Privacy Policy

1. Information we access and collect

Account and profile

We process your account identifier, phone number, display name, account creation information, and authentication and session information. If you provide them, we also process your email address and verification status, profile photograph, biography, interests, and profile and privacy preferences. The information used depends on the features and app version you use.

Phone sign-in uses Firebase Authentication to send and verify a one-time SMS code. Google processes phone numbers used for authentication for spam and abuse prevention, including across Google services. See Firebase’s privacy information and the Google Privacy Policy.

Contacts and invitations

With device permission, ChayBuddy accesses contact names, phone numbers, and available contact photographs to identify people you know and support invitations. Contact phone numbers are sent to our Firebase database service as matching queries against registered accounts. Contact details and matching results are cached on your device, including contacts who do not use ChayBuddy.

When you use invitation features, selected invitees’ names, phone numbers, and invitation timestamps can be saved with your account. Sharing an invitation through another application also provides the information you choose to share to that service. Only provide contact information you are entitled to use. Revoking permission stops further device access; it does not automatically erase information already stored.

Messages, media, and shared content

We process direct and group messages, photographs, videos, shared files, stickers, reactions, replies, and associated sender, recipient, conversation, timestamp, and delivery or read information. Content and media can be stored locally and processed by our servers and storage providers for delivery and synchronization. Content is not exclusively stored on your device.

Message notifications can include sender information and message previews. Depending on your notification and device settings, people with access to your device or notification display may see those previews.

Availability and community activity

We process availability status and visibility settings; group membership and roles; posts, comments, and reactions; meetup invitations and responses; event registrations, tickets, attendance and check-in records; and activity you submit through social features. Relevant activity can contribute to participation, reputation, or trust indicators. We also process blocks, reports, appeals, and information needed to respond to abuse and enforce service rules.

Location and places

With location permission, location features access device coordinates to support nearby discovery, maps, distance estimates, and meetup planning. These features request foreground permission and can update location while a location feature is in use. You can also select a discovery location manually. Location information may be cached locally or associated with your account and shared content, depending on the feature.

Places, addresses, coordinates, or venues you add to events, posts, or messages can be visible to their audience. Turning off location permission does not remove places you previously shared.

Payments, tickets, and refunds

When you book paid activities, we process booking and order identifiers, account and contact details, ticket information, amounts, payment and refund status, and related transaction records. Cashfree processes payment information through its payment service. Our service receives transaction information needed to confirm bookings, handle refunds, reconcile payments, and support disputes.

Organizer verification and payouts

If you apply to organize paid activities or receive payouts, we process the legal name, contact information, PAN number and PAN document, identity-document type and uploaded document, bank account holder name, account number, IFSC, and verification information you submit. Depending on your selection, an identity document may contain an Aadhaar number or other government identification.

Relevant information is processed by verification administrators and payment or payout providers for verification, payouts, compliance, and fraud prevention. Identity and financial information is sensitive. Do not send identity documents, bank details, passwords, or one-time codes to our privacy contact by ordinary email.

Device, security, and operational information

The app and supporting infrastructure process information needed to connect and operate, such as IP addresses, device or browser and operating-system information, authentication and app-integrity tokens, push notification tokens, linked-device identifiers, session information, request timestamps, error information, and delivery or security logs. Infrastructure and SDK providers also process technical information as described in their notices.

Support correspondence

If you contact us, we process the contact information, request details, and attachments you provide to respond, investigate problems, and maintain necessary records of the request.

2. How we use information

• Create and authenticate accounts and maintain sessions.
• Display profiles and availability, match contacts, and support invitations.
• Deliver messages and notifications, maintain offline information, and synchronize linked devices.
• Operate groups, discovery, forums, meetups, registrations, and attendance features.
• Process tickets, payments, refunds, organizer verification, and payouts.
• Apply your settings, answer requests, and troubleshoot service problems.
• Investigate fraud and abuse, protect users, and meet applicable legal obligations.

Where applicable law requires a legal basis, the relevant basis depends on the activity. It may include providing a service you request, consent for optional processing, compliance with legal obligations, or legitimate interests in operating and protecting the service, subject to applicable rights and safeguards. A device permission or use of the app is not blanket consent to unrelated processing.

3. Who receives information

Recipients and other users. Your chosen recipients receive messages and shared media. Group members, event participants, organizers, and public audiences receive relevant profile, membership, registration, attendance, or published content according to the feature and its access rules. People who know your phone number may be able to find your registered account through contact matching.

Public content. Information you publish to public groups, discovery features, forums, or events may be viewed, copied, or redistributed by others. Consider the audience before sharing personal information or a location.

Service providers. Providers process information needed for authentication, hosting, databases, storage, messaging, maps, media, email, and payment functions, as described below. They do not all receive all categories of information in this policy.

Legal and safety disclosures. We may disclose information where required by applicable law or valid legal process, or where lawful and necessary to investigate fraud, protect people, or defend legal rights. If ownership of the service changes, a transfer of information must follow applicable law and appropriate notice requirements.

Sharing you initiate. If you export content, share an invitation, open an external service, or give a third party access to information, that party handles the information under its own practices.

4. Third-party services

• Google / Firebase: authentication, databases, cloud functions, storage, app-integrity checks, and push messaging. See Firebase privacy and security and the Google Privacy Policy.
• Google Maps / Places: mapping and place search. Relevant map and search requests and technical information are processed by Google. See the Google Privacy Policy.
• Google Tenor: GIF and sticker search and media. Tenor receives search terms and network request information when its online features are used. See the Google Privacy Policy.
• Cashfree: payments, refunds, and organizer payouts, including relevant customer, transaction, verification, and bank information. See the Cashfree Privacy Policy.
• Backblaze B2, where configured: storage and delivery of uploaded media and associated file information. See the Backblaze Privacy Policy.
• Email delivery: the configured email service processes email addresses, verification messages, and delivery information needed to send service emails.

Loading link previews, linked images, or other external content can contact the destination website and disclose your IP address and request information, including when a preview loads within the app. Provider notices explain their own practices; this policy describes ChayBuddy’s use of their services.

5. Permissions and choices

• Contacts: identify registered contacts and support invitations.
• Camera: capture content and scan linked-device QR codes.
• Photos, videos, and storage: select, upload, download, or save media, where permission is required by your device and OS version.
• Microphone: capture sound when using recording features that request audio access.
• Location: support nearby discovery, maps, and location features.
• Notifications: display message, invitation, activity, and service alerts.

Manage permissions in your device settings. Denying an optional permission can prevent the corresponding feature from working. Available privacy settings let you manage availability, profile visibility, discoverability, blocking, and notification preferences. Previously delivered content and saved data are not automatically recalled when you change a permission or audience setting.

6. Offline storage and linked devices

ChayBuddy uses local databases, app files, and caches so supported features work offline. These can contain messages, media, contacts, profile and location information, preferences, and pending changes. Linked web browsers use browser storage, including local databases and caches, for sessions and offline functionality. Pending changes may be sent to our services when connectivity returns.

Use device locks and link only devices and browsers you trust. Clear app or browser storage when you want to remove local copies, especially on shared devices. This can remove unsynchronized information. Clearing storage or uninstalling the app does not delete your server account. Device or operating-system backups may preserve local information under your backup settings.

Local storage used for sessions, preferences, and offline functionality is distinct from optional device permissions. You can manage browser storage through browser settings, although clearing it may end a session or remove offline content.

7. Retention

Account and service information is retained while needed to provide the relevant functionality, unless deletion is requested earlier or a lawful retention requirement applies. Different categories have different lifecycles:

• Account and profile: while the account remains active and during the processing of a verified deletion request.
• Messages and media: according to delivery, synchronization, and deletion needs. Some server delivery records are removed after delivery confirmation. This does not erase recipients’ local copies or set a deadline for all conversations and uploads.
• Linked-device history transfers: temporary transfer uploads are configured to expire after approximately 24 hours, with physical removal performed by scheduled cleanup. These are separate from normal chat attachments.
• Device and browser copies: until removed by app cleanup, supported deletion controls, or clearing local storage. Independent recipient copies and operating-system backups can have separate lifecycles.
• Financial, verification, and dispute records: for the applicable legal, accounting, payment reconciliation, fraud-prevention, or dispute-resolution need.
• Support and security records: while needed to resolve the request, investigate an incident, document deletion, or satisfy an applicable legal obligation.

If some information must be retained after account deletion, we will explain the relevant categories, reason, and retention period or criteria in responding to your request. A retention exception does not justify keeping unrelated account information indefinitely. Contact us for information about retention applicable to your account or a particular transaction.

8. Account and data deletion

Inside the mobile app: open Profile → Privacy & Safety → Delete Account and follow the confirmation steps. An internet connection is needed to submit and complete server-side deletion.

Without the app: visit the ChayBuddy account-deletion page or email support@spellstudy.com with the subject “ChayBuddy account deletion.” Include your registered phone number with country code or another account identifier so we can locate the account. You do not need to reinstall the app to make this request.

We may take proportionate steps to verify account ownership before acting. Do not email your password, one-time codes, bank details, or identity documents. We will explain any additional verification through an appropriate channel.

A verified account-deletion request covers your account and associated personal information within our control, including profile information, contact and invitation records, memberships, messages and uploads, and linked-device information, subject to the limited retention reasons described above. We process requests within applicable legal deadlines and will explain any necessary exception or delay. Server and provider cleanup can involve multiple systems.

You can also contact us to request deletion of specific personal information without closing the account. We will explain if removing that information prevents a feature from working or if a lawful retention requirement applies.

Signing out, clearing local storage, or uninstalling is not account deletion. Recipients may retain screenshots, exports, downloaded files, or other independent copies of content you shared. We cannot guarantee removal of copies outside our control; this does not limit our responsibility for information within our control.

9. Security

ChayBuddy uses authenticated requests and access rules to restrict service operations, and HTTPS connections for its cloud service endpoints. Security also depends on device settings and provider configurations. Some media is served through shareable download URLs; someone who obtains a working URL may be able to access that file. Treat shared media links as sensitive.

This policy does not claim that all conversations or local storage are end-to-end encrypted. No system can guarantee absolute security. Contact support@spellstudy.com if you suspect unauthorized access or a security issue involving your account.

10. International processing

Our infrastructure and providers may process information outside your state or country, where data-protection rules can differ. Where applicable law requires conditions or safeguards for a transfer, those requirements apply to our processing. Contact us for information about the providers and processing relevant to your account.

11. Children’s privacy

Use of ChayBuddy must comply with applicable age and parental-consent requirements. Where processing a child’s information requires a parent’s or guardian’s authorization, that authorization is required before the relevant processing.

If you are a parent or guardian and believe a child has provided information without required authorization, contact support@spellstudy.com. We will investigate and take steps required by applicable law, including removing information where appropriate.

12. Privacy rights and complaints

Depending on your location and applicable law, you may have rights to access, correct, obtain a copy of, or delete information; withdraw consent; or object to or restrict certain processing. These rights can have conditions and exceptions. You may also have a right to complain to a relevant data-protection authority.

Contact support@spellstudy.com to make a request or raise a concern. Describe the request and provide enough information to identify your account. We may verify your identity proportionately and will respond within applicable legal deadlines. Withdrawing consent does not undo processing that was lawful before withdrawal.