Privacy Notice

1. Who is responsible for your data

Zenlit is run by Arjun Gowda L, an individual based in Mysuru, Karnataka, India. He decides how your personal data is used, which makes him the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023. He is also Zenlit’s Grievance Officer.

For anything about your data, email app.zenlit@gmail.com or use Help → Contact support in the app. If you can’t sign in, use the Support form on the sign-in screen.

This notice covers Zenlit on the web at https://app.zenlit.in and in the Zenlit Android app. It stands on its own; the Terms of Use and Community Guidelines cover the rules for using Zenlit.

2. What we collect and why

We collect only what Zenlit needs to work. Each item below says what it is for.

• Email address and sign-in method (Google, Apple on the web, or a 6-digit code): to create your account, sign you in, send your sign-in codes and, if something important affects your account (such as a data breach), to tell you. If you choose Google or Apple, they may also share your name, which we use only to suggest your display name. If you use Apple’s Hide My Email, Apple gives us a private relay address instead of your real email address and forwards our emails to you.
• Name, username and bio: shown on your profile. If you change your username, the old one is kept for 14 days so you can switch back and nobody else can take it.
• Social links (Instagram, X, LinkedIn), optional: shown only to members who also chose to share that platform.
• Profile photo and cover photo, optional: shown on your profile.
• Date of birth: kept private and used only to confirm you are 18 or older. If the date shows someone is under 18, we don’t save it; we keep only the time of the failed attempt.
• Posts (one photo each, with an optional caption and photo description): shown on your profile and in the Feed of members near you.
• Messages, message drafts and read receipts: to deliver your messages, keep unsent drafts so you don’t lose them, and show when a message has been read.
• Blocks: to keep you and the people you block apart, both ways.
• Settings, such as whether you are visible on Radar and which social platforms you share: to apply your choices.
• Reports, feedback and support requests, including any screenshot you attach and the contact email you give if you are signed out: to review safety problems, fix issues and reply to you. When someone reports your profile, post or message, a copy of the reported text (and of a reported post’s photo) is kept with the report, even if the content is deleted later; only the operator can see it.
• Your acceptance of the Terms of Use and Community Guidelines, with its date and time: to show which version you agreed to.
• Approximate location while you use Radar, with a random ID for each browser or app install: explained in the next section.
• Technical logs kept by our hosting providers, such as your IP address and the details of each request: to keep Zenlit secure and working. Short-lived counters of your actions (for example, messages sent in a minute) prevent abuse.

We don’t collect passwords, phone numbers, contacts, gender, payment details or government ID. We don’t show ads, sell or rent your data, use advertising trackers, add analytics tools that follow what you do in Zenlit, or use your data to train AI.

3. Location

Zenlit uses your location only while Zenlit is open and you are visible on Radar. We never collect it in the background.

• Your device location is read about once a minute and rounded on our server to an approximate area of about 500 m. Only the latest area is kept.
• Radar stops using it 5 minutes after your last update, and it is deleted within about a minute after that.
• Hiding from Radar, choosing Not now, signing out, or closing Zenlit on a computer deletes it straight away.
• Each browser or app install you use sends a random ID with its location updates, so we can tell your phone from your laptop and catch faked locations. It is made on your device, is different for each account, and isn’t linked to the device itself. We keep it only as long as the location data in this section, and for up to 3 days in the counters that prevent abuse.

To catch faked locations, when your location is deleted we keep only a rough area (about 10 km) and the time of your last update, for up to an hour. If you stopped sharing yourself, we also keep the 500 m area for about 2 minutes. These are used only to check your next update, and no one can see them. If an update jumps farther than anyone could travel, Radar pauses for 10 minutes and we record only the distance of the jump for review. An unusually high number of area changes in one day is also noted for review.

Other members never see your location, your coordinates or how far away you are. Radar shows who is nearby, so someone who checks it from different places could work out a rough area where you are.

Your location comes from your own browser or phone, so Zenlit can’t verify where anyone physically is. Treat other members’ presence nearby as something they report, not something we have checked.

4. Who can see your information

• Your profile, photos and posts are visible only to members who can currently see you: people near you, while you are both visible on Radar, and only if neither of you has blocked the other.
• Your messages are seen only by the person you are chatting with. Your first message is a request; you can chat freely once they accept.
• Your email address, date of birth, location and settings are never shown to other members.
• If you delete your account, other members see “Deleted account” in place of your name in past chats.

Messages are not end-to-end encrypted. The operator can access stored data, and does so only to run Zenlit, review reports and requests, or meet a legal obligation.

5. Photos

Photos are stored privately, not on public links. They are shown only to people who can currently see your profile, through temporary links. A link already shown to someone can keep working for up to 2 hours.

When you upload a photo it is resized and re-encoded, which removes embedded location (EXIF) data. We also store a small preview copy of each photo.

6. Service providers and where your data is stored

We use a few providers to run Zenlit. They process data only on our behalf, to provide their service:

• Supabase: database, sign-in, file storage and live updates. Your account, profile, posts, photos, messages and reports are stored in its Mumbai, India region.
• Vercel: hosts and delivers the web app through a global network, so your requests (including your IP address) may be handled outside India.
• Resend: sends the sign-in code emails from no-reply@zenlit.in, so it receives your email address and the code.
• Google: only if you choose Google sign-in.
• Apple: only if you choose Apple sign-in on the web.
• Expo: delivers app updates to the Zenlit Android app. When the app checks for an update, Expo receives your phone’s operating system, a random ID for this install of the app and your IP address, and uses them to send the right update and count how many installs receive it. If an update fails to start, the app sends Expo a short technical error message. Expo is a US company that works through a global network, so these requests may be handled outside India.

We don’t share your personal data with anyone else, except when Indian law requires it, for example a lawful order from a court or a government agency.

7. How long we keep your data

• Your account, profile, posts, photos, messages, drafts, blocks and settings: until you delete them or your account.
• Location: only minutes, as explained in the Location section. The rough area kept to catch faked locations: up to an hour.
• Temporary photo links: up to 2 hours.
• Reports, with their copy of the reported content: up to 2 years after we receive them, then deleted.
• Feedback and support requests: up to 2 years. Those you sent while signed in are deleted earlier if you delete your account.
• Notes about unusual location updates: up to 2 years, or until the account is deleted if that is sooner.
• A sign-up that never finished the first step (name, username, date of birth and accepting the Terms), including one stopped at the under-18 check: the account, with its email address, is deleted automatically after 7 days (1 day after the server recorded a failed under-18 check).
• After you delete your account, a minimal record of your registration (email address, sign-in method, username, and the dates you joined and left): 180 days, as Indian law requires, then deleted.
• Counters used to prevent abuse: up to 3 days.
• Hosting providers’ technical logs: the short periods the providers set. Supabase keeps request logs for about 1 day on our plan; Vercel also keeps its request logs only briefly. Expo keeps its records of update checks for the periods its own privacy policy sets.
• Backups: our database provider may keep its own short-term backups, and we may keep a weekly backup of the database for up to 30 days. Data deleted from Zenlit disappears from backups as they expire.

If the law requires us to keep something longer, we keep only that, only for that purpose, and only for as long as required. For example, when we remove content because it is unlawful or because of a court or government order, we preserve it and the related records for 180 days (or longer if a court or authorised agency asks) for investigation.

8. Deleting your account

You can delete your account at any time from Account → Delete account. To confirm it’s you, we email you a fresh 6-digit code.

Your account closes the moment you confirm the code: you are signed out everywhere and hidden from Radar and the Feed. Your data is normally removed within moments. If that is interrupted, an automatic job finishes it, usually within about half an hour. Deletion can’t be undone. Some records are kept for the periods in “How long we keep your data” above and in this list.

• Your profile, posts, photos, drafts and blocks are removed within moments. Your location is removed straight away.
• The text of messages you sent is removed within moments. The other person sees “Deleted account” in the chat once that’s done.
• Your username is held for 30 days so nobody else can take it and pretend to be you.
• A minimal record of your registration (email address, sign-in method, username, and the dates you joined and left) is kept for 180 days because Indian law requires it, and is used for nothing else.
• Reports you made are kept for safety review but are no longer linked to your account. Reports about you keep only the reason and date, not the reported content.

If you can’t sign in, use the Support form on the sign-in screen or email us from the address on your account, and we’ll help.

Step-by-step instructions for the app, the web and email are on the Account deletion page.

9. How we protect your data

Photos are stored privately. Every request is checked by the database, so members can only reach what they are allowed to see. Connections to Zenlit are encrypted (HTTPS), there are no passwords to steal, and only the operator can access the database.

No system is perfectly secure. If a personal data breach affects you, we’ll tell you without delay, in the app or by email: what happened, what it may mean for you, what we are doing about it and what you can do. We’ll also report it to the authorities as the law requires.

10. Your rights and choices

Under the Digital Personal Data Protection Act, 2023 you can:

• Get a copy of your data: Account → Download your data gives you a copy (a JSON file) of your account, profile, posts, conversations and messages. For anything else we hold about you, or the list of providers we shared it with, email us.
• Correct or update it: change your name, username, bio, photos and social links in Edit profile. To correct your date of birth or email address, contact us.
• Erase it: delete a post from its menu, or delete your whole account as described above.
• Withdraw consent: for location, hide from Radar, choose Not now, or turn off location for Zenlit in your browser or phone. For everything else, delete your account, because Zenlit can’t work without it. Withdrawing consent doesn’t affect what was done before.
• Nominate someone: email us from your account’s address with the name and email address of a person who can use these rights for you if you die or can no longer act for yourself. We’ll ask them for reasonable proof before acting.
• Complain: email app.zenlit@gmail.com or use Help → Contact support. We acknowledge complaints within 24 hours and resolve them within 7 days.

Send requests from the email address on your Zenlit account, or include that address and your username, so we can find your data. We may ask you to confirm it’s you, and we act only for the account holder or their nominee.

If you are not satisfied with how we handled your complaint, you can complain to the Data Protection Board of India through its online complaint process once it is available. The law asks you to use our process first.

This notice is in English. If you’d like it in another language listed in the Eighth Schedule to the Constitution of India, ask us.

11. Adults only

Zenlit is only for people aged 18 and over. We ask for your date of birth to confirm this and don’t let anyone younger sign up. We don’t knowingly process personal data about children, and we never track or target anyone with ads.

If we learn that an account belongs to someone under 18, we delete it. If you think a child is using Zenlit, please tell us.

12. Storage on your device

Zenlit keeps your sign-in session, a few settings (such as your theme), the random location ID described above and recently loaded content in your browser or on your device, so you stay signed in and the app loads faster. The Android app also keeps downloaded app updates and the random install ID Expo uses for them. We don’t use cookies or device storage for advertising or analytics.

13. Changes to this notice

We’ll announce changes in the app before they take effect. If a change affects how we use your data in an important way, we’ll ask for your consent again where the law requires. The version and effective date are shown at the top.

14. Contact and Grievance Officer

• Grievance Officer: Arjun Gowda L, Mysuru, Karnataka, India.
• Email: app.zenlit@gmail.com (for privacy requests, complaints, grievances and legal notices).
• In the app: Help → Contact support. Signed out: the Support form on the sign-in screen.