Privacy Policy

1. Information We Collect

In compliance with the Indian Digital Personal Data Protection (DPDP) Act, 2023 and the Google Play Developer Policy (Data Safety), we strictly collect and process only the minimal data necessary to provide and personalize our news intelligence services:

• Account & Authentication Data: When you sign in via Google Sign-In or Firebase Authentication, we collect your name, email address, profile picture URL, and unique Firebase UID. Optionally, you may provide your phone number, date of birth, country, and gender to personalize regional content delivery.
• User Preferences & Activity: Selected news topics/niches, bookmarked stories, reading history, search queries, language settings (e.g., English, Hindi, Odia), and WhatsApp notification opt-in preferences.
• Audio & Playback Telemetry: Audio playback progress, cast listening durations, and track-player state to resume audio briefings smoothly across sessions.
• Technical & Device Information: Device model, OS version, approximate IP location (country/city level for regional news curation), network type, crash logs, and anonymized performance telemetry.
• Waitlist Submissions: Email addresses submitted on the web landing page for product access updates and verification tokens.

2. How We Use Your Data

Your personal information is processed exclusively for the following transparent purposes:

• Delivering personalized AI-synthesized news summaries, 5Ws briefings, and ELI5 explainers.
• Streaming studio-quality localized audio casts via the Xp37 audio pipeline.
• Managing your authenticated profile, bookmarks, and cross-device synchronization.
• Sending critical service notifications, security alerts, and opted-in breaking news updates.
• Diagnosing app crashes, optimizing edge network latency, and improving platform reliability.

* We NEVER sell, rent, monetize, or broker your personal data to third parties or advertisers.

3. Third-Party Service Processors & Infrastructure

We partner exclusively with enterprise-grade cloud and security providers that uphold strict data confidentiality agreements:

• Google Cloud Platform & Firebase: Manages identity authentication, secure database storage (Cloud SQL), and operational telemetry.
• Cloudflare: Provides edge network caching, DDoS mitigation, and secure audio media hosting (R2 Storage).
• AI Language Providers & Sarvam AI: Powers speech synthesis and text comprehension. User personal data is never transmitted to train external public foundation models.
• Formspree: Encrypted proxy for landing page waitlist inquiries.

4. Data Security, Retention & Storage

All user data is encrypted in transit using industry-standard TLS 1.3 encryption and encrypted at rest using AES-256 protocols. Primary data workloads are hosted in secure regional cloud data centers located in India (asia-south1). We retain user data only for as long as your account remains active or as required by applicable Indian laws.

5. Account Deletion & User Data Rights (Google Play Compliant)

In strict compliance with Google Play Store User Data policies and the DPDP Act 2023, you have full sovereignty over your data. You may request account and data deletion at any time:

6. Children's Privacy Protection

Xplofy is designed for general audiences and is not directed to children under 13 years of age (or under 18 years without verifiable parental consent in accordance with the Indian DPDP Act). We do not knowingly collect personal identifiable information from children. If you believe a child has provided data without consent, contact us immediately for prompt deletion.

7. Statutory Grievance Redressal Officer

In accordance with the Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, the details of our designated Grievance Officer are: