Privacy Policy

1. Categories of Personal Data We Process

We collect and process only the minimal personal data necessary to provide authentic, proximity-based social discovery:

• Account & Authentication Data: Mobile telephone number, SMS One-Time Password (OTP) verification tokens, account creation timestamps, and account status indicators.
• Profile & Biography Information:Display name, profile avatar/photographs, and optional user-selected prompt responses (such as "Open To," "Talk About," "One Thing," and Outfit of the Day ("OOTD")).
• Real-Time Proximity & Location Data:Ephemeral latitude and longitude coordinates derived from your device location services (GPS, Wi-Fi, cell triangulation), your chosen discovery radius (200m, 500m, 1km, 2km, 5km, or 10km), and the toggle state of your "Location Sharing" control.
• Moments & In-App Interactions (Pings, Waves & Hits): Ephemeral moments (Pings) captured in your surroundings, outgoing and incoming wave signals, Hit interactions, and your calculated Presence Score.
• Direct Communications: Text messages and media exchanged between users following mutual double opt-in wave consent.
• Technical, Device & Security Logs: Device hardware model, operating system version, unique device/push identifiers, IP address, connection timestamps, error logs, and session authentication tokens.

2. Sources of Personal Data

• Directly Provided by You: When you register an account, verify your phone number, configure your profile, post a Ping, send a wave, or send a message.
• Automatically Collected from Device Sensors: Real-time location coordinates when you grant system location permissions and enable Location Sharing; telemetry, crash, and diagnostic data generated during app usage.
• Service Providers: Telecommunication gateways that confirm delivery and verification of authentication OTPs.

3. Specified Purposes of Processing (DPDP Act Section 5 Notice)

In compliance with Section 5 of the DPDP Act, 2023, your personal data is processed strictly for the following itemized purposes:

• Authenticating user identity and securing access via mobile phone number verification.
• Calculating relative proximity distances to populate the People Nearby discovery feed within your chosen radius (200m–10km).
• Facilitating mutual double opt-in waves, Ping consumption, moment Hits, and direct communication channels.
• Calculating your Presence Score based on active engagement and genuine real-world presence.
• Detecting, preventing, and investigating fraud, automated bot activity, harassment, stalking, or security incidents.
• Complying with statutory obligations, judicial orders, and cybersecurity logging mandates under Indian law.

We do NOT sell, rent, trade, monetize, or broker your personal data or location coordinates to third-party data brokers or advertising networks.

4. Location & Proximity Privacy Architecture

• Explicit Active Consent:Location data is accessed ONLY after you grant OS-level location permissions AND activate the in-app "Location Sharing" toggle.
• Deactivation & Feed Removal:When you toggle "Location Sharing" off, your profile is immediately removed from the active nearby discovery pipeline, making you undiscoverable to others (subject to standard network sync latency).
• No Historical GPS Travel Logs: We do NOT store historical location breadcrumb logs, movement timelines, or continuous travel routes. We hold only your latest active coordinate in temporary operational cache solely while Location Sharing is active to compute distance buckets.
• No Exact Coordinates Published:Exact raw latitude and longitude floats are processed in memory and are NEVER displayed or transmitted to other users. Other users only see approximate relative distance buckets (e.g., "within 500m").
• No Background Tracking When Inactive: When the App is closed or when Location Sharing is disabled, ByChance does not track your location in the background.

5. Third-Party Service Providers & Disclosures

We share personal data only with trusted service providers strictly to deliver core platform functionality:

• Cloud Infrastructure & Hosting: Managed cloud servers, secure databases, and memory caching layers located in certified data centers with industry-standard physical and logical security controls.
• Telecommunication & SMS Gateways: SMS aggregators and telecom gateways used exclusively to transmit verification OTP codes to your mobile phone.
• Mobile Application Platforms: Apple Inc. (App Store) and Google LLC (Google Play) for application distribution, crash diagnostics, and push notification delivery.
• Legal & Emergency Disclosures: We may disclose data if required by a binding court order, lawful government directive under Section 69A of the IT Act, or in emergency circumstances involving imminent danger of physical harm to any individual.

6. Data Retention, Account Deletion & Compliance Logs

• Active Account Data: Your account profile, photos, and settings are retained for the duration of your active account.
• Ephemeral Pings: Moments (Pings) are designed for single consumption and automatically expire from active discovery feeds once consumed or upon lifecycle expiration.
• Account Deletion: You may request permanent deletion of your account at any time directly through the in-app settings menu. Upon deletion, your profile, photographs, active Pings, waves, and direct messages are purged from our active production database within 30 days.
• CERT-In Mandatory Log Retention: In compliance with Direction No. 20(3)/2022-CERT-In issued by the Indian Computer Emergency Response Team (CERT-In) under Section 70B(6) of the IT Act, system access, network connection, and ICT security logs are securely retained for a rolling period of 180 days within Indian jurisdiction for cyber incident investigation.
• Encrypted System Backups: Encrypted secondary system backups rotate on standard snapshot cycles before automated overwrite.

7. Technical & Organizational Security Safeguards

In compliance with Section 43A of the IT Act, the SPDI Rules 2011, and Section 8(5) of the DPDP Act 2023, ByChance implements reasonable security practices and procedures:

• Encryption in Transit: All data transmitted between the App and our backend servers is encrypted using industry-standard Transport Layer Security (TLS 1.2 / TLS 1.3).
• Encryption at Rest: Sensitive data stores and credentials are encrypted at rest using AES-256 encryption.
• Access Controls: Strict role-based access control (RBAC), tokenized authentication sessions, rate-limiting, and firewall controls prevent unauthorized database access.

8. Your Privacy Rights (DPDP Act 2023)

Under the DPDP Act, 2023, you have the following statutory rights regarding your personal data:

• Right to Access Information (Section 11): Right to obtain a summary of personal data processed, identities of third parties with whom data has been shared, and any other prescribed details.
• Right to Correction & Erasure (Section 12): Right to correct inaccurate data, complete incomplete data, update outdated data, and request erasure of personal data that is no longer necessary for the specified purpose.
• Right to Grievance Redressal (Section 13): Right to have your privacy grievances addressed by our Grievance Officer within statutory timelines.
• Right to Nominate (Section 14): Right to nominate another individual who, in the event of death or incapacity, shall exercise your privacy rights under the Act. Nominations may be submitted by writing to our Grievance Officer.
• Right to Withdraw Consent: You may withdraw your consent for location sharing or account processing at any time via in-app toggles or by deleting your account.

To exercise any of these rights, please submit a request to our Grievance Officer at bychance.app@gmail.com.

9. Children's Privacy (Strict 18+ Requirement)

ByChance is strictly intended for individuals aged 18 and older. In compliance with Section 9 of the DPDP Act, 2023, we do not knowingly collect, process, or track personal data of children. If we discover that an individual under 18 has registered an account, we will immediately terminate the account and purge all associated data from our systems.

10. Grievance Redressal Officer & Contact Details

In compliance with Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021 and Section 13 of the DPDP Act, 2023, you may contact our designated Grievance Officer:

Response Timelines:

• Acknowledgment: Within 24 hours.
• Expedited Bodily Privacy Takedown (Rule 3(2)(b)): Non-consensual intimate imagery/deepfakes removed within 24 hours.
• General Grievance Resolution: Within 15 days.
• Appeals (GAC): Users aggrieved by a grievance decision may appeal to the Grievance Appellate Committee via https://gac.gov.in within 30 days.