Privacy Policy

This Privacy Policy explains how Zickr ("we", "us", "our") collects, uses, stores, and protects information when you use the Zickr mobile app and related services (the "App"), including zickr.app.

1. Who we are

Zickr is an event discovery and participation platform with features such as event maps, event hosting, join approvals, vibe video submissions, QR ticketing, chat, and paid ticket checkout. For privacy questions, contact support@zickr.app.

2. Information we collect

We collect information you provide, information generated through your use of the App, and limited technical data needed to operate and secure the service.

• Account and profile: display name (where provided), username, email address, date of birth (to confirm you are 18+), optional gender, profile photo, and related profile settings. Gender is optional at signup. You may be asked to set gender later only when joining an event that uses a gender preference (for example, boys-only or girls-only). You can use core browsing and open events without providing gender.
• Authentication: sign-in data when you use email/password, Google, or Sign in with Apple (where available on your platform). We do not receive or store your Google or Apple account passwords. When you use Sign in with Apple, we use the name and/or email Apple provides (including a private relay email if you choose Hide My Email) and do not require you to re-enter name or email already supplied by Apple.
• Event data: events you create or join, public/private visibility, access codes for private events, gender preference settings on events, custom join questions and your answers, follow requests, bookmarks, approvals, and participation history.
• Content you upload: approval vibe videos (which may include audio), event posts/media, profile photos, and chat messages.
• Location data: addresses, city, pincode, and map coordinates you or a host enter for events; and precise device location only if you grant permission (for optional nearby discovery and map centering). The App remains usable if Location Services are off: you can choose a city or location manually and continue browsing, hosting, and joining.
• Ticketing and entry: ticket/payment records, QR codes, and scan/check-in logs. On supported devices, the App may restrict screenshots or screen recording on ticket screens to reduce ticket fraud.
• Safety and moderation: reports you submit (about an event, about another user's profile, or as a host about an applicant's vibe clip), including your device type and, if you allow location access, your approximate location at the time of reporting (used only for safety review); user blocks and related alerts to our team, related notes, and account status actions (warnings, suspension, ban) used for safety and enforcement.
• Device and security data: device type, platform, brand/model (where available), push notification token (FCM), a hashed device identifier used for login-security alerts, IP address, timestamps, and server-side security or delivery logs.
• Ad measurement (Android app only): your device's advertising ID and app events (app install, app open, sign-up completed, join request sent, event saved, and ticket purchase amount), sent to Meta to measure our ads. See Meta in section 5.
• Payments and settlements: order/payment status, amounts, fee and refund calculations, payment method metadata, and host payout setup data (including bank account details used for verification, mobile number provided for payouts, PAN, and address). Card numbers, UPI PINs, and full payment credentials are entered in our payment partner's checkout and are not stored by us. Full bank account numbers for hosts are stored with encryption and access controls.

What we do not collect / require

• We do not require a phone number for general account registration. Hosts who set up payouts provide a mobile number for payout account setup only.
• We do not require gender to create an account or to use the App generally.
• We do not require device location to use the App; GPS is optional.
• We do not sell your personal data.
• We do not show ads inside the App. The only advertising SDK is Meta App Events in the Android app, used to measure our own ads (see section 5). The iOS app does not use any advertising SDK.
• We do not use dedicated crash-analytics tools.
• Face detection during vibe video recording uses on-device Google ML Kit processing to help verify that a face is present in your submission; we do not upload camera frames to Google for that feature.

3. How we use your information

• Provide core app features (map discovery, event hosting, join workflows, chat, QR entry, and notifications).
• Match eligibility for gender-preference events when you have set a profile gender.
• Process purchases, refunds (including guest pull-out refunds), settlement calculations, bank verification, and host payout operations.
• Send service notifications (approval requests, event updates, chats, ticket/payment status, moderation notices, blocked-user alerts for our team, and account/security alerts, including new-device sign-in alerts).
• Detect abuse, enforce policies, prevent fraud, and protect user safety (including hiding removed events from discovery, blurring chat from users you block, and reviewing reports).
• Improve product performance, reliability, and user experience.
• Measure how well our ads on Meta platforms (Facebook, Instagram) bring people to Zickr (Android app only).
• Meet legal, tax, audit, and regulatory obligations.

4. Legal basis (where applicable)

Depending on your region, we process data based on consent, contract performance, legitimate interests (security and product operations), and legal obligations.

5. Sharing and disclosure

We do not sell personal data. We may share data with service providers and partners that help us run the App, including:

• Supabase: authentication, database, file storage, and backend functions.
• Razorpay: payment processing, refunds, bank verification, and host payouts.
• Google: Google Sign-In, Firebase Cloud Messaging (push notifications), optional Google Fonts delivery, and on-device ML Kit (face check during vibe recording; processed on your device).
• Apple: Sign in with Apple on supported platforms (authentication only; we do not receive your Apple ID password).
• Meta (Facebook): Android app only. The Meta App Events SDK receives your device's advertising ID, basic device and app data (such as device model, OS version, app version, and IP address), and the app events listed in section 2, so we can measure and improve our ads. We do not send your name, email, phone number, chats, videos, or event location to Meta. Meta processes this data under its own privacy policy.
• Mapbox: map display and tiles.
• LocationIQ, OpenStreetMap Nominatim, MapTiler, and postalpincode.in: geocoding, place search, area boundaries, and pincode lookup (often via our secure backend proxy).
• Dicebear: optional default avatar image URL if you skip uploading a profile photo.
• Law enforcement, regulators, or authorities when legally required or to protect rights and safety.
• Corporate successors in merger or acquisition scenarios, with appropriate safeguards.

Other Zickr users may see information you choose to share according to the feature. For example, your username, profile photo, gender (if set), and age may be visible to hosts reviewing join requests. Hosts can view information submitted for event participation (such as join answers and vibe videos) as needed to run events. Guests do not see a host's PAN, full bank account number, or payout address.

6. Data retention

We retain data while your account is active and as needed for support, security, disputes, finance records, and legal compliance. If you delete your account, we delete or anonymize most personal data, but some payment, payout, moderation, and audit records may be retained where required by law or for fraud prevention.

7. Security

We use technical and organizational controls, including encrypted transport (HTTPS/TLS), access controls, row-level database policies, and encrypted storage for sensitive host payout account numbers. No system is completely secure.

8. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or withdrawal of consent. Contact support@zickr.app with subject Privacy Request.

Ad measurement opt-out (Android): open your phone's Settings > Google > Ads (on some phones Settings > Privacy > Ads) and choose Delete advertising ID or Opt out of Ads Personalization. You can also review and disconnect activity shared by apps in your Facebook or Instagram account under Your activity off Meta technologies.

9. Account / data deletion

You can delete your account from in-app Settings (where available) or by emailing support@zickr.app with subject Data Deletion Request. Deletion may be blocked while you are actively hosting or co-hosting non-cancelled events. We may retain limited records where legally required. Permanently banned accounts cannot sign in; contact support if you believe this was applied in error.

10. Children

The App is intended for users 18+ and is not directed to children. See our Child Safety Standards.

11. International transfers

Data may be processed on systems located outside your state or country (including outside India), with reasonable safeguards where required by law.

12. Changes to this policy

We may update this policy from time to time. We will update the "Last updated" date and may provide additional notice for material changes.

13. Contact

Email: support@zickr.app
Subject: Privacy Request / Privacy Grievance