Privacy Policy

Data Fiduciary: Rare Infoway Private Limited ("we", "us", "our") determines the purpose and means of processing personal data through the VChat mobile application (the "App").

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA 2023), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), and other applicable Indian laws.

VChat is a private messaging and real-time communication application available on Android and iOS. It enables:

• Phone-number-based identity — Registration and login using your mobile phone number and a one-time password (OTP). No email address or password is required.
• 1-to-1 messaging — Text messages, images, voice notes (audio recordings), and document sharing with individual contacts.
• Voice and video calls — Real-time peer-to-peer audio and video calls powered by LiveKit (WebRTC infrastructure).
• Group / Community chat — Group conversations with multiple participants.
• Contact discovery — With your permission, the App reads your device contact list to identify which of your contacts are registered VChat users.
• Call history — Log of incoming, outgoing, and missed calls.
• Push notifications — Message alerts and incoming call notifications via Firebase Cloud Messaging (FCM) on Android and Apple Push Notification Service (APNs) on iOS.
• Media sharing — Images (compressed), audio recordings (M4A), and documents (PDF, Word, Excel) up to the App's size limits.
• Profile — Display name, profile photo, and personal bio (About text).

Under the DPDPA 2023, we process personal data on the following grounds:

You may withdraw consent at any time by contacting dhairy@rareinfoway.com. Withdrawal does not affect lawfulness of processing before withdrawal, but may limit App functionality.

Children: We do not knowingly collect personal data from children under the age of 18 without verifiable parental consent as required by section 9 of the DPDPA 2023. Contact dhairy@rareinfoway.com immediately if you believe a child's data was collected without consent.

We request permissions only when the relevant feature is first used. You may revoke any permission in your device's Settings at any time, but doing so may limit App functionality.

6.1 Data Processors

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

6.2 Disclosure to Authorities

We will disclose personal data to law enforcement, government authorities, or courts when required by applicable Indian law, a valid court order, or other lawful legal process.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, personal data may be transferred to the acquiring entity. We will notify you via the App or email before your data becomes subject to a different privacy policy.

6.4 Cross-Border Transfers

Our primary servers are hosted on AWS Mumbai (ap-south-1), keeping data within India for the core backend. However, LiveKit infrastructure and FCM/APNs services involve data processing outside India. We implement appropriate safeguards for such transfers as required under applicable Indian law.

We retain personal data only as long as necessary to provide the App and comply with legal obligations.

We implement the following measures aligned with the SPDI Rules, 2011 and DPDPA 2023:

• TLS/HTTPS for all data in transit between the App and our servers.
• Encrypted local storage for authentication tokens (expo-secure-store).
• Short-lived JWT tokens for LiveKit session access.
• Short-lived presigned URLs for S3 media access — files are not publicly addressable.
• Access controls and role-based permissions on backend infrastructure.
• Firebase security for FCM token management.

Security incidents: In the event of a personal data breach, we will comply with applicable Indian law, including notification obligations under the DPDPA 2023 and IT Act, 2000.

As a data principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

Under SPDI Rules, 2011, you also have the right to review and correct sensitive personal data we hold about you.

To exercise any right, contact dhairy@rareinfoway.com. We will respond within the period prescribed by law.

The VChat App does not use browser cookies. We use device-local storage (AsyncStorage, expo-secure-store, expo-sqlite) solely to provide App functionality — authentication, message caching, and settings. These are essential to the operation of the App and are not used for advertising profiling.

The App may display links to external websites or services (e.g. in shared document previews or profile links). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies.

We will publish updated versions of this policy at https://rareinfoway.com and update the "Last updated" date. For material changes, we will notify you through the App or by SMS. Continued use of the App after the effective date constitutes your acknowledgement of the updated policy.

The Grievance Officer is available to address concerns regarding processing of your personal data in accordance with the Information Technology Act, 2000 and rules thereunder.