Privacy Policy

1.Who we are and what this covers

Zinola is a neighborhood network based in Chennai, Tamil Nadu. This policy explains how Zinola handles personal data on zinola.in, business.zinola.in and our phone apps (together, the “Service”). For this data, Zinola is the data fiduciary (the controller) under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), and we also follow the Information Technology Act, 2000 and its rules on sensitive personal data where they apply.

It sits alongside our Terms of Use and Community Guidelines. Questions about privacy go to privacy@zinola.in.

2.What we collect

We collect only what the Service uses. Each item below says what it is and where it comes from.

1. 2.1Your account and profile. Your name and email address; a phone number if you add one (phone sign-in and phone verification are currently switched off, but the field exists); either a password, which we store only in hashed form, or your Google or Apple sign-in. Your username, bio and photo if you add them. The basics we ask for — your gender, date of birth, how you’d like to be addressed and your language style (Simple or Friendly) — which we use to word the app to you, such as greetings and birthday wishes, and to check you are at least 13. These basics are not shown on your profile.
2. 2.2Account settings and history. Your helper character settings and helper progress (streaks and points); which version of the Terms you accepted and when; how you found Zinola (who invited you, if anyone, how their link was shared and what it pointed to, or the campaign or website that sent you, or the name you gave when we asked who invited you); and, if you sell on the marketplace and choose to add one, your UPI ID, which is copied into payment requests you send. Every link you share from Zinola carries a short code that identifies you as the sharer, so the person you invite can be counted as yours.
3. 2.3Location. The city and area you choose (also kept in cookies, see Section 8). On the phone apps, and only with your permission, your phone’s location while the app is open — never in the background. We keep these location points for up to 180 days and use them for nearby rings (what counts as near you) and for “places you’ve been”. You can also add place visits yourself. Turning off “Remember places” deletes the stored location points and the visits we detected from them; visits you added yourself stay. On the website, your browser’s location when you tap “use my location”. Any location you choose to share in a chat. When you ask to join a circle, its managers may see roughly how far you are from it.
4. 2.4Contacts, only if you use Find friends. Find friends is optional. Each phone number in your contacts is turned into a one-way key on your phone, and keyed again on our server with a secret value; names and everything else in your address book never leave your phone. We keep the keys for up to 365 days from your last sync and delete them when you turn sync off. Only people who have chosen to be discoverable are matched. Separately, if you share a contact card in a chat or post, the name and number on that card are sent with it.
5. 2.5What you post and send. Posts, replies, reviews (including earlier versions of a review you edited), listings, circle messages (text, photos, documents, locations and contact cards), direct messages, enquiry chats and business enquiries — a business receives its own copy of an enquiry, including your name, phone number and message. Reports you make. People you block, with the reason if you give one, which moderators can see. Your answers to a circle’s join questions, which that circle’s managers can see.
6. 2.6Interests. Your yes/no answers to occasional interest questions and in Settings → Your interests, and signals from what you do on content tagged with topics. Section 4 explains this in full.
7. 2.7Device and security. Your IP address and the approximate city it points to; your device, operating system, browser and app version; where you signed up and last signed in. Activity records of the actions you take, with the IP address and browser, for security and abuse prevention — kept 365 days. Sign-in records are kept 180 days and a session lasts 30 days. The IP address stored on posts, listings and circles you create, and on your sign-up and last sign-in, is erased after 180 days. The app also sends a random id made for each install (not a hardware id), so we can notice when one person has two accounts on the same phone and ask whether to join them — kept 90 days after the install was last used.
8. 2.8Usage. Searches, including ones that found nothing, and taps on business listings (such as call, WhatsApp or directions), with your user id if you are signed in or an anonymous visitor id if not — kept 90 days; daily totals without personal identifiers are kept longer. Notification records are kept 90 days and push delivery logs 14 days.
9. 2.9Analytics. PostHog receives the pages and screens you view, including their web address (which can include a search term or a profile handle), and named product events such as posting a listing. It identifies you only by your user id — never your name or email — and session recording and automatic click capture are off. On the website in production, Google Analytics 4 receives page views. The phone app and our servers send to PostHog directly; the website sends through our own domain.

3.How we use it

We use personal data to:

1. 3.1run your account, sign you in and keep you signed in;
2. 3.2show you posts, listings, businesses and people near the place you chose, and rank feeds for you (see Section 4 and How ranking works);
3. 3.3deliver messages, enquiries and notifications by push, email and, where enabled, SMS;
4. 3.4word the app to you — your language style, how you’d like to be addressed, birthday wishes;
5. 3.5check that you meet the minimum age;
6. 3.6keep the Service safe: detect spam and abuse, act on reports, enforce our Community Guidelines and investigate misuse;
7. 3.7understand how the Service is used, show businesses how their pages are doing, and improve the product;
8. 3.8meet legal obligations and respond to lawful requests.

4.Interests and personalization

1. 4.1What you tell us. From time to time we may ask whether a topic interests you, and you can answer yes or no to topics in Settings → Your interests. You can change or clear these answers at any time.
2. 4.2What we infer. When you like, save, enquire about or post content tagged with a topic, or tap a festival page, we add to a score for that topic. We keep one score per topic. Each post and listing is tagged with topics and keywords taken from its words.
3. 4.3How it is used. To rank your feeds — a small boost for topics you said yes to and a small dip for topics you said no to — and to decide which interest questions and festival pages to show you. It is not used for advertising; we show no ads.
4. 4.4How long. Your stated answers last until you change or clear them. The behavior score is kept while your account exists. The log of individual signals behind it is kept 365 days.

5.Who can see what

1. 5.1Public by default. Your public profile, posts, listings, reviews and business pages can be seen by anyone, including people who are not signed in and search engines.
2. 5.2Circles. Content in a closed or invite-only circle is visible only to its members. Door numbers follow the circle’s setting — visible to members, or to admins only. Join-question answers are visible to the circle’s managers.
3. 5.3Private conversations. Direct messages and enquiry chats are visible to the people in them.
4. 5.4Phone numbers on posts. A contact phone number on a post is hidden from readers who are not signed in.
5. 5.5Your settings. With a private account, only followers you approve see what you share with followers. With discoverable turned off, you are hidden from the people directory, search, suggestions and contact matching.
6. 5.6Zinola staff. Our team can access circle chats, reported messages and account records where needed to run and protect the Service.

6.Who else receives it

We don’t sell personal data and we show no ads. We use the providers below to run the Service; each receives only what its job needs.

1. 6.1Vercel — hosting (Mumbai region) and Vercel Blob — storage for uploaded files.
2. 6.2MongoDB Atlas — our database (Mumbai).
3. 6.3Resend — email.
4. 6.4MSG91 — SMS: sign-in codes when phone sign-in is enabled, and messages businesses send to their customers.
5. 6.5Expo push service, with Apple (APNs) and Google (FCM) — delivering notifications to your phone.
6. 6.6PostHog — product analytics, stored in the United States.
7. 6.7Google Analytics — website analytics.
8. 6.8Google and Apple — sign-in, if you choose to use them.
9. 6.9Google Places — what you type when searching for a place, and the map location when you share a place in a chat; and Google Maps on Android.
10. 6.10GIPHY — when you pick or view a GIF, your device loads it from GIPHY.
11. 6.11Meta (WhatsApp, Instagram, Messenger) — only for businesses that connect those channels to talk to their customers.
12. 6.12IndexNow and search engines — only the addresses of public pages.

7.Where your data is stored

Our hosting, file storage and database are primarily in India (Mumbai). PostHog stores analytics data in the United States. Some providers — such as Google, Apple, Expo, Resend and GIPHY — may process data outside India to do their part. We transfer data abroad only as the DPDP Act and other Indian law permit.

8.Cookies and storage on your device

The website uses the cookies below. None is used for advertising. Your browser also keeps some things in its own storage — drafts, recent searches and tips you dismissed — which stay on your device and are not sent to us. The phone app stores similar preferences on your phone and keeps your sign-in in the phone’s secure storage.

9.How long we keep it

Most of your data lasts as long as your account does. Some records expire on their own schedule, whether or not you still have an account:

10.Deleting your account

You can delete your account in Settings → Delete account. Deletion is immediate and permanent. If you would rather take a break, deactivate instead: it hides everything, and signing back in undoes it.

1. 10.1What is deleted. Your profile and sign-in; your posts, replies, reviews and listings; circles you own, with their content; your circle messages; your likes, saves, follows and memberships; your contact keys; your location points and place visits; your notification settings and push tokens; reports you made; your sign-in records; and the photos on all of these.
2. 10.2What is kept. To be honest about it: activity and security records, until their 365-day expiry; bookings and business enquiries, with your name and phone number removed — but each business’s own copy of an enquiry you sent keeps what you sent; marketplace chats you started on other people’s listings; your interest answers and scores; blocks you made or that name you; votes and RSVPs on other people’s posts; business claims, feedback and waitlist entries; and records we must keep by law. Document attachments you sent in chats may remain.
3. 10.3Email privacy@zinola.in and we will look at removing anything that remains.

11.Photos and files you upload

1. 11.1Uploaded files are stored in Vercel Blob at long, unguessable web addresses. Anyone who has the exact address can open the file — this includes photos shared in closed circles and in chats.
2. 11.2Photos on content removed by moderation are deleted after 30 days. Replacing your profile photo deletes the old one.
3. 11.3Photos are usually re-compressed when uploaded, which removes most embedded details (such as camera data or location). A photo that is already small may be uploaded as it is, with those details intact.

12.Your rights and choices

Under the DPDP Act you have the right to:

1. 12.1Access a summary of the personal data we hold about you and how we use it;
2. 12.2Correct or update it — most of it directly in your profile and settings;
3. 12.3Erase it, by deleting your account (Section 10) or asking us;
4. 12.4Withdraw consent — turn off location, contact sync, notifications, or clear your interest answers;
5. 12.5Nominate someone to exercise these rights for you in the event of your death or incapacity;
6. 12.6Grievance redressal — complain to us, and if you are not satisfied, to the Data Protection Board of India.

13.Children

1. 13.1You must be at least 13 to use Zinola. We ask your date of birth to check this. If you are under 18, you need the consent of a parent or guardian.
2. 13.2We don’t knowingly track children or build profiles of them for targeted advertising — we show no ads at all.
3. 13.3A parent or guardian can write to privacy@zinola.in to review or delete a child’s account.

14.Artificial intelligence

1. 14.1We don’t send your data to AI services today.
2. 14.2In future, interest data — ids, topics, scores and events, never the text of your messages — may be used to train recommendation models run by or for Zinola.
3. 14.3We will update this policy before using any external AI service with personal data.

15.Security

We encrypt data in transit (HTTPS), store passwords only in hashed form, key contact numbers with a secret value, limit access to staff who need it, and keep audit logs of sensitive actions. No system is perfect. If you think something is wrong, tell us at privacy@zinola.in.

16.Changes to this policy

When this policy changes in a way that matters, we will say so in the Service rather than quietly moving the date at the top. The version and dates above show which text is current.

17.Contact and grievance officer

Zinola, Chennai, Tamil Nadu. For privacy questions, requests and grievances: privacy@zinola.in. For anything else: hello@zinola.in.