Privacy Policy

Draft — pending legal review. This is a working draft. A lawyer will review it before ChaiPe launches, and the final text may change.

Effective date: 2026-10-05

This policy explains what personal data ChaiPe collects, why we collect it, who we share it with, how long we keep it, and how you stay in control. It is also our notice under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the DPDP Rules, 2025, and our privacy policy under the Information Technology Rules, 2021.

The short version#

• We collect what we need to run a safe dating app: your account details, your profile and photos, your chats, your approximate location (only if you allow it) and basic device data.
• We never sell your data. ChaiPe has no ads.
• Nobody on ChaiPe sees your exact location. Other people only see a rough distance such as "~3 km", or your city.
• After selfie verification we keep the result, not your selfie. We keep face data only if the consent screen tells you so, only to stop banned people from returning, and we delete it with your account.
• You can see, correct and delete your data, and withdraw consent, in the app or by email.
• Indian law makes us keep a small amount of data for a limited time after you delete your account. We tell you exactly what and for how long.

Contents#

1. Who we are
2. What this policy covers
3. Data we collect
4. Why we use your data
5. Consent and legal basis
6. What other people can see
7. Your location
8. Selfie verification and biometric data
9. Automated safety checks
10. Who we share data with
11. Service providers and where they are
12. Transfers outside India
13. How long we keep data
14. Deleting your account
15. Your rights
16. Withdrawing consent
17. Children
18. How we protect your data
19. Data breaches
20. Notifications and emails
21. Our website
22. Changes to this policy
23. Contact and grievances

Who we are#

ChaiPe is a dating app for adults in India, together with the website chaipe.app. ChaiPe is a product of Anvatrix, a sole proprietorship owned by Vipin Panchal.

• Address: 122, Vinayak Vihar, Ganathpura, Mansarovar, Vastu Nagar Phase 7, Jaipur, Rajasthan 302020, India
• Privacy questions: privacy@chaipe.app
• Grievance Officer: Vipin Panchal, grievance@chaipe.app

Under the DPDP Act we are the "Data Fiduciary" for the data described here. That means we decide why and how it is used, and we are responsible for it. In this policy, "ChaiPe", "we" and "us" mean Anvatrix, and "you" means anyone who uses ChaiPe or our website.

What this policy covers#

• The ChaiPe Android app, the website chaipe.app, and our support and grievance channels.
• ChaiPe is only for people aged 18 or over, and the app is offered in India.
• When we ask for consent for something specific (location, selfie verification, optional sensitive details, marketing messages), the app shows a short notice in English and Hindi first. Those notices are part of this policy.
• Google Play, Google Sign-In and Truecaller are separate services that you choose to use. Their own privacy policies apply to what they collect directly from you.

Data we collect#

We only ask for what we need. Items marked "optional" are up to you, and the app works without them.

Account and login

• Mobile number and name from Truecaller, only if you choose "Continue with Truecaller". Truecaller confirms the number belongs to you. We ask Truecaller only for your number and name, and you can edit the name. If you do not use Truecaller, we never ask for your phone number.
• Google account details, only if you choose "Continue with Google": your Google account ID, your email address and, if Google shares it, your name. We never get your Google password.
• We use the details from Truecaller and Google only to create your account, sign you in, keep your account secure and help you recover it. We do not use them for ads, and we do not sell them or share them except with the service providers listed below.
• Email address, if you sign in with email or add it for account recovery. We send one-time login codes to it. We store codes only in a scrambled (hashed) form and delete them after use.
• Date of birth, to confirm you are 18 or over. Other people see your age, never your date of birth.
• Login and session records: when you sign in or out, the device and app version used, and the IP address.

Your profile

• First name, gender, the genders you want to see, your intent (serious, open, casual or dosti), languages, city, prompts and answers, bio, and 2 to 6 photos.
• Optional details you choose to add, such as height, education, drinking, smoking, kids, exercise, star sign, relationship type and diet.
• Religion (optional). Only with your separate consent. You can remove it at any time.
• Sexual orientation (optional). Only if you choose to add it, with your separate consent. You can remove it at any time. The genders you want to see can also hint at your orientation, so we treat that setting with the same care: it is used only for matching and is never used for ads.
• Your preferences and filters, such as age range, distance, intent, languages and "only verified people can see me".

Verification

• A selfie with a random pose, if you choose to get verified. This is biometric data. See Selfie verification and biometric data.
• The verification result, its date and the method used.

What you do in the app

• Likes, passes, comments sent with likes, matches, unmatches, blocks, rewinds and reveals of who liked you.
• Messages in your chats, Chai Invite messages and your Chai Invite settings.
• Your settings, such as hide distance, snooze, notification choices and Spotlight use.

Safety and moderation

• Reports you make and reports made about you, with the reason given.
• A copy (snapshot) of the reported profile, photos or chat, kept as evidence.
• Moderation decisions, warnings, restrictions, bans and appeals.
• Fraud and abuse signals: Google Play Integrity results (whether the app and device look genuine), a flag on devices used by banned accounts, mock-location flags, rate-limit counters, and photo fingerprints that help us spot the same photo on many accounts.

Location (only if you allow it)

• Your approximate location, or the city you choose by hand. See Your location.

Device and technical data

• Device model, Android version, app version, language setting, push notification token and IP address.
• Crash reports from the app and error reports from our servers.
• The app does not ask for access to your contacts, SMS, call logs or your whole photo gallery. Android's photo picker shares only the photos you pick. The app does not use the Android advertising ID.

Purchases

• What you bought, the price, date, order ID and purchase token, and the status of your subscription (renewed, cancelled, paused, refunded). We get this from Google Play and RevenueCat.
• We never see your card, UPI or bank details. Google Play handles the payment.

Support, grievances and website forms

• What you send us when you contact support, raise a grievance or use a form on chaipe.app: for example your name, email, phone number (if you give it), your message and your ticket number.

Why we use your data#

What we never do:

• Sell or rent your personal data, or give it to data brokers.
• Show ads, or use your data to target ads.
• Use your location, selfie or sensitive details for anything other than the purposes stated here.
• Use face data to decide who gets offers, rewards or refunds.

Consent and legal basis#

Consent. For most of what we do, we rely on your consent under section 6 of the DPDP Act. During sign-up we show a separate consent screen. Nothing is pre-ticked, and going back or tapping outside never counts as a yes. We ask for separate consent for:

1. the core account processing described in this policy;
2. approximate location;
3. selfie verification (biometric data);
4. optional sensitive details, such as sexual orientation and religion;
5. marketing messages.

We keep a record of what you agreed to, the notice version and when, so we can prove it.

Without consent, where the law allows. In some cases the DPDP Act lets us process or keep data without your consent. For example:

• to handle a grievance, deletion request or support message you send us, using the details you choose to give us for that purpose (section 7(a)). This also applies if you use a form on chaipe.app without having a ChaiPe account;
• to comply with a court judgment or order, or a legal duty to give information to the government (section 7);
• to respond to a medical emergency that threatens the life or health of you or someone else (section 7);
• to keep records that a law requires us to keep, even after you withdraw consent or delete your account, such as the records described in How long we keep data (sections 8(7) and 12(3)).

Languages. Our consent notices are available in English and Hindi. If you need this notice in another language listed in the Eighth Schedule to the Constitution, write to privacy@chaipe.app and we will help.

What other people can see#

Other ChaiPe users can see:

• your first name, age, photos, prompts and bio, intent, languages and the optional details you chose to show;
• your city, or a rough distance label such as "~3 km". The smallest label is "~2 km";
• your Verified badge, if you have one;
• "Travelling to" a city, if you use Travel mode;
• comments you send with a like, and Chai Invites you send, to the person who receives them;
• your messages, to the person you are chatting with.

Other users can never see your phone number, email address, date of birth, exact location or exact distance, your selfie, or reports you have made.

You can limit what people see:

• Hide my distance: people see only your city.
• Only verified people can see me: unverified accounts do not see you.
• Snooze or hide your profile from Discover.
• Unmatch: the chat is removed for both of you. A copy is kept only if it was reported (see How long we keep data).

ChaiPe blocks screenshots on profile and chat screens, but someone can still photograph their screen with another device. Share personal details carefully.

Your location#

What we collect. Your approximate location, using Android's "approximate location" permission. We collect it only while the app is open, never in the background, and never your precise GPS location. Our server rounds ("snaps") the point to a grid of about 1 km, or about 2 km if you turn on Hide my distance, and throws the original away straight away.

Why. To show rough distances, to check whether ChaiPe is live in your city, and to catch fake or spoofed locations. Location is never used for ads, analytics or sale.

What others see. A distance label such as "~2 km", "~3 km", "~15 km" or "25+ km", or only your city. Never coordinates, a pin or an address. After you match, the label is frozen at the moment of the match. In someone's likes list, the label changes at most once a day.

What we keep. Only your latest rounded point. Each update replaces the one before, so there is no location history. Our database backups leave this data out. Our hosting provider takes whole-server snapshots for disaster recovery; a snapshot can contain the latest point that existed at that moment. Snapshots are not used for anything else and are replaced as newer ones are taken. Our request logs record that the app updated its location, but not the coordinates. Our crash and error reports are set up to leave location out.

When we delete it. Straight away when you tap Settings › Location › Stop using my location or delete your account. If you turn off the permission in Android settings instead, we delete it the next time you open ChaiPe. We also delete it after 30 days in which you have not opened the app. If you are outside a city where ChaiPe is live, we keep only your city, not a point.

Without location. You can choose your city by hand instead. People then see you as being in that city, and everything else works.

Fake locations. If your device reports a mock location, we do not use that point and may flag the account for review. We never ban anyone on that signal alone.

Travel mode (a paid feature, when available) places you at the centre of a city you pick from our list. It does not use your real location and ends automatically after 7 days.

Selfie verification and biometric data#

Getting verified is your choice. You can browse without it, but you need to be verified to like people. Before the camera opens, we ask for your separate, explicit consent.

How it works. You take a selfie copying a random pose. Our software, running on our own servers, checks that the selfie is of a live person and compares your face with the faces in your profile photos. A member of our team may look at borderline cases. Your selfie is not sent to an outside verification company.

What we keep.

• The result (verified or not), the date and the method.
• Your selfie is deleted as soon as a decision is made. If a person needs to review it, we keep it until the review is done, and never for more than 30 days.
• Face template, only if the consent screen says so. By default we keep no face data. If we turn on ban-evasion checks, we keep an encrypted face template (a set of numbers describing facial features, not a photo). It is used only to stop people banned from ChaiPe from creating new accounts. It is never used for ads, offers, refunds or anything else. If this applies, the consent screen tells you before you take the selfie.

Deleting it. You can remove your verification in Settings. We then delete your verification data, and you lose the Verified badge and the ability to like until you verify again. When your account is deleted, for any reason, your face template is deleted too. To keep a banned person from returning after that, we rely on the ban records described in How long we keep data, which never include face data.

Automated safety checks#

Some checks run automatically so we can keep ChaiPe safe without staff reading your messages.

• Photos are checked for nudity, and compared against fingerprints of other photos on ChaiPe, before other people can see them. Some photos are checked by a person. Your main photo may also be checked with Google Cloud Vision to catch stolen or stock photos found elsewhere on the web.
• Text in Chai Invites, comments and the early part of a new chat (roughly the first day or first 10 messages) is checked automatically for phone numbers, UPI IDs, links, social media handles and common scam or abuse words. We may show a warning, remove contact details from a Chai Invite, or block the message. The first Chai Invite each person sends is reviewed by our team.
• Account signals, such as unusually fast swiping, the same message sent to many people, or many reports, help us spot spam and fake accounts.

Our team does not read chats as a routine. A person looks at chat content only when it is reported, flagged by an automated check, or when the law requires it.

Automated checks can hide content or restrict an account for a short time until someone reviews it. A permanent ban is always reviewed by a person, and you can appeal (see our Community Guidelines).

Who we share data with#

• Other users, as described in What other people can see.
• Service providers who help us run ChaiPe. They act on our instructions under contract and may not use your data for their own purposes. They are listed in the next section.
• Google Play, Google Sign-In and Truecaller, when you choose to use them. They also handle some data on their own account (for example, Google processes your payment), under their own privacy policies.
• Police, courts and government authorities, when Indian law requires it. For example: a lawful order, a request under Rule 3(1)(j) of the IT Rules, 2021, a report of child sexual abuse material under the POCSO Act, or a cyber security incident report to CERT-In. We also share information with emergency services when it is needed to respond to an emergency that threatens someone's life or health. We check that each request is lawful and share only what is needed.
• A successor business. If ChaiPe moves to a company (for example, if Anvatrix becomes a company) or is sold, your data moves with it and this policy continues to protect it. We will tell you before that happens, and you can delete your account if you do not want your data to move.

We do not sell your data, and we do not share it with advertisers or data brokers.

Service providers and where they are#

If we add or change a provider, we will update this list.

Transfers outside India#

Our main database and servers are in India. Some of the providers above process data outside India. Section 16 of the DPDP Act allows this, except to countries that the Government of India restricts. If a country is restricted, we will stop sending data there. We keep transfers small: for example, push notifications never contain message text, and error reports leave out request contents and location.

How long we keep data#

We keep data only as long as we need it, or as long as the law requires.

Backups are encrypted and expire automatically on a rolling schedule. Something you delete can stay in an encrypted backup until that backup expires. If we ever have to restore a backup, we apply all deletions again before the data is used.

If you do not use ChaiPe for a long time, we may hide your profile from Discover. We may also delete a long-inactive account, after warning you at least 48 hours in advance.

Deleting your account#

You can delete your account at any time:

• In the app: Settings › Account › Delete account.
• On the web: chaipe.app/delete-account. We first confirm that the request really comes from you.

What happens straight away. Your profile disappears for everyone, you are signed out on every device, and your location is deleted.

What we then remove. Your photos, prompts, preferences, likes, matches, chats, selfie-verification data (including any face template) and push tokens are deleted from our live systems. Your messages stop being visible to the people you chatted with.

What we keep for a limited time. Registration information (180 days), reported content and evidence (180 days), logs (at least one year), ban records and purchase and tax records, each as set out in How long we keep data. After that it is deleted.

Subscriptions. Deleting your account does not cancel a Google Play subscription. The app warns you if a subscription is still active and gives you a link to cancel it. Unused credits are lost when you delete your account. See our Refund Policy.

Deleting an account cannot be undone. If you come back later, you will need to create a new account.

Your rights#

Under the DPDP Act you have the right to:

• Access: get a summary of your personal data, what we do with it, and who we have shared it with.
• Correction: correct, complete or update your data. You can edit most of it yourself in the app.
• Erasure: ask us to delete your data. We will, except what the law requires us to keep (see How long we keep data).
• Withdraw consent at any time, as easily as you gave it (see Withdrawing consent).
• Nomination: name another person who can use these rights for you if you die or become unable to act. Email us with their name and contact details.
• Grievance redressal: complain to us, and then to the Data Protection Board of India (see Contact and grievances).

How to use your rights. In the app, go to Settings › Privacy. Or email privacy@chaipe.app from the email address linked to your account. We may ask you to confirm your identity first, so that nobody else can get your data. We acknowledge every request within 24 hours, and aim to complete it within 7 days. We will always respond within the time the DPDP Rules allow (no more than 90 days).

Your duties. Section 15 of the DPDP Act also asks you not to impersonate anyone when you give your personal data, to give only authentic information when you ask for a correction or erasure, and not to file false or frivolous complaints.

Withdrawing consent#

Withdrawing consent does not affect what we did lawfully before you withdrew it.

Children#

ChaiPe is only for adults aged 18 or over.

• We ask for your date of birth at sign-up and block anyone under 18. You cannot try again with a different date, and the device is blocked from signing up.
• On Google Play, ChaiPe is listed for adults only, and Google's "Restrict Minor Access" setting is on.
• Anyone can report a profile as "may be under 18". The account is suspended straight away while we check.
• If we find that an account belongs to someone under 18, we hide the profile, delete the location, and remove the account. We keep only what we need to stop the person from signing up again, and any evidence the law requires us to keep.
• We never track or monitor the behaviour of children, and we never target them with ads.

Read our Child Safety Standards.

How we protect your data#

We use reasonable security safeguards, including:

• encryption in transit (HTTPS) for all traffic between the app, our website and our servers;
• encryption at rest for the most sensitive data, such as face templates and backups;
• private photo storage. Photos are shown through short-lived links, and location data (EXIF and GPS) is removed from every photo you upload;
• strict access control: only people who need data for their work can access it, our admin tools sit behind extra access protection, and admin actions are logged;
• scrambled (hashed) one-time codes, sign-in tokens that change regularly, and rate limits against abuse;
• monitoring and logs to detect and investigate attacks, and encrypted backups kept in separate storage.

No system is perfectly secure. If you find a security problem, please tell us at support@chaipe.app.

Data breaches#

If a personal data breach happens, we will:

• tell affected users without delay, in the app or by email, explaining what happened, what it may mean for you, what we are doing about it and what you can do to protect yourself;
• tell the Data Protection Board of India without delay, and send it a detailed report within 72 hours, as the DPDP Rules require;
• report the incident to CERT-In within 6 hours, as Indian cyber security rules require.

Notifications and emails#

• Service messages are part of using ChaiPe: login codes, security alerts, reminders before a subscription renews, refund updates, changes to our terms or policies, and periodic reminders of our rules (which the IT Rules require us to send).
• Push notifications never show who sent a message or what it says. They say only something like "New message" or "New match".
• Marketing messages are sent only if you opt in, and you can opt out at any time.

Our website#

• chaipe.app does not use advertising, analytics or tracking cookies. Cloudflare, which protects the site, may set cookies that are strictly needed for security.
• Cloudflare processes your IP address and basic request details (browser type, the page requested and the time) to deliver and protect the site. Our own web server logs keep only a shortened IP address, never the full one.
• The delete-account and grievance forms collect only what you type in. To limit abuse of the forms, we keep a scrambled (hashed) form of your IP address with your request, not the address itself. On the delete-account form, we keep your email address and phone number only in scrambled (hashed) form, used to find your account.

Changes to this policy#

We will update this policy when our app, our providers or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it takes effect and, where the law requires it, ask for your consent again.

Contact and grievances#

Grievance Officer (also our contact person for questions about your personal data):

• Name: Vipin Panchal
• Privacy and data rights: privacy@chaipe.app
• Complaints: grievance@chaipe.app
• Post: Anvatrix, 122, Vinayak Vihar, Ganathpura, Mansarovar, Vastu Nagar Phase 7, Jaipur, Rajasthan 302020, India
• In the app: Settings › Help › Raise a grievance
• On the web: chaipe.app/grievance

We acknowledge every grievance within 24 hours and resolve it within 7 days. Read our Grievance Policy for details.

If you are not satisfied with how we handled a complaint about your personal data, you can complain to the Data Protection Board of India under the DPDP Act, after using our grievance process (section 13(3)). The Board works as a digital office (section 28), so you can file your complaint with it online. For decisions about content, you can also appeal to the Grievance Appellate Committee at gac.gov.in within 30 days.

Questions about this page? Email support@chaipe.app. Complaints go to our Grievance Officer.