Privacy Policy

Social2All is operated by d, [Registered address — to be published] (“we”, “us”). We are the data fiduciary for the personal data described here, under India’s Digital Personal Data Protection Act, 2023. Questions: [Privacy email — to be published] or the contact form.

• Account: the email address or mobile number you verify, your username, display name, optional bio, website and profile photo, and the date of birth you declare at sign-up (never shown publicly).
• Content: posts, comments, stories, reels, highlights, direct messages and media you share. Location metadata (GPS) is stripped from uploaded photos.
• Activity: follows, likes, saves, blocks and mutes; views and impressions used for feeds and creator insights; watch history, which you can turn off and clear.
• Security: sessions, device type, browser, IP address and security events, used to protect your account and prevent abuse.
• Payments: billing name, state and optional GSTIN, invoices and payment references. Card, UPI and bank details are handled by our payment processor; we never see or store them.
• Support: what you tell us through the contact form, including your name and email.

• To provide the service: your profile, feeds, messaging, communities, notifications and subscriptions.
• To keep people safe: detecting spam and abuse, reviewing reports and enforcing our Community Guidelines.
• To show relevant, clearly labelled “Sponsored” posts based only on hashtags of posts you liked in the last 30 days.
• To bill you, issue GST invoices and meet tax and accounting obligations.
• To respond to your requests and to lawful requests from authorities.

We process your data on the basis of the consent you give when you create an account and accept this policy, and for legitimate uses permitted by law (such as complying with a legal obligation or responding to an emergency). We record which version of this policy you accepted and when. When we change it materially we ask you to review and accept the new version.

We do not sell your personal data. We share it only with service providers who process it for us under contract:

• Razorpay — payment processing;
• an SMTP email provider and Twilio — delivering sign-in codes;
• Google Firebase Cloud Messaging — push notifications;
• our hosting, database, object storage and CDN providers.

We may disclose data when required by law, a valid court order, or to protect someone from imminent harm. Content you make public is visible to anyone, including people without an account.

• Account data and content: until you delete them or your account. Account deletion completes 30 days after you request it.
• Stories disappear after 24 hours unless you archive or highlight them.
• Sign-in codes are stored only as one-way hashes and expire after 10 minutes.
• Invoices and payment records are kept as long as tax and accounting law requires, even after account deletion.
• Security logs, reports, moderation decisions and support requests are kept to handle safety issues and lawful requests.

• Access: download a copy of your data from Settings → Account → Download your data.
• Correction: edit your profile and settings at any time.
• Erasure: delete your account; signing in again within 30 days cancels it.
• Privacy controls: make your account private, block or mute people, turn off watch history, and manage notifications.
• Withdraw consent / grievances: contact our Grievance Officer. You may also approach the Data Protection Board of India.

We use encrypted connections, short-lived access tokens, hashed sign-in codes, per-community data isolation in the database and audit logging of sensitive actions. Direct messages are encrypted in transit and at rest but are not end-to-end encrypted. No system is perfectly secure; if a breach affects you we will notify you and the authorities as the law requires.

Social2All is for people aged 18 and over. We ask for your date of birth at sign-up and refuse accounts for anyone younger. If you believe a child is using the service, please tell us.

Data is stored with our hosting and storage providers. Where a provider processes data outside India, we do so only as permitted under the DPDP Act and with contractual safeguards.

We will post any changes here and update the date above. For material changes, d will ask you to review and accept the new policy before you continue posting.