Privacy Policy

📋 1. Information We Collect

1.1 Information You Provide Directly

• Account Registration: Full name, email address, phone number, date of birth, gender identity.
• Profile Data: Profile photo(s), bio/description, interests and hobbies, city/region, personality prompts, and any other optional profile fields you choose to fill.
• In-App Communications: Text messages, voice notes, images, GIFs, stickers, and other media you share through Frendy's messaging system.
• Group & Event Data: Groups you create or join, events you attend, posts you publish in groups.
• Feedback & Support: Any information you send us via contact forms, in-app support, or email.

1.2 Information Collected Automatically

• Device Information: Device make/model, operating system and version, unique device identifiers (Android ID), screen resolution, and mobile network operator.
• Log & Usage Data: IP address, access timestamps, features used, pages/screens viewed, session duration, crash reports, and app performance data.
• Location Data: Approximate location (city/region) derived from IP address. Precise GPS location only with your explicit permission, used solely to show nearby friends/events.
• Behavioral Data: How you interact with profiles, which features you use most, time spent in app, and friendship patterns (used exclusively to improve matching).

1.3 Information from Third Parties

• If you sign in with Google, we receive your name, email address, and profile photo as permitted by Google.
• Analytics providers share aggregated, anonymized data about usage trends.

🎯 2. How We Use Your Information

🔗 3. Information Sharing & Disclosure

We share your information only in limited, necessary circumstances:

• With Other Frendy Users: Your public profile (name, photo, bio, interests, city) is visible to other users. Private contact details (phone number, exact address) are never shared publicly.
• Service Providers: Cloud hosting, analytics, push notification, and customer support vendors who process data on our behalf under strict Data Processing Agreements (DPAs). They may not use your data for their own purposes.
• Safety & Legal Requirements: We may disclose data if required by court order, law enforcement request, or to protect the rights, safety, or property of Frendy, our users, or the public.
• Business Transfers: In a merger, acquisition, or asset sale, your data may transfer. We will notify you 30 days before and give you the option to delete your account.
• With Your Explicit Consent: For any purpose not listed here, we will ask for and require your consent first.

Data sharing summary:

🔒 4. Data Storage & Security

We take the security of your data extremely seriously. Our technical and organizational measures include:

• SSL/TLS 1.3 encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Regular third-party security audits and penetration testing
• Strict role-based access controls — minimal staff can access user data
• Two-factor authentication mandatory for all administrative access
• Real-time intrusion detection and monitoring systems
• Automated backups with encrypted off-site storage
• GDPR-compliant data processing infrastructure

📝 5. User-Generated Content

• Public Profile: Name, photo, bio, and interests are visible to all Frendy users unless changed in Privacy Settings.
• Private Messages: Only visible to the sender and recipient(s). End-to-end encryption is available for direct messages. We do not read private messages except for safety investigations with specific legal justification.
• Group Posts: Visible to all members of that group.
• Content Deletion: You can delete any content you've posted at any time. Deleted content is removed from the app immediately; it may persist in encrypted backups for up to 30 days before permanent deletion.
• Content Moderation: We use automated systems and human moderators to detect and remove content that violates our Community Guidelines.

🍪 6. Cookies & Tracking Technologies

The Frendy mobile app (app.frendy) does not use browser cookies. We use the following SDK-based tracking:

• Firebase Analytics: Anonymous, aggregated usage analytics. Cannot identify individuals.
• Firebase Crashlytics: Crash and error reporting to improve app stability.
• Push Notification Tokens (FCM): Device tokens for delivering notifications — not used for tracking.
• Advertising ID: Google's Advertising ID may be used for measuring ad effectiveness only if you have opted into personalized ads in your device settings.

Our website (frendy.app) uses:

• Essential Cookies: Required for basic website security and functionality. Cannot be disabled.
• Analytics Cookies: Google Analytics to understand website traffic — anonymous and aggregated.
• Preference Cookies: Remember your settings for a better experience.

You can opt out of Google Analytics across the web at tools.google.com/dlpage/gaoptout.

🔌 7. Third-Party Services

Frendy integrates with the following third-party services:

Each third-party service has its own privacy policy. We require all vendors to meet our data protection standards and sign Data Processing Agreements.

👶 8. Children's Privacy

If we discover that a user under 13 has created an account:

• The account will be immediately suspended and all data deleted.
• The parent/guardian will be notified if a contact email is available.

If you are a parent or guardian who believes your child under 13 has an account, please contact us immediately at privacy@frendy.app with the subject line "Child Account Removal" and we will act within 48 hours.

⚖️ 9. Your Rights & Choices

Depending on your location, you have the following rights regarding your personal data:

• Right to Access (GDPR Art. 15): Request a complete copy of all personal data we hold about you.
• Right to Rectification (GDPR Art. 16): Correct any inaccurate or incomplete data — you can do this directly in app Settings.
• Right to Erasure / "Right to be Forgotten" (GDPR Art. 17): Request permanent deletion of your account and all associated data. Use our Delete Account page.
• Right to Data Portability (GDPR Art. 20): Receive your data in a portable, machine-readable format (JSON).
• Right to Restriction (GDPR Art. 18): Restrict how we process your data in specific circumstances.
• Right to Object (GDPR Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent: Withdraw any consent at any time; this won't affect prior lawful processing.
• CCPA Rights (California): Right to know, delete, and opt-out of sale of personal information (we never sell data).
• Indian IT Rules: Rights under the Information Technology (Amendment) Act 2008 and Digital Personal Data Protection Act 2023.

⏱️ 10. Data Retention

After retention periods expire, data is securely and irreversibly deleted or anonymized. We do not retain data longer than necessary.

🌍 11. International Data Transfers

Frendy is headquartered in Maharashtra, India. Your data may be processed in countries where our service providers operate, including India, the United States, and member states of the European Union.

When transferring personal data internationally, we ensure appropriate safeguards:

• EU Standard Contractual Clauses (SCCs) for transfers from the European Economic Area
• Data Processing Agreements with all third-party processors
• Compliance with the EU-U.S. Data Privacy Framework where applicable
• Compliance with India's Digital Personal Data Protection Act, 2023

📢 12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or features. When we make material changes:

• We will notify you via in-app notification and/or email at least 30 days before changes take effect.
• The "Last Updated" date at the top of this page will be revised.
• For significant changes that affect your fundamental rights, we will seek renewed consent.
• A version history of this policy is available upon request.

Continued use of Frendy after the effective date constitutes acceptance of the updated Privacy Policy.

📬 13. Contact Us & Data Protection Officer

If you are not satisfied with our response to a privacy complaint, you have the right to lodge a complaint with:

• India: The Data Protection Board of India (under DPDP Act 2023)
• EU/UK: Your local data protection supervisory authority
• USA (California): California Privacy Protection Agency (CPPA)