DPDP Act, 2023 — Data Notice
What data we process, why, and for how long
Published by VibTribe under §5 of India's Digital Personal Data Protection Act, 2023. This notice is plain-English and itemised. You can withdraw consent, export, or delete your data any time from Profile → Privacy → Consent Center.
| Data element | Purpose | Legal basis | Retention | Subprocessors | Your rights |
|---|---|---|---|---|---|
| Mobile number | Account identifier and contact discovery | Contract performance | Until account deletion | Lovable Cloud | Export, delete |
| Email address (mandatory) | OTP verification at signup, password recovery, transactional & support emails. Marketing emails only if you opt in. | Contract performance (OTP/recovery) & consent (marketing) | Until account deletion | Resend | Export, delete; withdraw marketing consent any time |
| Display name, username, bio | Profile rendering & contact identification | Contract performance | Until account deletion | Lovable Cloud, Cloudflare (CDN) | Edit, export, delete |
| Profile photo / avatar | Profile rendering. Stored in a private storage bucket; served only via short-lived signed URLs to viewers permitted by your visibility setting (All / Contacts / Nobody). No public URLs are issued. | Contract performance & granular consent (visibility setting) | Until removed by you or account deletion | Lovable Cloud (private storage), Cloudflare (signed-URL delivery) | Change visibility, remove, export, delete |
| Tribe (group) avatar | Group identification. Stored in a private storage bucket; served via short-lived signed URLs only to current members of that tribe. | Contract performance | Until removed by tribe admin or tribe deletion | Lovable Cloud (private storage), Cloudflare (signed-URL delivery) | Tribe admins may replace or remove; members may leave the tribe |
| Date of birth | Age verification. Users under 13 are blocked from sign-up. Users aged 13–17 must complete verifiable parental / guardian consent (DPDP §9) before using the app. Users 18+ sign up directly. | Legal obligation | Until account deletion (guardian consent record kept for audit) | Lovable Cloud | Export, delete |
| Guardian consent record (13–17 only) | Store the parent / legal guardian’s name, email, mobile, relationship, IP, user-agent and timestamps used to prove verifiable consent under DPDP §9. Automatically retired when the user turns 18 (historical record kept for audit). | Legal obligation | Until account deletion; retired automatically at age 18 but retained for compliance audit | Lovable Cloud, Resend (consent request email) | Guardian may withdraw consent at any time from the consent link |
| Chats, media, status, reactions (end-to-end encrypted) | Deliver messaging service. Content is end-to-end encrypted — VibTribe cannot read it. Stored only as ciphertext. | Contract performance | Auto-deleted after 24 hours by default (user-configurable); ciphertext stored only until delivered & expired, or sooner if deleted by you | Lovable Cloud (encrypted storage), Cloudflare (encrypted delivery) | Delete per-message or whole account |
| Phone contacts (hashes only) | Match which of your contacts already use VibTribe | Granular consent (Consent Center toggle) | Hashes refreshed on each sync; deletable on demand | Lovable Cloud | Withdraw consent any time |
| Device tokens (FCM / APNs / Web Push) | Deliver push notifications to Android (Capacitor app via FCM), iOS (APNs) and web browsers | Consent | Until sign-out or token expiry | Google Firebase Cloud Messaging (Android & Web), Apple Push Notification Service (iOS) | Disable in OS / app settings |
| Device & session metadata (IP, user-agent, app version) | Security, fraud prevention, debugging | Legitimate interests & legal obligation | 90 days for session logs | Lovable Cloud, Cloudflare | Export |
| Consent records | Demonstrate lawful basis (DPDP §6) | Legal obligation | Lifetime of account + 3 years | Lovable Cloud | Export |
| Incomplete sign-up reminder emails | If you verify your email but do not complete onboarding, send up to three reminders (approx. 24 h, 72 h, 7 days) to help you finish. Reminders stop the moment onboarding completes. | Legitimate interests (completing the account creation you started) | Send counters cleared on onboarding completion or account deletion | Resend | Complete onboarding or delete the account to stop reminders |
| Admin offboarding notification email | When an administrator removes an account, notify the registered email address with the reason (General, Breach of Terms & Conditions, or Incomplete Sign-up) and inform you that associated personal data is deleted immediately. | Legal obligation & legitimate interests (transparency, DPDP §5) | Email delivery log retained per Resend policy; account data deleted immediately, subject to limited legal / security / fraud-prevention retention | Resend | Grievance redressal via the Grievance Officer |
| Analytics (page views, anonymised events) | Improve product & SEO | Granular consent (Analytics cookies toggle) | 14 months | Google Tag Manager / Google Analytics | Withdraw consent any time |
Your DPDP rights
- Right to access & correction
- Right to erasure (delete account)
- Right to grievance redressal
- Right to nominate (post-death data)
- Right to withdraw consent at any time
Grievance Officer
For DPDP-related grievances, write to Labhansh.garg@outlook.com. We acknowledge within 72 hours and resolve within the timelines required by the DPDP Act, 2023 and IT Rules, 2021.
See also: Subprocessors · Privacy Policy
Notice version 1.2 · Last updated 4 July 2026 · Maintained by VibTribe