Privacy Policy

This Privacy Policy explains what data we collect, how we use it, how it is shared, and your rights as a user.

App Permissions Disclosure

Harborleaf may request access to certain device permissions to ensure full functionality and safety compliance. These permissions include:

• Location – Used to enable SOS alerts, safety features, and content tagging.
• Camera – Used for posting photos, stories, and live streams.
• Microphone – Used for live streams, voice notes, and video content.
• Contacts – Used for suggesting connections and enabling the messaging module.
• Storage – Used for saving and uploading media content.

Each permission is requested with user consent. Users can manage or revoke permissions anytime through app or device settings. Background location access is used only during active SOS emergency sessions and is never used for advertising, tracking, or continuous monitoring.

Harborleaf collects data to provide services, improve the user experience, and maintain a safe environment. Data collection is done in compliance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act).

a) Account Information:

• Name, email, mobile number, date of birth, gender, and other information verified via DigiLocker.
• Profile details including profile picture, bio, interests, and account type (e.g., Business, Premium & Creator).
• User preferences, language, and timezone for personalized service.

b) Content You Create:

• Posts, thoughts, comments, photos, videos, and other media uploaded to Harborleaf.
• Metadata such as timestamps, device information, location (if shared), captions, hashtags, and tags.
• Content shared publicly, with connections, or in groups/forums on the platform.

c) Usage Information:

• Device type, operating system, app version, IP address, network information, and browser type.
• Platform interactions including likes, shares, follows, searches, clicks, and engagement metrics.

d) Payment & Transaction Data:

• Payment information for subscriptions, in-app purchases, or other commercial transactions.
• Transaction history, billing address, and receipts.
• Fraud and verification data to protect users and the platform from misuse.

e) Cookies and Tracking Technologies:

• Unique identifiers for personalized experience, performance monitoring, and analytics.
• Advertising and marketing cookies for adult accounts.
• Analytics data to understand user behavior and improve platform functionality.

g) Other Information:

• User reports and complaints submitted via in-app tools or email.
• Feedback and surveys provided voluntarily by users.
• Logs of interactions with Harborleaf support teams.

Advertisements & Promotions

Harborleaf may display limited, non-intrusive advertisements to adult users. Ads are clearly labeled and separated from user content. Ad personalization is based on in-app behavior — not sensitive or personally identifiable information.

Harborleaf uses collected data for multiple purposes to ensure the platform functions efficiently, safely, and responsibly:

Service Delivery:

• Provide, maintain, and enhance Harborleaf's platform, features, and services.
• Ensure platform stability, detect bugs, and improve app performance.
• Personalize the user experience, recommendations, and content feeds.

Safety & Security:

• Enforce community guidelines, Terms of Use, and legal compliance.
• Detect, prevent, and respond to unsafe or illegal activity, including harassment, CSAE/CSAM, and spam.
• Monitor accounts to ensure safe usage, screen time compliance, and age-appropriate content.

Communication & Notifications:

• Send updates about platform changes, policies, promotions, and feature announcements.
• Deliver safety alerts, security notifications, or reminders about responsible usage.

Analytics & Research:

• Analyze user engagement, platform usage patterns, and feature performance.
• Conduct research to enhance user experience and digital wellbeing.
• Aggregated, anonymized data may be used for reports, studies, or industry insights.

Legal & Regulatory Compliance:

• Respond to law enforcement requests or regulatory investigations.
• Retain and manage data in compliance with DPDP Act 2023, IT Rules 2021, POCSO Act 2012, and other applicable laws.
• Protect against fraudulent transactions, unauthorized access, and security incidents.

Marketing & Personalization:

• Display personalized content, promotions, and advertisements.
• Measure effectiveness of marketing campaigns and partnerships.

2.3.1 Third-Party SDKs & Integrations

Harborleaf uses trusted third-party SDKs and APIs for analytics, performance monitoring, crash detection, and content moderation. These may include (but are not limited to): Firebase, Razorpay, and AI moderation APIs. Each SDK is vetted for data protection compliance and adheres to the Digital Personal Data Protection Act, 2023. SDKs are used solely for functional or analytical purposes — not for profiling or advertising without consent.

Harborleaf does not sell your data. Data sharing occurs strictly in specific, lawful circumstances:

With Authorities:

• CSAE/CSAM content reporting to law enforcement, CERT-IN, NCPCR, or relevant cybercrime units.
• Compliance with legal processes, subpoenas, or government investigations.

With Service Providers:

• Trusted partners for operational purposes such as hosting, payment processing, content moderation, analytics, and customer support.
• Partners are contractually bound to maintain confidentiality and security.

Business Transfers:

• In the event of mergers, acquisitions, or restructuring, user data may be transferred to successor entities, maintaining privacy protection obligations.

Aggregated or Anonymized Data:

• Data stripped of identifiers may be shared for research, analytics, or reporting.
• Helps Harborleaf improve safety features, product design, and user experience.

Examples of Situations Where Data May Be Shared:

• To prevent fraud, abuse, or unlawful activity on the platform.
• To provide legal evidence in cases of disputes or criminal investigations.
• To comply with Indian financial regulations for transactions and payments.

• Harborleaf retains personal data only as long as necessary for operational, legal, and regulatory purposes.
• Deleted data may persist in backups for disaster recovery or as required by law (typically up to 90 days).
• Users can request access, correction, or deletion of their data under DPDP Act 2023.

Harborleaf implements strong security measures to protect user data:

• Encryption: TLS/HTTPS for data in transit, AES-256 for data at rest.
• Access Controls: Restricted access to authorized employees and partners.
• Monitoring & Incident Response: Continuous detection of unauthorized access, phishing, or breaches.
• Periodic Security Audits: Regular assessments of systems, applications, and third-party vendors.

Harborleaf maintains security monitoring systems and incident response procedures to detect, investigate, and mitigate unauthorized access, data breaches, or cybersecurity incidents.

In the event of a significant security incident, Harborleaf may:

• Temporarily restrict access to affected systems
• Notify impacted users
• Report incidents to CERT-IN or relevant authorities
• Conduct internal forensic investigations
• Implement corrective security measures

Notifications may be provided through:

• Email
• In-app alerts
• Website announcements
• Legal or regulatory disclosures

Harborleaf continuously improves security controls to minimize operational and cybersecurity risks.

• Cookies improve platform performance, security, and personalization.
• Types of cookies:
  • Essential Cookies: Required for app functionality.
  • Performance Cookies: Track platform usage for optimization.
  • Advertising Cookies: Serve personalized ads to adult accounts.
• Users can manage cookies via browser or app settings and opt-out of non-essential cookies.

• Harborleaf uses AI and algorithms for:
  • Content recommendations, feed ranking, and trend analysis.
  • Detecting unsafe content, grooming, or CSAE/CSAM activity.
• Users may request a review of automated decisions affecting account restrictions, content visibility, or recommendations.

Harborleaf uses automated systems, artificial intelligence, and machine learning technologies to support:

• Content moderation
• Safety detection
• Spam prevention
• Fraud monitoring
• Recommendation systems

Automated systems may occasionally make errors, including false positives or incorrect restrictions. Users may request human review of:

• Content removals
• Account restrictions
• Recommendation limitations
• Automated moderation decisions

Harborleaf combines AI moderation with human oversight to improve fairness, safety, and accuracy. Appeals may be submitted through in-app support tools or support@harborleaf.in.

Data Deletion Requests

Users can request deletion of their data through the in-app "Privacy Settings" or via email at support@harborleaf.in. Upon verification, data deletion requests are honored within 15 working days, unless retention is required by law.

For transparency, Harborleaf provides a public-facing data deletion form at www.harborleaf.in/privacy/delete (optional to implement later).

Users have the following rights:

1. Access your personal information.
2. Correct inaccurate or incomplete data.
3. Delete personal data, subject to legal retention requirements.
4. Restrict processing for specific purposes.
5. Withdraw consent for optional data use (marketing, cookies).
6. Data portability for applicable personal information.

Requests can be submitted to: support@harborleaf.in

• Data may be stored or processed outside India by trusted service providers.
• Transfers comply with Indian laws and ensure adequate data protection measures.
• Data is handled securely and used only for legitimate operational purposes.

Google Play Data Safety Compliance Summary

In accordance with Google Play's Data Safety requirements, Harborleaf transparently discloses how user data is collected, used, shared, and protected:

• Data Collected: Account info, content data, usage data, device info, and permissions-based data (e.g., location, camera).
• Purpose: Service functionality, personalization, safety monitoring, and analytics.
• Data Sharing: Only with trusted service providers or legal authorities under compliance.
• Security Measures: AES-256 encryption at rest, TLS/HTTPS in transit.
• User Rights: Access, correction, deletion, opt-out, and data portability.
• Storage: Encrypted AWS India servers.
• Transparency: Users can review the full policy via in-app "Data Safety" section.

• Harborleaf updates this policy periodically to reflect new services, legal requirements, or security improvements.
• Material changes are communicated via in-app notifications, email, or website announcements.
• Continued use of Harborleaf constitutes acceptance of updated policies.

Harborleaf provides optional emergency safety features designed to help users during unsafe or emergency situations. When users manually activate the SOS feature, Harborleaf may temporarily collect and process:

• Real-time GPS location
• Device movement/location updates
• Emergency contact details
• Device and network metadata necessary for emergency alert transmission

This information is used strictly for:

• Sending emergency alerts
• Sharing live location with trusted contacts
• Assisting emergency coordination
• Safety escalation and response support

Location access for SOS functionality is activated only:

• During manual SOS activation
• When explicitly permitted by the user

Harborleaf does not continuously track users in the background outside approved emergency functionality.

Emergency-related location data is encrypted and retained only for the minimum period necessary for:

• Safety purposes
• Fraud prevention
• Legal compliance
• Dispute resolution