rights if you die or cannot act, by writing to us.

10. Children and changes

Zovii is only for adults. We do not knowingly collect data from anyone under 18, and we delete it when we find it.

We may update this policy. If a change is important we will ask for your consent again in the app. Questions: support@zovii.in.