Vaak

This policy explains what information Vaak ("the app", "we", "us") collects when you use it, why we collect it, and the choices you have. It applies to the mobile app only.

Creating an account requires a mobile number, which we verify with a one-time passcode (OTP) sent to that number. We collect:

• Mobile number — used to identify your account and deliver OTP codes.
• Username — chosen by you when you complete your profile, shown within the app.
• Account activity — account creation date and last login time, used to keep your session secure.
• Authentication tokens — issued when you log in, used to keep you signed in between app launches.
• OTP codes — generated to verify your mobile number. These are stored in encrypted (hashed) form, never in plain text, and expire shortly after being issued.
• Chat messages — Vaak chat is end-to-end encrypted: messages and photos are locked on your phone and can be opened only on the phones in that chat. Our servers store and deliver them but cannot read them. We do see who sent a message to whom, and when. Text sent to someone still using a version of Vaak from before encryption, and messages sent before encryption was added, are stored readable.
• Photos in chat — photos you choose from your gallery or take with Vaak's camera. Vaak uses the camera only while you are taking a photo. Our servers hold the encrypted photo only until the other person's phone downloads it, and delete it after 14 days if it never does. On your phone, chat photos are kept in a "Vaak" folder in your gallery.
• Encryption keys — each phone creates its own keys. We store only your public key, so others can send you encrypted messages. The private key that unlocks your messages stays on your phone and is never sent to us.
• Phone numbers from your contacts — with your permission, the app reads your device's contacts to show you which of them are already using Vaak. Only the phone numbers are sent to our servers; the names you saved for your contacts stay on your phone and are used only there, to show those names in your chats — see Section 4 for exactly how this works.
• Profile photo and photo challenge — if you add a profile photo, we store it together with the challenge text you choose, plus a blurred copy and a small copy for lists. Other users see only the blurred photo and the challenge in Anka Lipi until they solve it; we record who has solved your current challenge, and you can see that list.
• Practice activity — the phrases you practise, whether you got them right, and how long you took, used to show your progress, to choose your next practice phrases, and to show your friends how much you practised today (you can hide this). Also reactions and nudges from friends, your streak, and who looked at your practice today: when you open a friend's practice card, they can see your name, but not how many times you looked. Reactions, nudges and views are deleted after two days. If you hide your practice, none of this is shown.
• Chat activity — replies, reactions, when a message was delivered and read, and the people you block.
• Push notification token — if you enable notifications, a device-specific token used to deliver them. Not linked to any advertising identifier. A chat notification carries the sender's username and the encrypted message, which your phone unlocks.
• Crash reports — if the app crashes, a crash report (the error, device model, Android/iOS version, app version, and your Vaak account number) is sent to Google's Firebase Crashlytics so we can find and fix the problem.

To be specific about what this app does not do:

We use the information above solely to operate the app: verifying your identity at login, keeping you signed in, displaying your chosen username and profile photo, delivering and displaying chat messages between you and other users, choosing practice phrases that suit your level, showing your progress, sending push notifications you've enabled, fixing crashes, and responding to support or privacy requests you send us. We do not use your information for advertising, and we do not build advertising or marketing profiles.

Contact matching, specifically: when you grant contacts permission, the phone numbers from your device's contacts are sent to our servers in a single request, checked against existing Vaak accounts, and the numbers you submitted are then discarded — we do not keep a copy of your contact list, and this match is never visible to anyone but you. Contact names never leave your phone.

Practice phrases: some practice phrases are written with the help of an AI service. Only general topics are sent to it — never your name, number, messages, or practice results.

We apply industry-standard safeguards appropriate to the sensitivity of the data involved:

• Authentication tokens on your device are stored in your device's secure, encrypted credential storage (Keychain on iOS, Keystore-backed storage on Android) — not in plain, readable form.
• Chat messages and photos are end-to-end encrypted (see Section 2).
• The connection between our servers and our database is encrypted in transit.
• Connections between the app and our servers use industry-standard transport encryption (HTTPS/TLS) in production.
• OTP codes are cryptographically hashed before storage; we never store them in a form that could be read back as the original code.
• Profile photos are never public: the app always gets them through our servers, which send the clear photo only to you and to people who solved your challenge, and nothing to people you've blocked or who blocked you.
• Our servers are hosted on Amazon Web Services in India.
• We do not use traditional passwords — accounts are authenticated by mobile number and OTP only, which removes an entire category of password-related risk.

No system is perfectly secure, and we cannot guarantee absolute security — but we design our storage and transmission practices to meet this standard, and we review them as the app evolves.

We do not sell your personal information, and we do not share it with third parties for marketing purposes. We use a small number of third-party services to operate the app, each limited to the specific purpose below:

• SMS delivery provider — your mobile number is shared with our SMS provider solely to deliver your OTP code, never for any other use.
• Push notification delivery (Firebase Cloud Messaging) — your device's push token is shared with Google's Firebase service solely to deliver notifications you've enabled.
• Crash reporting (Firebase Crashlytics) — crash reports, as described in Section 2, are sent to Google's Firebase service solely so we can fix crashes.
• Hosting (Amazon Web Services) — our servers and database run on AWS in India; AWS stores this data for us and does not use it for its own purposes.

We retain your account information for as long as your account remains active. If you delete your account (see Section 8), we permanently erase everything tied to it — your account record, active sessions, OTP verification history, practice history, push notification token, profile photo and challenge, encryption key, chat photos, practice reactions, nudges and views, and your chat messages (both sent and received) — not a temporary deactivation. Because deleting your account is a complete withdrawal, your chat messages are removed from the conversation entirely, including the copy the other person could see — not reassigned to a placeholder identity. This cannot be undone, and the same mobile number can be used to create a new account afterward.

Some data is kept for a short time even while your account is active: chat photos leave our servers once delivered (14 days at most), and practice reactions, nudges and views are deleted after two days.

Consistent with India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data — you can update your username at any time within the app.
• Delete your account and data — available directly in the app: tap your profile picture to open My Account and select Delete account. This permanently erases your account, sessions, and OTP history, is immediate, and does not require contacting support. If you no longer have the app installed, you can request the same deletion from the web at drive.vaakal.com/delete-account.html.
• Delete some of your data without deleting your account — messages, chats, and your profile photo can be deleted in the app; see vaakal.com/delete-data.html for the steps. You can delete your own messages for everyone within 48 hours of sending them.
• Withdraw consent and raise a grievance regarding how your data is handled, using the contact details in Section 11.

Vaak is for people aged 13 and over. It is not for children under 13, and we do not knowingly collect data from anyone under 13; if we learn that we have, we delete the account and its data.

Users aged 13 to 17. Under India's Digital Personal Data Protection Act, 2023, anyone under 18 is a child, and their personal data may be processed only with the consent of a parent or lawful guardian. If you are under 18, use Vaak only with your parent's or guardian's permission. We are adding an in-app parental consent step for users under 18; until it is available, a parent or guardian who has not given permission can ask us to delete their child's account and data.

For users under 18 we do not show advertising (Vaak has none for anyone), we do not sell or share their data, and we use practice activity only to choose practice content inside the app.

Parents and guardians: to ask about, or delete, your child's account and data, email support@vaakal.com with your child's Vaak mobile number. We will confirm the request and delete the data within 30 days.

If this policy changes, we will update the effective date at the top of this page and, for material changes, take reasonable steps to notify you within the app.

For questions about this policy, or to exercise any of the rights listed in Section 8, contact us at: