Privacy Policy

1.0 GENERAL SCOPE, ENTITY DESIGNATION, AND GOVERNING FRAMEWORK

1.1 Operational Scope: This document sets forth the comprehensive privacy guidelines enforced across all digital touchpoints provided by Swish Technologies, encompassing our iOS native build, Android native build, mobile responsive web interfaces, and backend server infrastructure.

1.2 Data Controller Identity: For the purposes of international and regional data privacy legislation, Swish Technologies operates as the primary Data Controller / Data Fiduciary in respect of personal data submitted during account creation, identity authentication, device registration, and platform communication.

1.3 Statutory Regulatory Framework: Processing activities conducted by Jiffy strictly comply with applicable statutory frameworks, including Section 43A of the Indian Information Technology Act, 2000, Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Digital Personal Data Protection Act, Apple App Store Review Guideline 5.1 (Data Privacy and Security), and Google Play Developer Program Policies concerning User Data, Device Permissions, and Analytics Disclosures.

2.0 STRICT AGE RESTRICTION AND INELIGIBILITY OF MINORS (18+ MANDATE)

3.0 CATEGORIES OF INFORMATION COLLECTED AND INGESTION PROTOCOLS

We categorize collected information under four distinct structural vectors: information explicitly provided by you, third-party public screening metrics, hardware device permissions, and automated diagnostic metrics.

3.1 Directly Disclosed Account and Profile Information

Upon initiating account onboarding, users provide discrete identifiers: (a) Authentication Telemetry: E.164-formatted mobile telephone numbers and verified Firebase Authentication unique tokens (UIDs) used to establish encrypted cryptographic sessions; (b) Biographical Demographics: Declared first name, verified chronological age / date of birth, gender identity, romantic preferences, professional title, corporate affiliation, academic alumni history, lifestyle attributes, and relational intent; (c) Media Assets: Photographs uploaded to user galleries, temporary or persistent visual story frames, and audio-acoustic snippets recorded for profile prompts; (d) Mutual Chat Interactions: Encrypted interpersonal text records exchanged between mutually validated users within ephemeral or persistent in-app messaging rooms.

3.2 Public Instagram Credibility Screening Metrics

To maintain an exclusive, high-trust creator environment, Jiffy incorporates an optional credibility evaluation during account setup:

• Public Username & Volume Metrics: We verify the user-submitted public Instagram handle against public follower benchmarks (e.g., verifying 1,000+ follower reach or active creator standing) to determine initial waitlist admission eligibility.
• Zero Credential Retention: We never solicit, request, intercept, record, or archive account passwords, multi-factor codes, or private credentials associated with Instagram or any Meta Platforms entity.
• Non-Intrusive Verification: Jiffy does not publish content, alter account biographies, follow external accounts, or access private direct messaging interfaces associated with your Instagram account.
• Platform Disclaimer: Jiffy operates as an independent platform engineered by Swish Technologies and is in no way affiliated, sponsored, associated, or endorsed by Instagram, LLC, Meta Platforms, Inc., or their corporate subsidiaries.

3.3 Device Hardware Permissions and Native Subsystem Access

Execution of core platform capabilities requires explicit user consent for specific hardware subsystems on Apple iOS and Google Android devices:

• Camera Hardware Access (android.permission.CAMERA / NSCameraUsageDescription): Required strictly for capturing real-time facial verification photographs and visual profile media. Background capture is technically precluded.
• Photo Library & File Storage (android.permission.READ_MEDIA_IMAGES / NSPhotoLibraryUsageDescription): Required strictly to allow users to select user-stored graphical assets for transmission and upload to their user profile.
• Microphone Hardware & Speech Subsystem (android.permission.RECORD_AUDIO / NSMicrophoneUsageDescription): Invoked solely when the user intentionally depresses the voice prompt recording interface to capture conversational audio. Acoustic data is streamed to authorized transcription infrastructure.
• Geographic Proximity & Location (android.permission.ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION / NSLocationWhenInUseUsageDescription): Collected while the foreground application is active to calculate geographic proximity offsets against prospective creator introductions within local municipal boundaries. Background geographic telemetry is disabled.
• Notification Subsystem (POST_NOTIFICATIONS): Used to deliver remote Apple Push Notification service (APNs) and Firebase Cloud Messaging (FCM) alerts regarding introduction events, mutual matching statuses, and chat deliveries. Users may deactivate notification dispatch via native operating system settings at any point.

3.4 Automated System Diagnostics, Telemetry, and Identifiers

During runtime interaction, technical server logs automatically compile non-sensitive hardware signatures: operating system architectural release, device model identifier, client build hash, interface language localization, unique hardware instance pseudonyms (Apple Identifier for Vendors / IDFV, Android Advertising Identifier AD_ID), execution timestamps, network latency indices, memory usage ceilings, and stack trace crash dumps.

4.0 TECHNICAL MEASUREMENT, ANALYTICS SDKs, AND ADVERTISING IDENTIFIERS

4.1 Operational Analytics: Jiffy incorporates standard measurement SDKs, including Meta App Events SDK, Google Play Core measurement libraries, and Firebase Analytics tools, exclusively to measure platform uptime, calculate aggregate conversion funnel events (e.g., successful account registrations, milestone completions), identify system bottlenecks, and fulfill mandatory reporting thresholds.

4.2 Data Boundary Limitations: Under no circumstance does Swish Technologies transmit personal identifiers, complete chat logs, biographical audio streams, full resolution unedited photo archives, or phone numbers to third-party ad networks or data broker aggregators. All measurement functions operate strictly under privacy preserving APIs, such as Apple SKAdNetwork and Google Install Referrer frameworks.

5.0 PURPOSES OF DATA PROCESSING AND LEGAL BASES

Processing of personal data is executed under the following formal legal grounds: (a) Contractual Necessity: Generating curated weekly match introductions, establishing secure session handshakes, routing peer-to-peer chat communication, and hosting multimedia profiles; (b) Legitimate Commercial Interests: Preventing unauthorized automated access (bot detection), enforcing code-of-conduct compliance, screening for impersonation, debugging software exceptions, and ensuring application resilience; (c) Statutory and Regulatory Compliance: Retaining financial or transaction records where applicable, complying with lawful warrants, and addressing binding court subpoenas issued under Indian jurisdiction.

6.0 DATA RECIPIENTS, DISCLOSURE, AND THIRD-PARTY INFRASTRUCTURE

6.1 Absolute Prohibition of Data Sale: Swish Technologies maintains an unconditional policy: We do not sell, rent, lease, monetize, trade, or barter user personal data to commercial brokers, marketing agencies, or unrelated third parties.

6.2 Peer Disclosures: Approved public profile attributes (first name, age, general geographic locality, profession, uploaded media, voice prompts, and declared interests) are rendered visible exclusively to active, authenticated members within matched recommendation pools. Phone numbers, precise GPS coordinates, and private message transcripts remain confidential.

6.3 Authorized Infrastructure Sub-Processors: Data processing operations are supported by accredited technological service providers subject to strict non-disclosure, security, and data protection agreements:

• Google Cloud Platform & Firebase (Alphabet Inc.): Encrypted cloud hosting, user session state management, telephone SMS verification gateway, and cloud database instances.
• MongoDB Atlas (MongoDB Inc.): SOC2-certified, AES-256 encrypted persistence layer for transactional application records.
• Amazon Web Services S3 (Amazon.com Inc.): Encrypted object storage bucket infrastructure (jiffystorebucket, ap-south-1) utilized for storing photographic assets.
• Deepgram Inc.: Ephemeral automated speech-to-text audio processing utilized exclusively for voice prompt transcription. Audio inputs are processed ephemerally without persistent voice model training.
• Cloudflare Inc.: DNS routing, content delivery caching, TLS certificate termination, and DDoS mitigation.

7.0 TECHNICAL AND ORGANIZATIONAL DATA SECURITY MEASURES

7.1 In-Transit Cryptography: All network exchanges between client mobile software (iOS / Android) and server endpoints are cryptographically protected using Transport Layer Security (TLS 1.3 / HTTPS) with strict cipher suite negotiation, precluding plaintext interception.

7.2 At-Rest Encryption: Production database clusters and S3 media storage repositories are encrypted at rest using Advanced Encryption Standard (AES) with 256-bit cryptographic keys. Access to cryptographic secret keys is guarded via automated secret management protocols with least-privilege administrative access policies.

8.0 DATA RETENTION LIMITATIONS AND PERMANENT ACCOUNT DELETION

8.1 Active Account Retention: Information is retained throughout the active lifecycle of your account to provide matchmaking, communication, and community access features.

8.2 Permanent Account Deletion Mechanism: Users may unilaterally terminate and permanently expunge their account records at any time. Account deletion may be initiated through two distinct pathways:

• Native In-App Pathway: Navigate to Profile > Settings > Account > Delete Account. Confirming this action initiates immediate automated deletion.
• Web-Based Self-Service Portal: Submit an authenticated deletion request directly via our designated compliance endpoint: Account & Data Deletion Web Portal.

8.3 Data Purge Workflow: Upon deletion confirmation: (a) Profile records, photographs, voice prompts, match indices, and conversation histories are immediately removed from active operational databases; (b) Associated authentication credentials in Firebase Auth are deleted; (c) Ephemeral database snapshots and cold backups cycle out of existence within thirty (30) calendar days in accordance with automated disaster recovery retention scripts.

9.0 STATUTORY USER RIGHTS AND DATA SUBJECT ACCESS

Users maintain comprehensive statutory rights over their personal information: (a) Right of Access: Review personal profile parameters and uploaded files directly within the client interface; (b) Right to Rectification: Edit, update, and modify biographical statements, photographs, and relational preferences at will; (c) Right to Erasure: Permanently erase and purge all profile instances via the deletion tools defined in Section 8; (d) Right to Consent Revocation: Revoke granted camera, photo gallery, location, or microphone permissions at any moment via native iOS Settings or Android Application Management menus.

10.0 CROSS-BORDER DATA TRANSFERS AND JURISDICTION

10.1 Server Localization: Primary application services and database repositories are hosted in secure enterprise data centers located within India and compliant international regions operated by Google Cloud Platform and AWS. By accessing the service, you consent to the cross-border transit of encrypted data packets strictly for processing by the authorized sub-processors designated in Section 6.3.

10.2 Governing Law: This Privacy Policy, and any disputes, claims, or controversies arising from data processing operations, shall be governed by and construed in strict accordance with the laws of the Republic of India, with exclusive judicial jurisdiction vested in the competent civil courts of Bangalore, Karnataka, India.

11.0 AMENDMENTS AND POLICY REVISIONS

Swish Technologies reserves the prerogative to modify or amend this Privacy Policy periodically to reflect technological updates, architectural modifications, product feature enhancements, or evolving legal frameworks. When material changes are instituted, an operational notice will be displayed within the application interface or published on this page prior to the effective date. Your continued utilization of the Jiffy application following the publication of any revision signifies binding concurrence with the modified policy terms.

12.0 STATUTORY GRIEVANCE REDRESSAL AND PRIVACY OFFICER CONTACT

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the provisions of the Digital Personal Data Protection Act, the designated Grievance & Data Protection Officer for Swish Technologies is detailed below: