Privacy Policy

Effective: 29 September 2026 · Version 7.0

This policy explains what personal data Dapster collects, why, who can see it, how long we keep it, and your rights. The data fiduciary (the party responsible for your data) is Anandu P N, an individual, of Pullattu House, Nedumbassery P.O., Kapprassery, Kerala 683585, India ("we", "us"). Contact details are in Section 17.

We do not sell your personal data. We do not use AI or large language models to process your messages. We do not use a crash-reporting tool.

Contents

1. Real account data vs persona data
2. What we collect and why
3. Consent and how to withdraw it
4. The selfie check
5. Location
6. What other members can see
7. Chats, photos and view-once
8. Moderation, scanning and reports
9. Payments
10. Ad measurement (Meta) and device data
11. Service providers and where data goes
12. Security
13. How long we keep data
14. Your rights
15. Data breaches
16. 18+ only
17. Grievance Officer and contact
18. Changes to this policy

1. Real account data vs persona data

Dapster is a persona app. Your data falls into two groups:

• Real account data is about you: your email, Google ID or username, password hash, date of birth, gender, phone number (if asked), selfie-check image, approximate location, consent records and purchases. It must be true, and we treat it as personal data.
• Persona data is the character you create: the name shown, age shown, bio, story and optional details. It is fiction by design. We still protect it as personal data because it is linked to your account, and your photos may show you.

2. What we collect and why

"Legal basis" refers to the Digital Personal Data Protection Act, 2023 (DPDP Act): Consent (section 6), or a legitimate use under section 7 (for example, data you gave us voluntarily for a specific purpose, or processing needed to comply with a law or court order).

3. Consent and how to withdraw it

• When you sign up you must accept the Community Standards, Terms of Service and this Privacy Policy (version 7.0). Our server records the time and the version. When versions change, everyone is asked again.
• There are separate consent checkboxes for the selfie check and for location.
• Location: you can withdraw consent at any time in Settings > Privacy & consent. This clears your stored location. You can also turn off location permission in Android settings.
• Selfie check: this is required to use Dapster. Withdrawing this consent therefore means deleting your account (see Delete your account).
• Withdrawing consent does not make processing done before the withdrawal unlawful.

4. The selfie check

• During sign-up you take a selfie (and can add an optional voice clip).
• On your phone, Google ML Kit checks that the photo shows exactly one face. This check happens on the device; the selfie is not sent to Google for it.
• The selfie is then uploaded and our server approves it automatically. There is no face matching against your photos, no liveness test and no ID check. It does not confirm your identity or your age.
• The selfie and voice clip are stored privately, are never shown to other members, and are deleted 30 days after you submit them. During those 30 days, authorised staff can view them for safety review.
• We treat selfie images as sensitive data and handle them with the care required for sensitive personal data under the IT Act, 2000 and the SPDI Rules, 2011, even though we do not use them for biometric identification.

5. Location

• Dapster asks only for Android's approximate (coarse) location permission.
• We round your coordinates to about 1 km before storing them.
• Android's / Google's geocoding service turns your location into a city or area name.
• Your profile shows your city/area. Your exact location is never shown.
• Location affects the order of profiles in the feed.
• Sharing location in a chat sends your approximate coordinates to the other person, as part of the message. Map tiles come from OpenStreetMap, so OpenStreetMap receives your IP address and the map area being viewed.

6. What other members can see

7. Chats, photos and view-once

• Match and friend chats disappear 24 hours after each message is sent. The last 5 messages of a chat may stay up to 7 days, as text.
• In instant-message and Dapster ID request chats, a participant may turn disappearing off; those messages stay until the chat or an account is deleted.
• Chat photos and audio are stored on Cloudflare R2 with unlisted links and are deleted when the message expires.
• View-once and listen-once are enforced by the app. Android blocks screenshots inside Dapster, but someone can still capture the screen with another device.
• Private photos are stored privately and served only through our authenticated server, only to members you approve. You can revoke access at any time.
• Push notifications are sent through Google Firebase Cloud Messaging and may include a preview of the message text.
• Blocking someone deletes the chat history between you.

8. Moderation, scanning and reports

• Every text message, caption and channel post is automatically scanned for safety risks, such as phone numbers, mentions of other platforms, requests for money, and violence or blackmail. Flagged text is stored for review.
• Authorised Dapster staff may access conversations for safety, moderation, legal compliance and to handle reports.
• Photos are not scanned automatically; they are reviewed when reported or during our own reviews.
• Our text filter blocks profile and channel text that describes a minor.
• When you report someone, we store the report, the reason and the content concerned so staff can review it.

9. Payments

• All purchases go through Google Play Billing. We never receive your card, UPI or bank details.
• We receive from Google Play the product bought, price, time and order/purchase details, and we use the Google Play Android Publisher API to confirm purchases and detect refunds.
• If a purchase is refunded or cancelled by Google, we remove the matching benefit.

10. Ad measurement (Meta) and device data

• Dapster shows no ads inside the app. We do run ads for Dapster on Facebook and Instagram.
• To measure those ads, the app includes the Meta (Facebook) App Events SDK. It sends Meta: app install and app-open events, completed registration, purchase value and currency, your Android Advertising ID, and ad install-referrer data (which ad led to the install). As with any app using this SDK, Meta also receives basic device information (such as device model, Android version and app version) and your IP address.
• We do not send Meta your name, messages, photos or location.
• Meta handles this data under its own privacy policy (facebook.com/privacy/policy). Because Meta may use it for its own ad measurement, Google Play lists this as "shared" data.
• Your choice: you can reset or delete your Advertising ID in Android settings (Settings > Google > Ads, or Settings > Privacy > Ads).
• The app also uses a push-notification token (Firebase), your app version and basic device information needed to work properly.

11. Service providers and where data goes

We use these providers to run Dapster. They process data for us, for the purposes described here.

• Cross-border transfer: your data is processed in India and in the United States, and passes through Cloudflare's global network. We do not transfer personal data to any country that the Government of India has restricted under section 16 of the DPDP Act.
• Other sharing: with other members as described in Section 6; with authorities when the law requires (see our Terms, Section 15); and, if Dapster is transferred to a new owner, with that owner, who must keep this policy's protections or ask for your consent.

12. Security

We use these measures:

• HTTPS/TLS encryption for data in transit.
• Our storage providers' default encryption at rest.
• Passwords stored only as bcrypt hashes; refresh tokens stored hashed.
• Private photos and selfies in a private storage bucket, served only through our authenticated server.
• Screenshot blocking inside the app on Android.
• Admin access limited to allow-listed accounts, with an audit log of admin actions.
• Row-level security on database tables.
• Rate limiting.

No system is 100% secure. We cannot guarantee that data will never be accessed without permission.

13. How long we keep data

Where Indian law requires us to keep specific data longer (for example, evidence of child sexual abuse material, or data an authority has lawfully ordered us to preserve), we keep only that data, only for as long as required. Full details: Delete your account.

14. Your rights

Under the DPDP Act, 2023 and the DPDP Rules, 2025, you have the right to:

• Access: get a summary of your personal data we process and what we do with it, and who we shared it with.
• Correction, completion and updating: most profile details can be edited in the app. For other data, write to us.
• Erasure: delete your account in the app or ask us to erase data we no longer need.
• Withdraw consent (see Section 3).
• Grievance redressal: complain to our Grievance Officer.
• Nominate someone to exercise your rights if you die or become unable to. Email the Grievance Officer with the nominee's name and contact details.

How: use the in-app settings, or email the Grievance Officer (Section 17). We may ask you to confirm the account is yours. We acknowledge requests within 24 hours and resolve them within 15 days (IT Rules, 2021), and in any case within the time set by the DPDP Rules.

If you are not satisfied after using our grievance process, you can complain to the Data Protection Board of India.

15. Data breaches

If a personal data breach happens, we will inform affected users and the Data Protection Board of India as the DPDP Rules require, including what happened, the likely impact, what we are doing about it, and what you can do to protect yourself.

16. 18+ only

• Dapster is only for adults aged 18 and over. We do not knowingly collect data from anyone under 18.
• Accounts we believe belong to a minor are banned and deleted. Where there is child sexual abuse material, we preserve evidence as the law requires and report it to the authorities. See our Child Safety Standards.
• If you think a minor is using Dapster, email dapsterofficial@gmail.com with the subject "Child Safety".

18. Changes to this policy

• When we change this policy we give it a new version number and date.
• The app asks every member to accept the new version before continuing. Important changes are also announced in the in-app Dapster Info channel.