Privacy Policy

Effective date: 28 July 2026  |  Last updated: 22 September 2026

This Privacy Policy explains how Tax Collars Private Limited (CIN U74999TN2020PTC137643), a company registered in India ("we", "us", "our"), handles your information when you use Privy Manager — our mobile applications for Android and iOS, and our browser-based web app (together, the "App"). Privy Manager is a private messaging app built so that we hold as little of your data as possible — and cannot read what we do hold.

Everything in this Policy applies to all three unless a section says otherwise. Where the web app genuinely differs — because a browser cannot offer what a phone's operating system does — we say so plainly: see §2.6 (reCAPTCHA) and §8 (local security).

By creating an account or using the App, you agree to this Policy. If you do not agree, please do not use the App.

1. The short version

2. Information we collect

2.1 Account information

• Username. You choose it; it does not have to identify you. Internally it is converted to a synthetic identifier for sign-in — it is not an email address and we cannot contact you through it.
• Password. Handled by our authentication provider (Firebase Authentication) as a credential; we never store your plaintext password. Your password is also used on your device to derive the key that protects your encryption keys (see §3).
• Recovery email (optional). You may add an email address so you can recover a forgotten username. It is stored in a private record only you and our systems can access, and is used solely to send you that recovery email. We never use it for marketing and never disclose it to other users.
• Recovery code. If you generate one, it can be used to regain access to your account if you forget your password. It cannot reset your PINs (§8).
• Names. At sign-up you choose a display name, which is what other users see, and give an Actual Name. We verify neither. Your Actual Name is kept in a private record that only you and our systems can access; other users see it only in a conversation where you choose to reveal it.
• Profile photo (optional). If you set one, it is visible to users you communicate with.
• Access PINs. When you set your App, Hide and Wipe PINs, they are sent over an encrypted connection to our servers, which store only a one-way (bcrypt) hash of each. When you unlock, a phone first checks the PIN against a similar one-way hash kept on the device; the PIN goes to our servers only if that check does not recognise it, and always on the web app. We never store the PINs themselves (§8).

2.2 Your content — encrypted

Messages, attachments, photos, files, and voice notes are encrypted on your device before upload (see §3). Our servers store and relay only ciphertext. This includes Personal Notes (conversations with yourself).

2.3 Conversation metadata — not encrypted

To route and deliver messages, our servers necessarily process in readable form:

• which account identifiers (anonymous usernames — never your real name or phone number) participate in a conversation;
• message timestamps and delivery/read state;
• unread counts and conversation settings (e.g. disappearing-message timers, group admins and approvers, moderation settings);
• your friends/contacts list within the App (accounts you have connected with — never your phone's address book).

We use this metadata only to operate the service. We never sell it, share it for advertising, or use it to profile you.

2.4 Device and session information

For each signed-in session we store: the platform (iOS, Android or web), a device name (e.g. "iPhone 15"), whether the device is mobile, session state (active, primary, revoked), sign-in and sign-out times, and a push-notification token. You can view this session history in the App and revoke sessions remotely.

Sign-in records. Each sign-in attempt is logged by our authentication provider, including your IP address and the app or browser identifier your device sent. We also count failed sign-in attempts for each account, to temporarily block password guessing, and notify you the first time your account is blocked this way. We use these records only to protect accounts.

2.5 Reports and support messages

If you report a conversation (§9), the report stores: your account identifier (as reporter), the conversation and reported account identifiers, the subject and description you wrote, whether you marked it illegal or urgent, and references to the messages you cited as evidence. Reported message content itself remains encrypted.

If you write to us from Help & Support in the App, we store your message, the subject you chose and your account identifier, and email them to our support address so we can answer you. A support message is ordinary text, not encrypted content — write it as you would any email.

2.6 Operational data

Standard infrastructure logs (error traces, function invocations, and the sign-in records in §2.4) and abuse-prevention signals (e.g. Firebase App Check attestation, rate-limiting records — the username-recovery rate limiter stores only a one-way hash of the email address). These logs never contain message content.

reCAPTCHA — web app only. The Privy Manager web app uses Google reCAPTCHA Enterprise, through Firebase App Check, to check that requests come from a real browser running our app rather than an automated script. To make that judgement, Google receives technical information about your browser and how you interact with the page, and sets its own cookies; this is governed by Google's Privacy Policy and Terms of Service. We receive only a pass/fail verdict — never the underlying signals, and never anything tied to your messages. There is no puzzle or checkbox to solve; the check is invisible. This applies only to the web app: the Android and iOS apps prove their integrity through Google Play Integrity and Apple App Attest, which do not involve reCAPTCHA.

2.7 What we do NOT collect

• Phone number
• Your device's contacts / address book
• Location data
• Analytics, advertising identifiers, or behavioural tracking (the reCAPTCHA bot check on the web app, described in §2.6, reads browser and interaction signals solely to tell humans from scripts — it is not used to profile you, target advertising, or measure your use of the App)
• Crash-reporting or telemetry SDKs
• Biometric data (Face ID / fingerprint unlock is verified entirely by your device's operating system; biometric information never reaches the App or our servers)

3. How encryption works — and its honest limits

• A random 256-bit data key is generated for your account. It is protected ("wrapped") by a key derived on your device from your password, and the unwrapped key is cached on your device: in its secure hardware on phones (iOS Keychain / Android Keystore), and in browser storage on the web app (see §8). The unwrapped key never leaves your device.
• Your data key also derives an identity keypair; only the public half is published. Each conversation uses a random shared conversation key, delivered to each participant wrapped with their public key. Message text and media are sealed with AES-256-GCM using that shared key.
• The result: only conversation participants can decrypt content. Our servers see ciphertext and wrapped keys. We could not read your messages even if compelled to try.
• Everything additionally travels over TLS in transit.

4. How we use information

We use the information in §2 only to:

1. create and authenticate your account and sessions;
2. deliver messages, media, and push notifications;
3. operate the features you invoke (disappearing messages, delete-for-everyone, group moderation, session management, account recovery);
4. keep the service secure — prevent abuse, spam, and unauthorised access;
5. review reports filed by users (§9); and
6. comply with valid legal obligations (§10).

We do not use your information for advertising, profiling, model training, or any purpose unrelated to running the App. We never sell personal data.

5. Push notifications

We use Firebase Cloud Messaging (and, on iOS, Apple Push Notification service) to tell your device that something arrived. Because content is end-to-end encrypted, a notification never carries readable message text from our servers; where the App shows a message preview, your own device fetches and decrypts the message.

To make an alert useful, a notification does carry the sender's name, the conversation's name and the kind of message (for example "Photo" or "Voice note"), readable to the notification service that delivers it to your device (§7). You control this in Settings: Generic removes all three, Secure conversations can be set to In-app only or Off, and you can turn notifications off entirely in your device settings.

6. Device permissions

The App requests permissions only when a feature needs them, and the captured data goes only where you send it:

Denying a permission only disables the corresponding feature.

7. Where your data lives, and who processes it

We do not run our own data centres. We use a small number of infrastructure processors, bound by their own contractual and legal safeguards:

• Google Firebase / Google Cloud (authentication, database, file storage, serverless functions, push messaging, app integrity). Your data is stored in Google Cloud data centres, primarily in the asia-south1 (Mumbai, India) region; some serverless processing runs in Google Cloud's United States regions.
• Google reCAPTCHA Enterprise — bot detection for the web app only (see §2.6). It processes browser and interaction signals for that check and returns a verdict to us; it never sees your messages.
• Postmark (postmarkapp.com) — delivers username-recovery emails to the optional recovery address you provided. It processes only that email address and the recovery message itself.
• Zoho (zoho.com) — hosts our email. It processes the messages you send to our support, privacy and grievance addresses.
• Amazon Web Services — hosts our website, privymanager.com, including the page that invite links open. The invite code sits after the "#" in the link, which your browser never sends to the server.
• Apple (APNs) and Google (FCM) — push-notification delivery.

These providers act on our instructions to run the service. We share nothing with anyone else, except as described in §9 (moderation) and §10 (legal process). If data is processed outside your country, we take reasonable steps to ensure it receives equivalent protection.

8. Data on your device, PINs, and local security

• The App keeps a local, encrypted copy of your conversations on your device (for offline access), plus keys in your device's secure hardware. This local data is removed when you use the wipe feature, delete your data in-app, or uninstall the App.
• Access PINs (App PIN, Hide PIN, Wipe PIN) are kept only as one-way hashes: on our servers, and on phones also in the device's secure storage (§2.1). We never store the PINs themselves, and cannot recover or reset them — no support request, recovery code, or legal process can. A forgotten PIN permanently locks what it protects. This is a deliberate design decision, not an oversight.
• The Wipe PIN, if you set one, irreversibly erases designated local data when entered. Use it with care.
• Your recovery code can restore account access after a forgotten password only. Store the exported file somewhere safe; anyone holding it (with your username) may be able to take over your account.
• On the web app, local protection rests on your computer, not on ours. A phone gives the App hardware-backed storage that the operating system keeps isolated; a browser has no equivalent to offer — to us or to any other site. So on the web app, the safety of anything held locally for offline use follows the safety of the computer and browser profile you use it in. A lock screen in a browser discourages a passer-by; it is not a substitute for controlling who can use the machine. Use the web app on devices you trust, sign out when you have finished — always on a shared or public computer — and prefer the mobile apps for your most sensitive conversations.
• The web app signs itself out after a period of inactivity. By default that is 3 days; you can shorten it, lengthen it, or switch it off in Settings → Security. When it happens the session ends and the local copy this browser was holding is cleared, so signing back in fetches your messages from our servers again. The check runs when the app is next opened — nothing of ours runs in a closed browser — so treat it as a way of not leaving yourself signed in indefinitely, not as a substitute for signing out on a computer you do not control.

9. Moderation, reporting, and suspension

• Filing a report does not automatically alert the authorities. Reports go to our review team, not to the police.
• We do not ban accounts or seize data merely because a report was filed. We review the material the reporter submits (§2.5).
• If a report is substantiated, we may temporarily and reversibly suspend the reported account pending review. Suspended users are told the reason and their data is not viewed or used during suspension beyond what the review requires.
• For serious or repeated breaches of our Terms of Use, we may close the account permanently after review.
• We never reveal a reporter's identity to the reported user.
• Group moderation is a user feature, not surveillance by us: in groups with moderation enabled, the approvers chosen by the group (who are themselves participants, holding the conversation key) review messages before they reach the group. We still cannot read any of it.
• CSAM (child sexual abuse material) is the sole exception to the above: where the law requires, we will preserve and report it to the appropriate authorities.

10. Legal requests

• We respond only to valid legal process under applicable law, including the (Indian) Information Technology Act, 2000 and rules made under it, and the Digital Personal Data Protection Act, 2023. Informal requests are refused.
• Because message content is encrypted with keys we do not hold, we cannot produce decrypted content even when compelled. We can only produce what we actually possess: the metadata described in §2 and ciphertext we cannot read.
• We disclose only what the law requires, and nothing more. Where the law permits, we will notify affected users of a demand for their data.

11. How long we keep data

Deleting an account is immediate and cannot be undone. Whether you delete it yourself or it is removed for inactivity, the same process runs: your profile, conversation metadata, encryption keys, recovery data and the login itself are purged from our live systems in a single pass. We keep nothing back for a recovery window, so export anything you want to keep before you delete. Copies inside our encrypted database backups expire within 7 days; backups exist only to recover from a disaster, never to bring back a deleted account. Operational logs age out on the schedule in the table above.

“Inactive” means nobody has opened the app on any of your devices. Opening it resets the clock and cancels any warning already sent. Because the warnings are notifications, they will not reach you if you have uninstalled the app or turned notifications off — the account is still deleted at 365 days.

Local copies on your own devices (§8) are yours and persist until you remove them.

12. Your rights and choices

Subject to applicable law (for users in India, the Digital Personal Data Protection Act, 2023), you may:

• Access — ask what personal data we hold about you (§2 is the complete list; content we hold is unreadable to us).
• Correct — change your username availability aside, you can edit your profile, recovery email, and settings in-app at any time.
• Erase — delete individual messages, whole conversations, or your entire account in-app; account deletion triggers the §11 purge schedule.
• Withdraw consent — remove your optional recovery email at any time; stop using optional features; or delete your account entirely.
• Grievance redressal — complain to our Grievance Officer (§16) and, if unsatisfied, to the Data Protection Board of India or your local authority.
• Nominate — (India) nominate a person to exercise your rights in the event of death or incapacity, to the extent the law provides.

We will respond to verified requests within the time required by law. Note that we cannot identify you from encrypted content — requests must come from your authenticated account or verified recovery email.

13. Children

Privy Manager is not intended for anyone under 18. We do not knowingly collect data from children. Since we collect no age or identity information, we rely on you to meet this requirement; if we learn an account belongs to a minor, we will delete it.

14. Security

We protect your data with, among other measures: end-to-end encryption of content (§3), TLS for all transport, hardware-backed key storage on device, per-account key isolation, server-side access rules that restrict every record to its owner or conversation participants, app-integrity attestation, and rate-limited, non-revealing recovery flows. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify you and the relevant authorities as the law requires.

15. Changes to this Policy

We may update this Policy as the App evolves. Material changes will be announced in the App before they take effect, with the new effective date shown at the top. Continued use after the effective date means you accept the updated Policy.

16. Contact & Grievance Officer