Privacy policy

• To sign in, you enter your number and we send a one-time code to it by WhatsApp or SMS. On Android in India you can instead let Truecaller confirm your number; Truecaller then shares your number, and your name if you allow it, with us.
• The verified number is your account. We use it to sign you in, to let people who already have your number send you recommendations, and to protect your account.
• We store your number encrypted. People you send a recommendation to see your number, or the name they saved for you in their own contacts.
• When your account is used on a new phone we record the device model, an approximate city worked out from the network address, and the time, so we can alert you and you can sign that phone out.
• Phone numbers are sometimes given to someone new by the mobile operator. If a number that has been inactive for a long time is verified by a new person, they get a fresh account. The old account is detached from the number and kept hidden, until its owner recovers it or asks us to delete it. We never delete an account automatically.

• Account: your phone number; a display name and a photo, both optional; an email address, only if you add one (for example to receive your data export).
• What you send and receive: recommendations, the link or title they are about, voice notes, their transcripts, typed notes, replies and "Tried it" reactions.
• Contacts: only if you allow it, and only as described in "Your contacts" below.
• Device and safety data: a notification token, an installation ID, the device model and app version, sign-in events, and the reports and blocks you make.
• Crash reports: after you sign in, the app sends a report when something breaks: where in the code it went wrong, the device model, the app version and an installation ID. Never your name, number, messages or recommendations. You can turn crash reports off in Settings.
• Usage statistics: only if you opt in. They are counted against a rotating ID that is never linked to your account.

We do not collect your date of birth or age, your precise location, your messages in other apps, or any advertising ID, and we do not track you across other apps or websites.

If you allow it, the app puts each number in your contacts into one standard international format and turns it into a one-way code (a hash) on your phone before sending it. Names and other details never leave your phone. We keep only the matches with people already on Taareef and never store anyone else. We never message your contacts: an invitation goes out only when you send it yourself. You can turn off contacts access, or remove what was uploaded, at any time in the app.

• Voice notes are stored encrypted and delivered only to the people you choose.
• Each voice note is transcribed in the language you spoke by a speech-to-text provider working for us. The provider may not use your voice to train its models and keeps it only as long as transcription takes.
• If you send a recommendation as a WhatsApp link, anyone who has the link can play the voice note for 30 days, the same as anything else shared by link. The transcript is not shown on the link page.
• If you unsend a recommendation, we remove it, its voice note and its transcript from the recipient's Inbox. If they already played or shared it, we can't undo that.

To show a card for what you recommend, our server sends the link or the name you typed to services such as TMDB (films and shows), Google Maps (places), Apple Music, Open Library (books), YouTube and Spotify. We send only that text, never who you are. Place details are fetched fresh each time and not stored.

• To create and secure your account, deliver recommendations and notifications, and show you your Inbox.
• To keep people safe: to detect fraud and abuse, to screen voice notes and notes that may break the Community guidelines (automatically, with people reviewing reports), and to act on reports.
• To fix crashes, from crash reports (which you can turn off in Settings) and from our servers' error reports, which carry no personal data; and, only if you opt in, to improve the app with usage statistics.
• To meet legal obligations, such as answering lawful requests and keeping security logs.

We rely on your consent, which you give when you sign in and when you allow optional features, and on the uses the law permits without consent, such as legal compliance. You can withdraw consent for optional features at any time in the app.

• Clerk: sign-in sessions.
• Cloudflare: our network edge (domain, content delivery and firewall) and the storage of voice notes and images.
• Neon: our database, hosted in Singapore.
• Our server hosting provider: not chosen yet; we will name it here before Taareef launches.
• Sentry: crash reports from the app after you sign in (you can turn them off in Settings), and error reports from our servers, which carry no personal data; in the United States.
• A speech-to-text provider: not chosen yet; we will name it here before transcripts launch.
• Meta (WhatsApp) and MSG91 (SMS): delivering sign-in codes.
• Truecaller: confirming your number on Android, only if you choose it.
• Google and Apple: delivering notifications; Google Maps Platform for place details.
• PostHog: usage statistics and, to fix bugs, screen recordings with all text and images hidden, only if you opt in; in the United States.

These providers act on our instructions. We don't share your personal data with anyone else, except where the law requires it.

Our database is in Singapore. Voice notes and images are stored by Cloudflare in the Asia-Pacific region. Clerk, Sentry and PostHog process data in the United States. Transfers outside India follow the rules of the Digital Personal Data Protection Act, 2023.

• Account data, recommendations and voice notes: until you delete them or your account. We never delete an account automatically.
• After you delete your account: everything listed in Delete your account is erased within 30 days, and removed from backups within a further 7 days.
• Data exports: deleted 7 days after they are ready.
• Security logs: kept for one year, with your identity replaced by a code.
• Crash and error reports: at most 90 days.
• Usage statistics: 13 months.
• Reports about abuse and the evidence attached to them: as long as the law requires.

Under the Digital Personal Data Protection Act, 2023 you can:

• get a summary of the personal data we hold about you and how we use it ("Download my data" in Settings);
• correct or update it, for example your name or photo;
• erase it by deleting your account;
• withdraw consent for optional features, such as contacts and usage statistics, and turn off crash reports;
• nominate someone to exercise these rights if you die or become unable to;
• raise a grievance with our Grievance Officer (below), and, if you are not satisfied with the answer, complain to the Data Protection Board of India.

You can also choose who can send you recommendations, and block people, in Settings.

Taareef is not designed for children and does not ask for or store anyone's age or date of birth. If you are a parent or guardian and believe your child is using Taareef, write to our Grievance Officer and we will help, including by deleting the account.

All traffic to and from Taareef is encrypted. Phone numbers and voice notes are encrypted where we store them, and only the few people who need access to run Taareef have it, with every access to personal data recorded. If a breach affects your data, we will tell you and the authorities as the law requires.

When we change this policy, we update the date above. If a change is significant, we tell you in the app before it takes effect.

• Name: [Grievance Officer's name, to be published]
• Email: grievance@taareef.in
• Address: [Grievance Officer's postal address, to be published]

See Support and grievances for how grievances are handled and how quickly we answer.