Privacy Policy

1. Who we are

ChitChat is a mobile messaging application operated by Xylvin Technologies (OPC) Private Limited ("Xylvin", "we", "us"), a company incorporated in India with its registered office at 277/910, Rajeev Nagar, Mahaveeran Pura, Sipri Bazar, Jhansi, Uttar Pradesh 284003, India, CIN U62013UP2026OPC252161.

For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), Xylvin is the Data Fiduciary for the personal data described in this policy, and you are the Data Principal.

This policy explains what information ChitChat collects, why, who it is shared with, and the choices you have. It covers the ChitChat mobile app and this website.

2. What we collect

Information you give us

• Your email address — used to sign in. We send a six-digit one-time code to confirm it belongs to you. Phone number sign-in is planned; when it launches, your phone number will be collected the same way.
• Your profile — display name, profile photo and a short status line such as "Available". A display name is required; the photo and status line are optional.
• Your messages and media — the content of chats you send and receive: text, photos, video, voice notes, documents, stickers, GIFs, shared locations and contact cards.
• Status updates — photos or text you post to your status, which expire automatically after 24 hours.
• Reports you file — if you report a user or a message, we receive the report along with the content you are reporting.
• Support correspondence — anything you send us by email.

Information collected automatically

• Device and session data — a randomly generated identifier for each installation, whether that device is your primary device, and a push notification token so we can deliver message alerts.
• Presence — whether you are currently online and when you were last active. You control who can see this in Settings.
• Delivery and read status — whether a message was delivered and read. You can turn read receipts off.
• Call records — when calling launches, we will record who called whom, when, and for how long. We do not record call audio or video.
• Aggregate service counters — totals such as the number of verification codes sent and storage consumed across the whole service. These are counters only and are not linked to individual accounts.

Location

ChitChat requests location access only when you choose to share your location in a chat. When you tap Location and confirm, we read your current coordinates once and send them as a message to that conversation. We do not track your location in the background, and we do not build any location history.

3. Your contacts

To show you which of the people you know already use ChitChat, the app reads your device address book after you grant contacts permission.

Concretely, this is what happens:

• Phone numbers from your address book are normalised on your device and sent to our servers to be checked against our user directory.
• Contact names never leave your device. They are matched locally against the results.
• We do not store your address book. The numbers are used to run the lookup and are not written to our database.
• The result is cached on your device for 24 hours so the app does not have to repeat the lookup.

You can refuse contacts permission and keep using ChitChat. You will need to start conversations manually rather than seeing a ready-made list.

4. How we use your information

We do not use your messages to train machine-learning models, to profile you, or for marketing. We do not sell, rent or trade your personal data.

5. Message security

Separately, you can lock the app itself with a PIN or your device biometrics (Settings → Privacy → App lock). That protects the app on your handset and is independent of the encryption described above.

6. Who we share information with

Other users. Your display name, profile photo and status line are visible to people you chat with, subject to the visibility settings you choose. Message content is visible to the people in that conversation.

Service providers. We use the following processors, who handle data on our instructions and are not permitted to use it for their own purposes:

Legal disclosure. We may disclose information where required by applicable law, a valid order from a court or authorised government agency, or where necessary to protect the rights, safety or property of our users, the public or Xylvin.

Business transfer. If Xylvin is involved in a merger, acquisition or sale of assets, your information may transfer. We will notify you before your data becomes subject to a different privacy policy.

7. App permissions

ChitChat asks for permissions only when a feature needs them, and it keeps working if you decline — you simply lose that feature.

8. How long we keep your information

• Messages and media — kept until deleted by a participant or until the account is deleted.
• A copy on your device — ChitChat stores your conversations in a private database on your phone so they open instantly, remain readable offline, and can be searched. It is removed when you sign out or delete your account, and it is covered by the app lock if you have one set.
• Status updates — deleted automatically 24 hours after posting.
• Verification codes — expire after 15 minutes and are deleted immediately once used.
• Profile and account data — kept for as long as your account is open.
• Abuse reports — kept for as long as needed to investigate and to meet legal obligations.
• Aggregate counters — retained indefinitely, as they identify no individual.

9. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct inaccurate data, and complete or update it. Your name, photo and status can be edited in the app at any time.
• Erase your personal data — see the next section.
• Withdraw consent at any time, for example by revoking contacts, location or notification permission in your device settings.
• Nominate another individual to exercise these rights on your behalf in the event of death or incapacity.
• Complain to our Grievance Officer, and to escalate to the Data Protection Board of India if you are not satisfied.

To exercise any of these, write to privacy@xylvin.com. We respond within 30 days.

10. Deleting your account

You can delete your ChitChat account in two ways:

• In the app — Settings → Account → Delete account.
• On the web — use the account deletion request form.

Deleting your account removes your profile, your status updates, your media and your message history from our systems. Two things survive, and you should know about them: messages you sent remain in the recipient's copy of the conversation, in the same way a sent email stays in the other person's inbox; and we retain records we are legally obliged to keep, such as abuse reports under investigation.

11. Children

ChitChat is not intended for anyone under 18. We do not knowingly collect personal data from children. Under the DPDP Act, processing a child's personal data requires verifiable parental consent, and we do not currently operate such a mechanism.

If you believe a child has created an account, contact privacy@xylvin.com and we will remove it.

12. Where your data is stored

ChitChat's data is stored on Google Cloud infrastructure in the asia-south2 (Delhi) region. Some of our processors may process data outside India. Where that happens, we rely on the transfer conditions permitted under the DPDP Act and on contractual safeguards with the provider.

13. Changes to this policy

We update this policy when the app changes. If a change materially affects how we handle your data, we will notify you in the app or by email before it takes effect, and update the "last updated" date above. Continuing to use ChitChat after a change means you accept the revised policy.

14. Contact and grievances

For any question about this policy, or to exercise your rights, contact our Grievance Officer, appointed under the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:

General privacy queries: privacy@xylvin.com. Everything else: support@xylvin.com.