Privacy policy

Written to be checked against the app rather than to cover us. Every claim here is enforced in the database, not just in a policy document.

What we hold

• Your name and email, from Google. Neither is shown to anyone you talk to — a separate display name is.
• Your verified phone number, when you sign in with Truecaller or verify a number via WhatsApp. The number is used only to identify your account; it is never shown to the people you talk to. Truecaller shares only your verified phone number with us after you consent — we do not receive your Truecaller profile, name, or email through that flow.
• Your messages, so a conversation can continue while it is live. When a session ends, the messages disappear from the app for both people immediately. We keep an inaccessible copy on our servers for 30 days — for account disputes and safety review only — and then delete it permanently. Nobody can read it from the app in the meantime. Anything you report is handled separately (see below).
• Voice recordings you send, if you send one. The microphone is used only while you are recording, never in the background. Audio goes into a private store that only the two people in that conversation can open, and it is deleted when the conversation or the account is. A recording you never send is deleted within a day.
• Your account balance and transaction history, if your version of the app includes optional paid features.
• A date of birth, only if you apply to be someone who listens. It is never shown; an age is computed from it.
• A notification token for your device, so a reply can reach you. Deleted when you sign out.
• Whether you are here, but only because you said so. Presence is a setting with three positions and it starts at hidden. It is never guessed from whether the app is open. Unless you are listed as someone who listens, only people you already have a conversation with can see it, and turning it off stops us recording when you were last here at all.

Device permissions

The app may request notifications (message alerts), microphone (voice notes and calls), and camera (video calls). Our admin configuration sets which permissions are required in production versus optional during internal testing — the prompt you see follows that live policy, not a fixed list in this document. We do not use these sensors in the background except while you are actively recording or in a call.

What we do not hold

• No contacts or precise location. Photos are accessed only when you choose one to send; camera and microphone access is limited to features you actively start.
• No advertising ID and no contact-book permission.
• No analytics on what you say. We count events like "a message was sent", never their contents — a database trigger rejects any event carrying free text.

Who can see your messages

The person you are talking to, and nobody else, enforced by row-level security in the database, so it holds even if the app is wrong. Our team can read a specific message only when you report it: reporting attaches a copy of that message to the report, and that copy is what a human reviews.

A notification never contains what was said. It tells you who replied, and that is deliberate — a lock screen is read by whoever is holding the phone.

Optional purchase data

If optional paid features are available, purchases are processed by the payment provider shown before confirmation. We do not store card details. We retain the transaction reference, amount, timestamp, and resulting balance so you can review the purchase and request support.

What survives deleting your account

Your profile, conversations, messages, and account balance are deleted immediately and permanently. Abuse reports do not. A report is kept, with the reporter's identity removed, for 90 days, because a report that vanished when the reported account was deleted would make deletion a way to destroy the evidence against you.

If the thing reported was a voice note, the recording is kept with the report for the same 90 days and a reviewer can listen to it. That is the same trade as a reported message, said plainly because it is a louder one: it is a recording of somebody's voice, and the alternative is a report about audio that points at nothing.

Where it lives

Supabase (PostgreSQL) for data, Google Firebase for notifications and app distribution, Sentry for crash reports, and Truecaller for phone-number verification. Crash reports are scrubbed of message contents before they are sent.

Retention

Conversations are ephemeral. When a session ends, its messages, voice notes, and photos vanish from the app for both people at once. We retain an inaccessible copy for 30 days — only so an account dispute or safety concern can be looked into — and then permanently delete it. Neither you nor the person you spoke with can open it during those 30 days; it exists only for those two purposes. Content you explicitly report is retained separately, for longer, as described above and in “What survives deleting your account”.

Active account data (your profile, settings, and so on) is retained for as long as your account exists. On deletion: see above. Aggregated, non-personal usage counts (e.g. total messages sent in a day) may be retained for operational reporting indefinitely; they contain no personal information.

Your rights

You have the right to access, correct, or request deletion of your personal data at any time. Write to us at hello@pappal.live. We respond within 30 days, and usually much sooner.

Contact

Questions, or a request to see what we hold about you: hello@pappal.live or +91 70578 87915.