Privacy Policy

1. Introduction & Overview

Welcome to ZoraGram ("ZoraGram," "we," "our," or "us"). We are committed to protecting the privacy, confidentiality, and security of our community members ("you" or "user"). This Privacy Policy applies to the ZoraGram Android mobile application (Package Name: com.zoragram.friendship), our official website at https://zoragram.in, and all associated services, features, and communication tools.

This Privacy Policy explains what personal data and device information we collect, why we collect it, how it is processed and shared, and how you can manage, download, or permanently delete your data in compliance with the Google Play Developer Program Policies, Google Play Data Safety Requirements, and applicable data protection legislation including the Information Technology Act, 2000 and Digital Personal Data Protection Act (DPDPA).

2. Information We Collect

We collect information in three ways: information you provide voluntarily, information collected automatically during app usage, and information from system permissions.

A. Information You Provide Voluntarily

• Account Registration & Credentials: Full name, display username, registered email address, optional mobile phone number, and encrypted password (or Google OAuth authorization token).
• Profile Details: Bio, profile avatar photograph, cover banner image, date of birth, gender, and external social/website links you choose to share publicly.
• User-Generated Content (UGC): Photos, video reels, captions, comments, replies, hashtags, and direct chat messages you publish or transmit on ZoraGram.
• Identity Verification Documents: If you apply for a verified Creator or Business Blue Badge, government-issued photo ID proofs (such as Aadhaar card, PAN card, or passport) are collected solely to confirm authenticity and prevent impersonation.
• Communications & Support Inquiries: Messages, feedback, crash reports, and grievance submissions sent to our support desk.

B. Information Collected Automatically

• Device & Telemetry Data: Mobile device manufacturer and model, operating system version (e.g. Android 13/14/15), unique device identifiers, screen resolution, app version code, and mobile network state (WiFi/cellular).
• Usage & Activity Log Data: Interaction timestamps, posts viewed, reels engaged with, search queries, likes, comments, and following graph to personalize your feed algorithm.
• Network & Security Data: IP address, Internet Service Provider (ISP), approximate geolocation at city/region level for security alerts (unfamiliar device logins), and server crash logs.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) device registration tokens used exclusively to route real-time notifications for new followers, comments, likes, and direct messages.

3. Android Runtime Permissions & Device Access

In compliance with Google Play's Permissions and APIs Hygiene Policy, ZoraGram requests device permissions strictly when necessary to enable specific in-app features initiated by you. We do not access, track, or record any sensor or hardware feature in the background without your explicit action:

4. How We Use Your Information

We process collected data exclusively for legitimate operational, security, and contractual purposes:

• Core Social Functionality: Publishing photos and reels, managing your profile, establishing follower relationships, and transmitting direct chat messages.
• Feed & Content Recommendation: Applying algorithmic personalization (based on your engagement, trending hashtags, and categories) to deliver relevant content in your Home and Explore feeds.
• Authentication & Account Protection: Verifying your identity during signup/login via One-Time Passwords (OTPs), detecting credential stuffing, and dispatching security alerts for logins from new devices.
• Trust, Safety & Content Moderation: Enforcing our Community Guidelines, proactively scanning for Child Sexual Abuse Material (CSAM), investigating user reports, and eliminating spam or fraudulent bot networks.
• Customer Support & Bug Resolution: Addressing technical support tickets, diagnosing crash logs, and communicating platform updates.

5. Third-Party Services & SDK Disclosures

We do not sell, rent, or trade your personal information to data brokers or advertising exchanges. To deliver platform infrastructure and comply with Google Play Data Safety standards, we integrate with the following audited third-party service providers:

• Google Play Services & In-App Billing: Provides app distribution, security verification (Play Protect), and secure processing of digital purchases and creator support tokens. (Privacy Policy: Google Privacy Policy).
• Google Firebase (FCM, Crashlytics & Auth): Provides real-time push notification routing, anonymized app stability and crash diagnostics, and secure OAuth tokens.
• Cloud Infrastructure & Mail Dispatch: Reputable cloud hosting and mail transport providers (including Amazon Web Services / AWS SES) to deliver transactional authentication emails, OTPs, and password reset links from noreply@zoragram.in.
• Law Enforcement & Legal Compliance: We disclose data to statutory authorities only upon receipt of lawful, binding court orders or statutory notices under applicable laws.

6. In-App Payments & Financial Data

In compliance with Google Play In-App Billing Policies:

• All financial transactions for digital features, creator gifting, or optional premium badges within the Android app are processed exclusively through Google Play In-App Billing.
• ZoraGram servers never receive, collect, or store credit/debit card numbers, CVV codes, bank account credentials, or UPI PINs. All financial credential storage is handled directly by Google Play's PCI-DSS Level 1 certified infrastructure.
• ZoraGram does not operate external web payment checkouts to circumvent Google Play billing rules. For full details, review our Payments & Billing Policy.

7. Data Retention & Account Deletion (Google Play Compliance)

In accordance with the Google Play Account Deletion Policy, ZoraGram provides users with complete autonomy to permanently delete their account and all associated personal data through both in-app controls and an accessible web portal:

What Happens Upon Deletion:

• Immediate Action: Your profile is instantly hidden from search, discovery feeds, and other members. Active sessions are terminated.
• 7-Day Grace Period: You may cancel deletion by logging back into the app within 7 days.
• Permanent Purge: After 7 days, all your personal profile records, photos, reels, comments, likes, follower links, and direct chat messages are permanently expunged from our production databases and media storage.
• Statutory Retentions: Limited financial transaction receipt IDs (for tax/GST accounting) and severe abuse ban records (to prevent re-registration by expelled bad actors) are retained only as permitted or required by law.

8. Data Security & Encryption

We implement rigorous technical, operational, and organizational safeguards to protect your personal data:

• Encryption in Transit: All communications between the ZoraGram Android app, backend servers, and web endpoints are encrypted using modern Transport Layer Security (TLS 1.2 / TLS 1.3 / HTTPS).
• Credential Protection: Account passwords are protected using irreversible salted cryptographic hashing algorithms. We never store passwords in plaintext.
• Access Controls: Administrative access to production databases is restricted to authorized personnel using multi-factor authentication (MFA) and audited activity logs.

9. Children's Privacy & Zero CSAM Tolerance

ZoraGram is strictly for individuals who are at least 13 years of age (or the minimum legal age in your country). We do not knowingly collect personal information from children under 13. If we discover an account registered by an underage user, we will immediately terminate the account and purge all associated records.

We enforce an absolute, non-negotiable zero-tolerance policy against Child Sexual Abuse Material (CSAM) and child sexual exploitation and abuse (CSAE). All confirmed violations result in immediate device banning and mandatory reporting to the National Center for Missing & Exploited Children (NCMEC) and national law enforcement. For details, consult our dedicated Child Safety Standards.

10. Your Privacy Rights & Controls

You have full legal control over your personal information:

• Access & Portability: View your profile data, posts, reels, and following lists anytime within the app.
• Correction & Update: Edit your name, bio, profile photo, and password via in-app profile settings.
• Notification Preferences: Customize email alerts (new followers, likes, comments, newsletter) or unsubscribe with 1-click via our Email Preferences Center.
• Account Privacy: Switch your profile between Public and Private mode. On private profiles, only approved followers can view your posts and reels.
• User Blocking & Filtering: Block any user with one tap to immediately prevent them from viewing your profile, sending messages, or commenting on your content.

11. Updates to This Policy

We may periodically update this Privacy Policy to reflect app feature enhancements, updated Google Play Developer Program policies, or legislative changes. When updates are published, we will revise the "Last Updated" date at the top of this page. Significant modifications will be communicated via in-app notices or email notification prior to taking effect.

12. Grievance Officer & Contact Information

In compliance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, you may direct any privacy questions, data access requests, or regulatory complaints to our designated Resident Grievance Officer: