Flayr Privacy Policy

1. Introduction & Scope

Metamersist Technologies Pvt. Ltd. ("Metamersist," "we," "us," or "our") operates the Flayr mobile application (package ID: com.flayr.app, version 1.0.1). Flayr is a social nightlife and meetup app for friend groups currently operating in Pune and Mumbai, India.

This Privacy Policy explains what data we collect, why we collect it, who we share it with, and what rights you have over it. It applies to all users of the Flayr Android and iOS apps and any associated backend services we operate. By creating an account you agree to this policy. If you do not agree, please do not use the App.

2. Information We Collect

2.1 User Profile

• Mobile phone number (primary identifier, E.164 format)
• Full name and profile photo (JPEG/PNG/WebP/GIF, resized to 400×400 px)
• Bio (up to 160 characters) and city
• UPI ID (optional — used only for displaying peer-to-peer bill split details; never processed by us)
• Privacy level preference, notification preferences
• Expo push notification token, account creation and last login timestamps

2.2 Social Circles ("Chapters")

• Chapter name, emoji, type (e.g. college, work, hobby), and active years
• Member list — user IDs and nicknames within the circle

2.3 Signals (Hangout Invitations)

• Area and city of the planned hangout
• Scheduled date and time, and a free-text vibe note (up to 200 characters)
• Attendance responses (interested / maybe / unavailable) from invited members
• Check-in records — whether you attended, verified by QR/token scan at the venue (not by GPS tracking)

2.4 Venue Bookings

• Venue name, headcount, booking date, and special notes
• Estimated total and Razorpay order ID (created when payment is initiated)

2.5 Bill Splits

• Per-person amounts, settlement status and timestamps
• UPI payment reference — user-supplied proof of a manual payment; we record this string but do not process the payment ourselves

2.6 Memories

• Text note, photo, mood tag (e.g. "great," "fun"), and optional tagged friend for post-meetup memories

2.7 Contact Discovery

To help you find friends, the app can optionally hash your phone contacts on-device using SHA-256 before sending them to our server. The server compares these hashes against existing user accounts to identify mutual contacts. Raw contact data never leaves your device and is never stored by us — hashes are discarded immediately after the comparison.

2.8 Security & Administrative Data

• Refresh token hashes (bcrypt) for session management
• Rate-limit counters and OTP state (stored in Redis with automatic expiry)
• Audit log of admin actions affecting your account (actor, action, timestamp, IP, user agent)
• Suspension status, block list, and reports filed by or against your account

3. How We Use Your Information

• To authenticate you and manage your account and sessions securely
• To power core features: signals, chapters, venue discovery, bookings, bill splits, and memories
• To help you find friends from your contacts using privacy-preserving hashing
• To display venue locations on a map using geocoded venue addresses (not your GPS)
• To send push notifications about signals, RSVPs, and social updates within daily limits
• To process venue booking payments via Razorpay
• To detect and prevent fraud, abuse, and security incidents
• To track crashes and errors for stability improvements (via Sentry)
• To comply with applicable laws and respond to legal requests

4. Third-Party Services & Data Sharing

We use the following service providers, each receiving only the minimum data necessary for their function:

We do not sell, rent, or trade your personal data. We may disclose information if required by law, court order, or a government authority, or to protect the safety of our users.

5. Location Data

We do not track or store your real-time GPS location. Here is exactly how location is handled in each feature:

• Signals: You type or select a neighbourhood name from a list — this text string is stored, not your coordinates.
• Venue maps: Venue addresses are geocoded by Ola Maps to produce latitude/longitude for display. This is venue data, not your location.
• Near Me filter: Your device's GPS is used momentarily to reverse-geocode the nearest area name. This coordinate is never sent to our servers and is not stored.

6. Push Notifications

We send push notifications for: new signal alerts, friend RSVP updates, signal confirmations and expiry, memory prompts, reconnect nudges, and chapter membership updates.

• Hard cap: maximum 5 notifications per user per day
• Quiet hours: no notifications sent between 11:00 PM and 8:00 AM IST
• You can manage preferences in-app at Profile → Notifications, or through your device OS settings
• If your device token becomes invalid, we remove it from our servers automatically

7. Data Retention

• Active accounts: data is retained for as long as your account is active
• Deleted accounts: your account is soft-deleted and retained for 180 days to support account recovery by the original SIM holder; after 180 days the phone number slot is freed for re-registration
• OTP state: auto-expires after 5 minutes (Redis TTL)
• Rate-limit counters: auto-expire after 10–24 hours (Redis TTL)
• Refresh token records: auto-purged after 30 days
• Notification logs: retained for operational observability; no fixed purge schedule

8. Your Rights (DPDPA)

Under India's Digital Personal Data Protection Act (DPDPA), you have the following rights:

• Access: Download a full export of your data (profile, chapters, signals, bill splits, audit events) from the App or via /api/users/data-export
• Correction: Edit your name, bio, city, avatar, UPI ID, notification preferences, and privacy level directly in the App
• Deletion: Delete your account in-app; a 180-day recovery window applies before permanent erasure
• Withdraw consent: Turn off push notifications in-app (Profile → Notifications) or via your device OS settings at any time
• Grievance redressal: Contact our Grievance Officer at the address below

9. Children's Privacy

Flayr is intended exclusively for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has registered, we will promptly delete that account and all associated data.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date at the top of this page and, where changes are material, notify you via in-app notification or push alert. Continued use of the App after the updated policy takes effect constitutes your acceptance of the revised terms.

11. Contact Us

For privacy queries, data access or deletion requests, or any concerns about this policy, please contact our Grievance Officer: