Privacy policy

The short version

We collect what the app needs to work: your phone number, your profile, what you do in the app and, only if you say yes, your approximate location.
Other people see your first name, @username, photos, bio, city and plans. Never your phone number, surname, date of birth or exact location.
We don't sell your data, and there are no ads.
You can get a copy of your data, withdraw consent, or delete your account.
Mahaul is only for people 18 and over.

Who we are

Mahaul (“Mahaul”, “we”, “us”) runs the Mahaul app and this website. Under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we're the Data Fiduciary for the personal data described here.

[Legal entity name and registered address: TODO]

Questions about this policy: [email protected].

What we collect

Data	What it is, and why
Phone number	Used to sign you in with a one-time code sent by SMS, and to keep out bots and banned users. Never shown to anyone.
Google, Apple or Facebook sign-in	Only if you choose it, where offered: your email address and an account ID from that provider, to sign you in.
Date of birth	Entered at sign-up to confirm you're 18 or over. Nobody else sees it. Your age range is used for the People deck's age filter, never shown on your card.
Profile	Display name, @username, bio, home city, up to 6 photos and your music taste. So people know who they're meeting. Others see your first name only.
Activity	Events you're going to or interested in, waves and Super Waves, friends and friend requests, Out this week plans, gatherings, groups, posts, comments and Vibes. To run the features you use and to rank what you see.
Messages	Direct, group, event and plan chat messages, including photos you send. To deliver them.
Approximate location	Optional, and only with your consent. Your device's location, rounded to about 1 km before we store it. Used for “2 km away” and the distance filter. Turn it off in Settings, or tap Stop sharing my location, and it's deleted straight away.
Places you pick	For Out this week: the event, venue or area (about 1 km) you choose. Shown to your friends only.
Contacts	Optional. If you tap My contacts, the app turns the phone numbers in your contact book into hashes on your phone and sends only the hashes. We compare them with people already on Mahaul and keep only which accounts matched, for “People you may know”. We don't store the hashes, and we never receive your contact list.
Reports and safety records	Reports you make or that are made about you, moderation decisions, appeals and grievances. For safety and our legal duties.
Device and technical data	Your push notification token, whether it's for Android or iPhone, and your IP address. To send notifications, keep the app working and prevent abuse.
Consent records	What you agreed to, and when. The DPDP Act requires us to be able to show this.

We don't collect your exact location, your contact list, or government ID such as Aadhaar.

When you sign up, we ask for consent purpose by purpose. Nothing is pre-ticked.

Purpose	What it means
Run the app (required)	Create your account, show events, let you RSVP, connect and chat. Mahaul can't work without it.
Personalised recommendations (optional)	Use your interests, city and activity to rank the events and people we show you.
AI features (optional)	Where offered, let AI features such as recommendations or an event assistant use your activity to help you. Off unless you turn it on.
Share approximate location (optional)	Show your rough distance to other people, never an exact pin.
Product updates (optional)	Occasional emails or notifications about new features and events.

You can change any optional choice later in the app, and withdrawing is as easy as agreeing. Withdrawing location consent, or tapping Stop sharing my location, deletes your stored location straight away. Withdrawing consent doesn't affect anything we did lawfully before.

Who can see what

Anyone on Mahaul can see your first name, @username, profile photos, bio, city, music taste, the events you're going to or interested in, posts you share with them and, if your location is on, a rounded distance like “2 km away” (nothing past 300 km). They can't see your surname, phone number, date of birth or age.
Your friends also see your Out this week nights and the places you pick for them.
Friends and matches can message you. Nobody else can start a direct message with you.
People you wave at don't find out it was you unless they wave back.
Organizers see what any member sees. We don't give them your phone number or email.
Mahaul staff who need it to run the service, handle reports or meet legal duties can access your data. That access is logged.

Service providers and legal requests

We use a small number of providers to run Mahaul. They may only use your data to provide their service to us, under contracts that require them to protect it.

Cloud hosting: Amazon Web Services, Mumbai region (India).
Sign-in codes: an Indian SMS provider that sends your one-time code. [Provider name: TODO]
Push notifications: Google Firebase Cloud Messaging on Android, and Apple Push Notification service on iPhone.
Maps: map tiles from OpenFreeMap, built on OpenStreetMap data. Your phone requests tiles directly, so the tile server sees your IP address and the area you're looking at.
Sign-in providers: Google, Apple or Facebook, only if you sign in with one of them.

We don't sell your personal data, and we don't share it with advertisers.

We'll disclose data when Indian law requires it, such as a valid order from a court or government agency, or when it's needed to protect someone from serious harm.

Where your data is stored

Mahaul is built to keep Indian users' personal data in India. At launch, our servers and backups will be in the AWS Mumbai region. A few providers, such as push notifications, may process limited data outside India. Where they do, it's under contract and only as the DPDP Act allows.

How long we keep it

Your profile and activity: while your account is open.
Approximate location: until you stop sharing or withdraw consent. Then it's deleted.
After you delete your account: it's closed straight away and erased 30 days later. What we keep after that, and for how long, is under Deleting your account.
Records we have to keep: audit logs and consent records for 1 year after an account is erased, safety cases for 1 year after they're closed, cases opened because of a court or government order for 3 years after they're closed, and purchase records for 8 years. Your name, phone number and IP address are removed from them.
A copy of your data: the file we prepare for you can be downloaded for 14 days, then it's deleted.

Your rights

Under the DPDP Act, you can:

Access your data: ask for a summary, or a copy of what we hold about you.
Correct and update it: edit your profile any time, or ask us to fix anything else.
Erase it: delete your account (see below).
Withdraw consent for any optional purpose, at any time.
Get your grievance addressed by us, and if you're not satisfied, complain to the Data Protection Board of India.
Nominate someone to use these rights for you if you die or can't act yourself.

In the app, go to Settings → Your data to download your data or delete your account. Download your data prepares a file with everything linked to your account, including a list of what happens to each part if you delete your account. We deliver it within 90 days at most, usually much sooner, and tell you in the app when it's ready. Or email [email protected]. We'll check it's really you first, and reply within 90 days at the latest, usually much sooner.

Deleting your account

You can delete your account in the app, under Settings → Your data → Delete account, or by email. Delete your account has step-by-step instructions.

When you delete your account:

Straight away, the account is closed and you're signed out on every device. Nobody can see your profile, photos, posts, comments or plans, and in chats you show as “Deleted user”. We send you a notice with the date your account will be erased.
For 30 days, nothing is erased. Sign in again with the same phone number (or a Google, Apple or Facebook account you linked) and you can restore your account as it was, or continue deleting. We remind you about 3 days before the end.
After 30 days, an automatic job that runs every hour erases the account: your phone number, email address, password and date of birth; your name (replaced with “Deleted user”), username, bio and settings; your photos and videos, from our storage too; your posts, comments, Vibes and tags; your event plans, Out this week nights and gatherings; your friends, matches, waves, blocks and People deck history; your approximate location, contact matches, devices and sessions; and notifications about you. Gatherings you host that haven't happened yet are cancelled, and an organizer page you run is suspended with its upcoming events taken off Mahaul; the people involved are told.
Messages you sent stay in the other people's chats, because the conversation is theirs too, but the text is replaced with “Message deleted”, photos are removed and the sender shows as “Deleted user”.
We keep only what the law or safety requires, with your name, phone number and IP address removed, and then delete it: audit logs and consent records after 1 year, safety cases 1 year after they're closed, cases opened because of a court or government order 3 years after they're closed, and purchase records after 8 years. While a court or government-order case about you is still open, your account stays closed but is erased only once the case is closed.

Under-18s

Mahaul is only for people 18 and over, and we check date of birth at sign-up. If we learn someone under 18 has an account, we close it and delete their data. If you think a child is using Mahaul, report the profile or write to us.

Security

Data travels encrypted (HTTPS/TLS). Inside Mahaul, access to personal data is limited to people who need it, and logged. If a breach affects you, we'll tell you and the Data Protection Board, as the law requires. No system is perfectly secure, so use a phone number you control and keep your phone locked.

This website

This website doesn't use cookies, analytics or trackers. Its fonts load from Google Fonts, so Google receives your IP address when you visit.

The waitlist form asks only for your email address. It's stored with Cloudflare, the company that hosts this website. We'll use it only to tell you when Mahaul launches, and you can ask us to remove it at any time.

Changes to this policy

We'll update this page when things change, and show the date at the top. If a change is significant, we'll tell you in the app before it takes effect.

Contact and grievances

Questions or requests: [email protected].

Grievance Officer: [email protected]. [Grievance Officer name and postal address: TODO] We acknowledge grievances within 24 hours and aim to resolve them within 15 days. In the app: Settings → About & legal → File a grievance.