Privacy notice

Draft for legal review. Before launch, have a lawyer check this against India's Digital Personal Data Protection Act, 2023 (HANDOVER.md section 9).

What we collect and why

Account: your email, password (stored only as a secure hash by our authentication provider), display name, pronouns and city. Used to run your account.

Date of birth: to confirm you are 18 or older and, for wellbeing sessions, that you are 18 to 25. It is never shown to anyone. If you opt in, only your birthday's day and month appear to other members.

Face photo: to verify that each account belongs to a real person and to show as your display picture. A moderator views it once to approve it. Rejected photos are deleted.

Your content: reviews, posts, essays, comments, lists and journal entries. Journal entries and private lists are visible only to you.

Events: your reservations, so we can send confirmations and joining links on the day. Hosts and moderators see who reserved.

Complaints and reports: visible only to admins.

Wellbeing preferences: shared with Rafiky only if you tick the consent box.

Who we share it with

Our service providers: Supabase (database, storage and authentication), Vercel (hosting), Resend (email). We do not sell your data or show advertising.

Your rights

You can download your data and delete your account at any time from Settings. Deleting your account removes your profile, photos and content. You can ask us questions or complain through the complaints box.

Retention

We keep your data while your account is open. Moderation records are kept for up to two years to handle appeals and repeat abuse.