Privacy Policy

Helogram is a hyperlocal social app for people aged 18 and over, run from India by Aniket Gaikwad ("Helogram", "we"). This policy explains what personal data we process when you use the Helogram app or website, and the choices and rights you have under India's Digital Personal Data Protection Act, 2023 and other applicable law.

The short version: we collect what we need to run a local social network, we never sell your data, we show no ads, and you can delete your account and data at any time.

What we collect

• Account details: your name, username, email address, optional mobile number, and a securely hashed password (or, if you sign in with Google or Apple, the name and email they share with us). We also record your date-of-birth check: we check that you are 18 or over, and we keep only the fact that you confirmed it, not the date itself.
• Profile: your photo, bio, and any business details you add (business name, category, address, opening hours, map image).
• What you post: posts, photos, videos, Beams (24-hour posts), comments, Hypes, hashtags, tags and mentions, and whom you follow.
• Messages and calls: the text, photos, videos, voice notes, documents and GIFs you send in chats, reactions, read receipts and online status. Calls connect your device directly to the other person's where possible; we do not record calls or store their audio or video.
• Location (only if you allow it): your device's location, used to find nearby posts, people and businesses, and the neighbourhood you choose. Your precise location is never shown to other people.
• Device and notification data: a push-notification token for your device, app version, device type and operating system, and technical error reports when something crashes.
• Usage and safety data: views, shares and Hypes on posts, visits to business profiles (for the business's insights), the reports and blocks you make, screenshots taken in chats (other people in the chat are told), and sign-in and security records such as login times.
• Support: anything you send us when you contact us.

Why we use it

We process your data on the basis of the consent you give when you accept these terms in the app, and where the law allows us to without consent -- for example to comply with a legal obligation or a court order. We use it to:

• create and secure your account, and keep you signed in;
• show your posts and profile to others, and show you what's happening near you;
• deliver messages, calls and notifications;
• give business accounts simple insights (views, directions and calls) about their own profile;
• keep Helogram safe: automatically screen photos and videos for nudity, sexual content and violence before they are published (and photos in chats, which are blurred rather than blocked), review reports, remove content that breaks our rules, stop spam and abuse, and investigate misuse;
• fix bugs and keep the service running; and
• meet our legal obligations, including responding to lawful requests from authorities.

We do not sell your personal data, we do not use it for advertising, and we do not build advertising profiles.

Who can see what

Other people can see your name, username, profile photo, bio and what you post, depending on your privacy settings (a private account's posts are visible only to approved followers). People you message see what you send them. Your email, phone number, date of birth and precise location are never shown to other users. Approximate distance to a business may be shown to you, worked out on our servers.

Who we share it with

We use a small number of service providers ("processors") who handle data only on our instructions and under their own security terms:

• Supabase (servers in Tokyo, Japan) -- our database, sign-in and real-time messaging.
• Cloudflare -- stores and delivers photos, videos, voice notes and files (R2), runs the automated safety check on uploaded images (Workers AI), and may relay call traffic when a direct connection isn't possible.
• Vercel -- hosts the Helogram website.
• Google -- Sign in with Google (only if you use it), Firebase Cloud Messaging to deliver push notifications, Gmail to send verification codes, and public STUN servers that help calls connect.
• Apple -- Sign in with Apple (only if you use it) and push delivery on iPhone.
• Expo -- delivers app updates to your device.
• OpenFreeMap and jsDelivr -- serve map tiles and the map library; like any website, they receive your IP address when your device loads them.

We may also disclose information when the law requires it -- for example to comply with a court order or a lawful request from a government agency -- or when needed to protect someone's safety. If Helogram is ever transferred to a new owner, your data would go with it under the same protections, and we would tell you first.

Where your data is stored

Your data is stored and processed outside India, mainly in Japan, and by providers with global networks. Indian law allows this, except to countries the Government of India restricts; we will move data if that ever applies to a country we use.

How long we keep it

• Your account, profile and content: until you delete them, or delete your account.
• Disappearing messages: removed automatically when their timer runs out.
• After you delete your account: your profile, posts, messages, media and settings are deleted straight away. As Indian law (the IT Rules, 2021) requires, we keep a minimal record of your registration details -- name, email, mobile number and sign-up date -- for 180 days, then erase it permanently. It is not linked to any content and not used for anything else.
• Reports and moderation decisions: as long as needed to keep Helogram safe and to answer appeals or legal requests.
• Error reports: only as long as needed to fix the problem.
• Anything the law requires us to keep longer, for as long as it requires.

Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• ask for a summary of the personal data we hold about you and how we use it;
• correct or update it (most of it you can edit yourself in Settings);
• erase it -- delete your account in Settings → Account, or see /legal/delete-account;
• withdraw your consent at any time (by deleting your account; we stop processing, except where the law requires us to keep something);
• nominate someone to exercise these rights for you if you die or become unable to; and
• complain to our Grievance Officer, and if you're not satisfied, to the Data Protection Board of India.

To use any of these rights, email aniketkumargaikwad@gmail.com from the address on your account. We reply within 30 days at most.

Children

Helogram is only for people aged 18 and over. Every account confirms its date of birth, and we do not knowingly process the personal data of anyone under 18. If we learn that an account belongs to someone under 18, we block and delete it.

Security

All traffic between your device and Helogram is encrypted (HTTPS/TLS), passwords are stored hashed, data is encrypted at rest by our providers, and access is limited to what's needed to run the service. Messages are protected in transit and on our servers but are not end-to-end encrypted, so treat chats accordingly. No system is perfectly secure; if a breach affects your personal data we will tell you and the Data Protection Board as the law requires.

Permissions and cookies

The app asks for a permission only when you use the feature that needs it, and works without it: location (nearby content), camera (photos, videos, QR codes), microphone (videos, voice notes and calls), photos and media (choosing photos and saving ones you take), files (sending documents) and notifications.

The website uses only the cookies needed to keep you signed in. It sets no advertising or tracking cookies.

Changes and contact

If we change this policy in a way that matters, we'll ask you to review and accept it in the app before you continue. Earlier versions are available on request.

Questions, requests or complaints: aniketkumargaikwad@gmail.com. Our Grievance Officer is Aniket Gaikwad -- see /legal/grievance.