Privacy Policy

Effective Date: 7th March, 2026  |  Version 1.0.0

1. Introduction & Scope

Zunii ("the App," "we," "us," or "our") is a social communication application that connects users with new people through random matching. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and how you can exercise your rights.

We are operated by Abhishek Olkha, residing at Inderpura, Udaipurwati, Jhunjhunu, Rajasthan 333307, India. Abhishek Olkha is the data controller responsible for your personal data.

This Policy applies to all Users of the Service, regardless of how you access or use it. By creating an account or using Zunii, you acknowledge that you have read, understood, and agree to the data practices described in this Policy. If you do not agree with our practices, please do not use the App.

This Policy should be read in conjunction with our Terms of Service and Community Guidelines, which are incorporated herein by reference.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Subscription & Purchase Data

We do NOT store your credit card number, bank account details, or other payment instrument data. All payment processing is handled by Google Play (Android) or the Apple App Store (iOS), and subscription management is handled by RevenueCat. We only receive purchase confirmation records.

2.4 Information from Third Parties

When you authenticate using Apple Sign-In or Google Sign-In, we receive the following from the respective provider:

• Basic profile information (name, email address);
• Authentication tokens; and
• Unique account identifiers.

We do not request or receive access to your contacts, photos, calendar, or other data from these providers beyond what is strictly necessary for authentication.

2.5 Information Stored Locally on Your Device

To improve performance and enable offline access, the App stores the following data locally on your device:

• Chat metadata and recent messages (for instant loading);
• Cached peer profile information (name, initials, avatar — refreshed every 24 hours);
• Sync state data (to minimise network usage);
• Credit balances and ad cooldown timestamps (for monetisation features);
• Authentication preferences (e.g., saved email for "Remember Me" if enabled by you); and
• A local database cache maintained by Firebase Firestore for offline access, which may temporarily contain data from active chats and connections. This cache is cleared when you sign out.

Local data is stored in standard device storage and protected by your device's own security features (device encryption, screen lock). We do not apply additional application-level encryption to locally cached data. This local data is permanently deleted when you sign out or delete your Account.

2.6 Information We Do NOT Collect

• Precise GPS or geolocation data;
• Contacts or address book data;
• Photos or media library (beyond images you actively choose to share in chats or set as your profile picture);
• Biometric data;
• Credit card numbers, bank account details, or payment instrument data (payments processed by Google Play / Apple App Store);
• Health, political, or religious data (unless you voluntarily share it in chat — we discourage this); or
• Data from other apps on your device.

3. How We Use Your Information

3.1 Providing & Operating the Service

• Create, authenticate, and manage your Account;
• Match you with other Users based on your selected preferences (age, gender, country) using our tiered matching pools (country → region → global);
• Enable real-time communication between matched Users via our regional chat servers;
• Display your initials and, at your discretion, your name and photo to matched Users;
• Manage Connections, chat history, and connection expiry;
• Process and deliver subscription entitlements (premium features);
• Manage credits earned through rewarded advertisements (boost, filter, daily extension credits);
• Apply your privacy preferences (Ghost Mode, auto-delete settings); and
• Process Account deletion requests.

3.2 Advertising

• Serve opt-in rewarded video advertisements through Google AdMob when you voluntarily choose to watch them;
• Measure ad performance (impressions, completions); and
• Grant credits to your account upon successful ad completion.

Rewarded ads are always voluntary. You are never required to watch an ad to access core app functionality. You choose to watch ads to earn credits for enhanced features (priority matching, filter unlocks, or additional daily matches).

3.3 Subscription Management

• Process and verify subscription purchases via RevenueCat;
• Deliver premium features (increased daily matches, additional connections, priority matching, unlimited filters);
• Handle subscription lifecycle events (renewal, cancellation, expiration, billing issues); and
• Manage grace periods for billing issues.

3.4 Safety, Security & Integrity

• Review and act on User reports of Terms and Community Guidelines violations;
• Apply automated moderation actions (warnings, cooldowns, suspensions) based on report severity and frequency;
• Detect, investigate, and prevent fraud, abuse, and unauthorized access;
• Rate-limit actions to prevent spam and abuse;
• Enforce our Terms of Service and Community Guidelines;
• Protect the rights, safety, and property of our Users and the public;
• Respond to legal requests and comply with applicable law; and
• Detect, report, and remove Child Sexual Abuse Material (CSAM) in compliance with applicable laws, including reporting to NCMEC.

3.5 Service Improvement & Analytics

• Analyse aggregated usage patterns and trends using Firebase Analytics;
• Manage feature availability and configuration using Firebase Remote Config;
• Develop, test, and deploy new features; and
• Diagnose and resolve technical issues.

3.6 Communications

• Send push notifications for new messages, connection requests, and chat events via Firebase Cloud Messaging;
• Send Service-related communications (Account verification, security alerts);
• Respond to your support requests and feedback; and
• Notify you of material changes to our Terms, Privacy Policy, or Community Guidelines.

4. How We Share Your Information

4.1 With Other Users

4.2 With Service Providers

We share data with third-party service providers who process data on our behalf under contractual obligations to protect your data. See Section 5 for the full list.

4.3 For Legal Reasons

We may disclose your data to law enforcement, regulators, or other authorities where required by law, court order, or to protect the safety of our users and the public. This includes:

• Comply with applicable law, regulation, legal process, or enforceable governmental request;
• Respond to valid subpoenas, court orders, or other legal process;
• Protect the safety, rights, or property of Zunii, our Users, or the public;
• Investigate, prevent, or take action regarding violations of our Terms or applicable law;
• Report child exploitation material to NCMEC and law enforcement; and
• Respond to emergencies involving danger of death or serious injury.

4.4 We Do Not Sell Your Data

We do not sell your personal data to third parties. We do share advertising identifiers with ad partners for the purpose of serving rewarded video ads — see Section 5 and Section 8.5 for opt-out options.

4.5 Business Transfers

In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of assets, your personal information may be transferred. We will notify you via in-app notification and/or email before your information becomes subject to a different privacy policy. Your data will continue to be protected under substantially similar privacy terms.

4.6 Aggregated & De-Identified Data

We may share aggregated, de-identified, or anonymised information that cannot reasonably identify you for analytics, research, or business purposes.

5. Third-Party Services

We use the following third-party service providers. Each processes data subject to its own privacy policy. All third-party service providers listed below are bound by Data Processing Agreements (DPAs) that require them to process your data only as instructed by us and to implement appropriate technical and organisational security measures.

6. Data Retention & Deletion

6.1 Retention Schedule

6.2 Account Auto-Delete

You may choose an auto-delete period of 30, 60, or 90 days (default: 90 days). If you do not open the App for your chosen period, your Account and all associated data will be automatically and permanently deleted. You will receive a warning when your Account approaches the danger zone (25% of your chosen period remaining). Opening the App renews your lease.

6.3 Connection Auto-Expiry

Connections automatically expire after 90 days of inactivity (no messages sent). You will receive a warning when a Connection has 20 or fewer days remaining. Sending a message renews the Connection lease.

6.4 Account Deletion

You can delete your account at any time through the App (Settings → Privacy & Security → Delete Account), our website at zunii.app/account/delete, or by emailing support@zunii.app. When you delete your Account, we permanently and irreversibly remove:

• Your profile information (name, photo, age, gender, country);
• Your authentication credentials and tokens;
• All chat history (random and Connection chats) and messages;
• All images (profile and chat images from Cloudflare R2 and Firebase Storage);
• Your Connections list;
• Your block list;
• Your reports (as the reporting User);
• Your subscription records and credits;
• Your push notification tokens;
• All real-time database records (inbox, presence, matching data, usage data, rate limits); and
• All local device data (SQLite database permanently deleted).

6.5 Deletion for Suspended or Restricted Accounts

7. Data Security

We implement industry-standard technical and organisational measures designed to protect your personal information.

7.1 Technical Safeguards

• Encryption in Transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at Rest (Server-Side): Data stored on our servers (Firebase, Cloudflare) is encrypted at rest by our infrastructure providers using AES-256 or equivalent.
• Local Device Storage: Data cached on your device is stored in standard device storage and protected by your device's own security features (device encryption, screen lock). We do not apply additional application-level encryption to locally cached data.
• Secure Authentication: Passwords are hashed using industry-standard algorithms. OAuth 2.0 protocols with secure token management; token revocation on Account deletion.
• Access Controls: Role-based access with principle of least privilege. Access to user data is restricted to authorised personnel and services.
• Rate Limiting: API endpoints are rate-limited to prevent abuse.
• Image Security: Shared images are accessible via randomised URLs that are not guessable. Chat images are automatically deleted from our servers within 24 hours.
• Infrastructure Security: Firebase (SOC 2 Type II, ISO 27001) and Cloudflare maintain industry certifications.
• Multi-Region Architecture: Chat data is routed to the nearest regional server (Americas, Asia-Pacific, or Europe) for performance and data proximity.
• Screen Protection: The App includes screenshot prevention on Android and screen blur on iOS app switching to protect chat content.

7.2 Organisational Safeguards

• Regular security assessments and vulnerability testing;
• Documented incident response procedures;
• Data Processing Agreements with all sub-processors; and
• Regular review and update of security policies.

8. Your Rights & Choices

Depending on your jurisdiction, you have the following rights. We respond to valid requests within 30 days (45 days for complex requests).

8.1 Account Deletion

Delete your Account via the App (Profile → Delete Account), our web deletion page, or by emailing support@zunii.app. If your Account is suspended or in a cooldown period, you may still request data deletion by emailing privacy@zunii.app (see Section 6.5).

8.2 Data Access, Correction & Portability

View and update your profile directly in the App (Profile → Edit Profile). Request a copy of all data we hold, or a copy in a structured, machine-readable format (data portability), by contacting privacy@zunii.app. We will fulfil portability requests within 30 days.

8.3 Ghost Mode (Activity Status)

You can control your activity visibility in Settings → Privacy & Security:

• Show Activity Status: Toggle off to appear offline to all connections (Ghost Mode). When Ghost Mode is enabled, you also cannot see others' activity status.
• Show Last Seen: Toggle off to hide your last seen timestamp from connections.

8.4 Blocking

You can block any User from their profile or during a chat. Blocked users cannot match with you or contact you. You can manage your blocked list in Settings → Privacy & Security → Blocked Users.

8.5 Advertising Controls

• Rewarded ads are opt-in: You are never required to watch an advertisement. You choose when to watch a rewarded ad to earn credits.
• iOS (IDFA): We request your permission via Apple's App Tracking Transparency framework before accessing your IDFA. You can change this in iOS Settings → Zunii → Tracking, or your device's Settings → Privacy & Security → Tracking.
• Android (AAID): You can opt out of interest-based advertising or reset your Advertising ID in Settings → Privacy → Ads (or Settings → Google → Ads).
• We honour the Global Privacy Control (GPC) signal.

8.6 Analytics Opt-Out

You can opt out of analytics data collection by contacting privacy@zunii.app. When you opt out, we disable analytics and crash reporting data collection for your account.

8.7 Remember Me

If you enable "Remember Me" on the login screen, your email address is stored locally on your device for convenience. This data is cleared when you sign out or delete your account.

8.8 Restriction & Objection

Request restriction of processing or object to processing based on legitimate interests. Contact us at privacy@zunii.app to exercise these rights.

8.9 Withdrawal of Consent

You may withdraw consent at any time through the App's Settings → Privacy, by deleting your account, or by contacting privacy@zunii.app. Withdrawal does not affect the lawfulness of prior processing.

8.10 Non-Discrimination

We will not discriminate against you for exercising any privacy rights.

8.11 In-App Controls Summary

• Ghost Mode: Hide your online status and last seen from all users (Settings → Privacy);
• Auto-Delete Period: Choose 30, 60, or 90 days of inactivity before Account auto-deletion (Settings → Account);
• Ad Personalization: Reset or limit your advertising identifier in your device settings;
• App Tracking Transparency (iOS): When prompted, choose whether to allow tracking. You can change this in iOS Settings → Zunii;
• Push Notifications: Manage via App settings or device settings;
• Name & Photo Sharing: Control sharing in each individual chat;
• Matching Preferences: Control your matching filters; and
• Blocking: Block any User at any time.

9. Children's Privacy

10. International Data Transfers

Zunii operates globally. Your data may be transferred to and processed in countries other than your own. Specifically:

• India — where our operations and data controller are based;
• United States — Firebase infrastructure and Americas chat shard;
• Europe (Belgium) — European chat shard (europe-west1);
• Singapore — Asia-Pacific chat shard (asia-southeast1); and
• Global — Cloudflare edge network nodes.

Our infrastructure uses regional routing:

• Americas shard: United States (serves North America, South America)
• Europe shard: European Union / Belgium (serves Europe, Middle East, Africa)
• Asia-Pacific shard: Singapore/India (serves Asia-Pacific)

Cross-Region Matching: When users from different regions are matched, chat data is routed to our Americas shard (United States). This means if you are in the EU and are matched with a user outside the EU, your chat data for that conversation will be processed on US-based servers.

Chat messages between Users in the same region are processed on the regional shard (e.g., EU users chatting together use the European shard).

Safeguards for international transfers include:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• UK International Data Transfer Agreement (IDTA) where applicable;
• Data Processing Agreements with all sub-processors;
• Reliance on infrastructure providers' certifications (Google Cloud SOC 2, ISO 27001, EU-US Data Privacy Framework); and
• Encryption in transit and at rest.

11. Cookies and Tracking Technologies

As a mobile application, Zunii does not use browser cookies. We use the following technologies:

• Device Identifiers: IDFV (iOS) and Android ID for Account security, fraud prevention, and single-Account enforcement.
• Advertising Identifiers: AAID (Android) and IDFA (iOS) are used by Google AdMob to serve and measure rewarded video advertisements. On iOS, the IDFA is only accessed after you grant permission via the App Tracking Transparency (ATT) prompt. On Android, you can reset or opt out of personalised ads in your device settings.
• Firebase Analytics: Collects anonymised, aggregated usage data to improve the Service. Does not track you across other apps or websites.
• Firebase Remote Config: Delivers feature flags and configuration values. Collects app instance identifiers.
• Push Notification Tokens: FCM tokens for push notification delivery, deleted on Account deletion or logout.

We do NOT:

• Link your advertising identifier to personally identifiable information;
• Use your advertising identifier for interest-based or behavioural advertising across apps;
• Share your advertising identifier with data brokers or third parties for their own purposes; or
• Reconnect data to a reset advertising identifier.

We honour the "Opt out of Interest-Based Advertising" and "Limit Ad Tracking" settings on your device, and the Global Privacy Control (GPC) signal.

Our website (zunii.app) uses only essential cookies strictly necessary for functionality. We do not use advertising, analytics, or third-party tracking cookies on our website.

12. Region-Specific Disclosures

12.1 European Economic Area, United Kingdom, and Switzerland (GDPR / UK GDPR)

EU and UK Representative

Legal Bases for Processing

Where we rely on legitimate interests, we have conducted a balancing assessment to ensure your rights and interests do not override our legitimate interests. We have also conducted Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in high risk to individuals, including our matching system and content moderation processes. You may contact us to request details of these assessments.

Your GDPR Rights

If you are in the EEA, UK, or Switzerland, you have the following rights:

• Access (Art. 15): Request a copy of your data.
• Rectification (Art. 16): Correct inaccurate data.
• Erasure (Art. 17): Request deletion of your data. This right may be exercised at any time, including if your Account is suspended or restricted (see Section 6.5).
• Restriction (Art. 18): Restrict how we process your data.
• Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• Automated Decisions (Art. 22): You have the right not to be subject to decisions based solely on automated processing that produce legal effects. Contact us if you believe an automated decision was made in error.
• Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting prior lawful processing.
• Lodge a Complaint: With your national supervisory authority (e.g., ICO in the UK, CNIL in France, DPC in Ireland).

Automated Decision-Making

Matching: Our matching system uses automated processes to connect Users based on preferences and availability. This does not produce legal or similarly significant effects.

Safety Enforcement: Our systems may automatically apply temporary restrictions (warnings, cooldowns of 30 minutes to 6 hours, or suspensions) based on the number and severity of reports. These actions are subject to human review. Appeal at appeals@zunii.app.

Special Category Data

We do not intentionally collect special category data (health, religion, political opinions, sexual orientation, etc.). If you voluntarily share such information in chats, it is processed only for content delivery and moderation. We strongly discourage sharing such information.

UK Online Safety Act

We operate in-app report and block functions, content moderation processes, and remove illegal content as defined under UK law.

Breach Notification

In the event of a personal data breach likely to result in risk to your rights and freedoms:

• We notify the relevant supervisory authority within 72 hours (GDPR, DPDPA);
• We notify affected Users without undue delay where the breach poses high risk;
• We document the breach and remediation measures; and
• We take immediate steps to contain, investigate, and remediate.

Data Protection Contact

Contact: privacy@zunii.app. Response within 30 days (extendable by 60 days for complex requests).

12.2 United States

COPPA (Children Under 13)

Our App is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will delete it immediately. Contact privacy@zunii.app if you believe we have collected such information.

California (CCPA / CPRA)

If you are a California resident, you have the following rights:

• Right to Know: Request disclosure of categories and specific pieces of personal information collected, sources, purposes, and parties we share it with.
• Right to Delete: Request deletion of your personal information.
• Right to Correct: Request correction of inaccurate information.
• Right to Opt-Out of Sale or Sharing: We do not sell personal information. We share advertising identifiers with ad partners — to opt out, use your device's "Limit Ad Tracking" setting or contact us. We honour the Global Privacy Control (GPC) signal.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those disclosed.
• Right of Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories Collected (Last 12 Months)

*Advertising identifiers and device information are shared with Google AdMob solely to serve rewarded ads you voluntarily choose to watch. This is not "sharing" for cross-context behavioral advertising as defined by CPRA.

To submit a request: privacy@zunii.app. We will verify your identity before processing.

Other US State Privacy Laws

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Montana, Texas, Oregon, Kentucky, Indiana, Rhode Island, Delaware, Iowa, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, Tennessee, and others — including those effective 2025–2026) have the right to access, correct, delete, and obtain a portable copy of their personal data; opt out of targeted advertising; and opt out of the sale of personal data. We honour the Global Privacy Control (GPC) signal. To exercise these rights, contact privacy@zunii.app.

12.3 India (DPDP Act 2023 / DPDP Rules 2025)

Data Processing Notice

This section constitutes a Data Processing Notice as required under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and DPDP Rules, 2025.

Data Fiduciary: Abhishek Olkha, Inderpura, Udaipurwati, Jhunjhunu, Rajasthan 333307, India. Email: privacy@zunii.app

See Section 2 for the itemised list of personal data collected and its purposes.

How to withdraw consent: Through the App's Settings → Privacy, by deleting your account, or by contacting privacy@zunii.app. Withdrawal does not affect processing already carried out.

How to complain: You may file a complaint with the Data Protection Board of India at dpboard.gov.in once operational.

Your Rights (India)

• Right to Access: Obtain a summary of your personal data and processing activities.
• Right to Correction and Erasure: Request correction or deletion of your data.
• Right to Grievance Redressal: Raise grievances with our Grievance Officer.
• Right to Nominate: Nominate a person to exercise your rights in case of death or incapacity.

Grievance Officer (India)

In accordance with the DPDP Act and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

The Grievance Officer will acknowledge your complaint within 24 hours and resolve it within 15 days.

Children's Data (India)

Under the DPDP Act, anyone under 18 is a child. We do not knowingly collect data from users under 18 in India. We do not serve targeted advertising to any user.

IT Rules Compliance

We comply with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, including publishing these terms, providing grievance mechanisms, and acting on unlawful content within 24 hours of receiving a valid government order.

12.4 Australia

We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), and the Online Safety Amendment (Social Media Minimum Age) Act 2024. Minimum age for Australian users: 16 years. Users under 16 are not permitted to create or maintain an account. We employ age verification measures during registration, including date of birth verification, and reserve the right to require additional age verification at any time. Any data collected for age verification is used solely for that purpose and deleted promptly after verification. We take reasonable steps to ensure overseas recipients handle your data consistently with the APPs. You have the right to access and correct your personal information. Complaints: contact us first at privacy@zunii.app, then the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12.5 Brazil (LGPD)

If you are in Brazil, your data is processed in accordance with the Lei Geral de Proteção de Dados (LGPD — Law No. 13.709/2018). You have the right to confirm processing, access, correct, anonymise, delete, or port your data; withdraw consent; and lodge a complaint with the ANPD at gov.br/anpd.

Data Protection Officer (Encarregado): Abhishek Olkha
Email: privacy@zunii.app

12.6 South Africa (POPIA)

If you are in South Africa, your data is processed under the Protection of Personal Information Act (POPIA). You may access, correct, delete, or object to processing. Lodge complaints with the Information Regulator at inforegulator.org.za.

Responsible Party & Information Officer: Abhishek Olkha
Email: privacy@zunii.app

12.7 Kenya (Data Protection Act 2019)

If you are in Kenya, your data is processed under the Data Protection Act, 2019. We are registered with the ODPC. You may access, rectify, object to, restrict, or delete your data. Lodge complaints with the ODPC at odpc.go.ke.

12.8 Canada (PIPEDA)

If you are in Canada, your data is handled under PIPEDA and applicable provincial laws. You have the right to access and correct your personal information. Complaints may be directed to the Office of the Privacy Commissioner at priv.gc.ca. Contact our Privacy Officer first at privacy@zunii.app.

12.9 Japan (APPI)

If you are in Japan, your data is handled under the Act on the Protection of Personal Information (APPI). We use your data only for purposes described in this Policy and will not provide it to third parties without consent, except as required by law. Cross-border transfers: we ensure equivalent protection or obtain your consent. Complaints: ppc.go.jp.

12.10 South Korea (PIPA)

If you are in South Korea, your data is handled under the Personal Information Protection Act (PIPA). This section constitutes our Personal Information Processing Policy (개인정보 처리방침). When your data is no longer needed, it is destroyed using irreversible methods. Cross-border transfers require your consent or equivalent safeguards. Complaints: PIPC at pipc.go.kr or KISA.

12.11 Vietnam, Indonesia, Singapore

Vietnam: We comply with the Law on Cybersecurity 2018 and respond to lawful government data requests as mandated.

Indonesia: We comply with Government Regulation No. 71/2019 and lawful content removal orders from Kominfo.

Singapore: We comply with POFMA. If the Singapore government issues a correction or removal order, we will comply promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we provide in-app notification at least 14 days before changes take effect. Where consent is required under applicable law, we obtain it before changes apply. The "Effective Date" at the top of this Policy indicates when it was last updated. Your continued use of the App after the effective date constitutes acceptance.

14. Contact Us