PRIVACY POLICY

Last updated: 1 November 2026

1. WHO WE ARE AND SCOPE

This Privacy Policy explains what information Hynk ("the App", "we", "us") collects, why, how we use and protect it, and what rights you have. It applies to all users of the App and is incorporated into our Terms & Conditions. By using the App you accept the practices described here. The App is designed around a privacy-first architecture: we collect the minimum data needed to operate a mutual-intent matching service, and several categories of data are never collected at all (see section 3).

2. DATA WE COLLECT

2.1 Phone number. Your number is verified during registration and password recovery using a one-time code delivered through WhatsApp. We store the number so that reveals can deliver a usable contact detail. We also store a SHA-256 hash of the normalized number for matching. Passwords are stored as password hashes, not plaintext.

2.2 Profile data you provide: display name, gender, date of birth (to enforce the 18+ requirement), and an optional profile photo.

2.3 Address-book matching. Contact names and phone numbers are normalized and hashed on your device. The hashes are sent to our server to find which contacts use Hynk and to support contact-joined notifications. We do not upload contact names or plaintext numbers for matching. These deterministic hashes are pseudonymous identifiers; they are not irreversible anonymization.

2.4 Intents and matches. The intent categories you select toward a contact, and the resulting match records, including which reveals each side purchased.

2.5 Hynk Wallet ledger. We keep append-only balance records for top-ups, reveals, undo payments, bonuses and authorized adjustments. Historical intent and invitation charges remain in the ledger for purchase recovery, support and disputes.

2.6 Purchase data. Android purchases are processed by Google Play and website purchases by Razorpay. We store the checkout action and quantity, provider order/payment identifiers, verification state and resulting action records for purchase recovery and support. Google Play purchase tokens are retained while verification or consumption needs recovery. We do not receive or store your complete payment-card details.

2.7 Feedback and support content you voluntarily submit, including optional images.

2.8 Technical data: push-notification identifier for match and reveal notifications, and basic app-version/device metadata needed for debugging and abuse prevention.

2.9 Referral activity: which referral code you used at signup, if any.

2.10 Private chat. We store messages, photo and video files, participants, send times, view state and media-expiry data to provide in-app chat. Chat is currently server-stored and access-controlled; it is not end-to-end encrypted.

2.11 Personal sharing and historical invitations. Current sharing options open your chosen app so you can share Hynk yourself. That platform processes your message under its own terms and privacy policy; your identity may be visible to the recipient. Anonymous invitations are not available in the current app or website. Historical invitation records, including recipient hash, inviter, delivery request and charge, remain for support and dispute handling.

2.12 Payment reviews. We store checkout identifiers, verified provider payment states and review outcomes when a refund, reversal or dispute requires wallet review. A pending review can temporarily restrict wallet spending and new top-ups.

2.13 Optional bio and suggestions. Your optional bio may be shown to signed-in people who open your contact, subject to blocking. Intent suggestions and other feedback are stored with your account ID and are not publicly listed.

3. WHAT WE DELIBERATELY DO NOT DO

3.1 We do not upload your contact names or plaintext phone numbers for contact matching. Matching uses the hashes described in section 2.3. Personal sharing and historical invitation records are described in section 2.11.

3.2 Match identity and matched-intent details stay hidden until a mutual match and a reveal by either participant. That reveal unlocks the connection for both participants without a second payment. Your optional bio is separately intended for people opening your contact, as described in section 2.13. You may also choose to share information in chat.

3.3 We do not sell personal data, share it with advertisers, or operate any advertising or third-party tracking SDKs.

3.4 We do not read your conversations on other platforms. Private chat opens for both people after either participant reveals the match.

3.5 We do not use your data for purposes unrelated to operating the App.

4. LEGAL BASIS AND PURPOSES OF PROCESSING

We process your data to: (a) create and secure your account (OTP verification); (b) operate matching between secure private identifiers; (c) maintain your Hynk Wallet balance and purchase history; (d) deliver notifications about matches and reveals; (e) provide support and resolve disputes; (f) detect and prevent fraud, abuse, and violations of the Terms; (g) comply with legal obligations. Our legal bases are performance of the contract with you, consent where required (which you give at registration and may withdraw for optional processing), legitimate interest in keeping the service secure, and compliance with law.

5. HOW REVEALS WORK

Inside a mutual match, either party may complete a purchase to reveal the other's identity and intent together. One reveal unlocks these details for both participants without a second payment. Private chat opens for both people after either participant reveals the match. We log that a reveal happened (for billing and safety) but the App design already assumes a revealed detail may be saved by its recipient, which is why reveals require mutual intent first.

6. SHARING OF DATA

6.1 We share the minimum data with the following categories of processors, under contractual confidentiality obligations: Meta (WhatsApp for verification codes; historical invitation delivery), Google (Google Play for billing; Firebase Cloud Messaging for notifications), Razorpay (website payment processing), and our cloud hosting provider (which stores the database and media).

6.2 We may disclose data where required by law, court order, or to protect the rights, property, or safety of our users, ourselves, or the public.

6.3 If the business is ever transferred (merger, acquisition), data may transfer subject to this Policy.

6.4 We never sell your personal data.

7. DATA RETENTION

7.1 Account data, intents, matches, and the wallet ledger are kept while your account is active.

7.2 Once the server confirms account deletion, active sessions end and we remove identifying profile fields, unmatched interests, chat messages, contact-discovery records and support submissions from the live service. Private media access ends immediately; files are queued for deletion with retries if storage is temporarily unavailable. Limited transaction and safety records, and a credential-revocation identifier, may remain for security, dispute resolution and applicable legal obligations. They are not accessible through a deleted account.

7.3 De-identified, aggregated statistics (for example, total intents sent per day) may be retained indefinitely and cannot identify you.

7.4 Backup copies may persist until they are replaced under the hosting retention schedule. They are not available through the App. We must not restore a deleted account to active use from a backup.

8. YOUR RIGHTS

Subject to applicable law (including the Digital Personal Data Protection Act, 2023 (India) and, where applicable, the GDPR), you have the right to:

8.1 Access: request a copy of the personal data we hold about you.

8.2 Correction: correct inaccurate profile data (most fields are editable in-app).

8.3 Deletion: use Settings → Account → Delete account or the account removal option in Help. You can also request deletion without reinstalling the App at https://hynk.world/delete-account.html or by emailing [email protected]. We verify account ownership before acting on an external request. Deletion and limited retention are described in section 7.

8.4 Withdraw consent: where processing is based on consent, withdraw it (contact us); this may limit features.

8.5 Grievance redressal: raise a complaint with our Grievance Officer (see section 11), and you may escalate to the Data Protection Board of India where applicable. You can exercise these rights via the App's support channels; we respond within the timelines required by law.

9. SECURITY

Your privacy matters. Production API connections use HTTPS. Authentication, per-resource authorization and reveal permissions protect access to private data. Server sessions can be revoked, and private media requests are checked for ownership, connection access and expiry. Device screenshots are blocked in production Android builds where supported. Chat is not currently end-to-end encrypted: messages are stored on our servers. Authorized service operations may require access, and an intended recipient may retain content, including with another device. Timers and screenshot controls cannot guarantee that a delivered image will disappear from every possible copy. No system can guarantee 100% security. We work to prevent unauthorized access and review issues as they are discovered.

10. CHILDREN

The App is strictly for users aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to a minor, we delete it and its data. If you believe a minor is using the App, please report it via Preferences → Contact us.

11. GRIEVANCE OFFICER AND CONTACT

For privacy questions, data access or deletion requests, or complaints: email [email protected] or use Settings → Contact us, addressed to the Grievance Officer. We acknowledge requests within 24 hours and endeavour to resolve them within 15 days.

12. CHANGES TO THIS POLICY

We may update this Policy from time to time. Material changes will be notified in the App with a reasonable notice period. The "last updated" date above always reflects the current version. Continued use after an update means you accept the revised Policy.

For current checkout, purchase tokens are cleared after completed provider consumption. Historical purchase identifiers and financial records remain stored for recovery and dispute handling. We do not receive or store your complete payment-card details. Hynk Wallet uses the existing balance and ledger; it is not a bank account or a cash-out service.

Existing matches after account deletion Existing mutual matches remain available to the other participant after deletion. They can still reveal your name, phone number and matched intent. Your avatar and chats are removed, and chat with the deleted account is unavailable.