Privacy Policy

This Privacy Policy explains what data we collect, how we use it, how it is shared, and your rights as a user.

App Permissions Disclosure

Harborleaf may request access to certain device permissions and foreground services to ensure full functionality, live-streaming capabilities, messaging, and safety features. These permissions and services include:

• Location – Used to enable SOS alerts, safety features, nearby-rescuer assistance, and location-based content tagging.
• Camera – Used for posting photos, stories, videos, and live streams.
• Microphone – Used for live streams, screen-sharing sessions where audio is enabled, voice notes, and video content.
• Contacts – Used for adding emergency contacts, suggesting connections, and enabling messaging-related functionality.
• Photos and Media – Used for selecting, saving, and uploading photos, videos, and other supported media content.
• Notifications – Used to deliver emergency alerts, messages, live-stream notifications, account notifications, and other important service-related notifications.
• Screen Capture / Screen Sharing – When a user voluntarily starts screen sharing during a live stream, Harborleaf may capture and transmit the user's device screen to authorized viewers for the duration of the active screen-sharing session. Screen sharing starts only after the user initiates and authorizes the feature.

Each permission is requested with user consent. Users can manage or revoke applicable permissions at any time through the Harborleaf app or device settings. Background location access is used only during active SOS emergency sessions and is not used for advertising, behavioral tracking, or continuous monitoring. During an active SOS session, location information may be used by Harborleaf's emergency functionality to facilitate assistance from nearby rescuers. Location sharing through the emergency functionality ends when the active emergency session is terminated, subject to applicable technical, security, and legal retention requirements.

Foreground Service Usage

Harborleaf uses foreground services to keep essential live-streaming and emergency safety features active when the app is running in the background or when the user temporarily switches to another application.

• Live Streaming – When a user starts a live stream, a foreground service helps maintain the active live session and the required audio/video connection.
• Screen Sharing – When a user voluntarily starts screen sharing during a live stream, a foreground service helps maintain the screen-sharing session and transmit the user's device screen for the duration of the active session.
• Emergency Assistance – When a user activates an SOS/emergency alert, a foreground service helps maintain the emergency session and supports ongoing location and emergency-status updates needed to facilitate nearby-rescuer assistance.
• User Control – Foreground services are started only when the user initiates the relevant feature and are stopped when the live stream, screen-sharing session, or emergency session ends.

Harborleaf collects data to provide services, improve the user experience, facilitate safety features, prevent misuse, and maintain a safe and trusted environment. Data collection and processing are carried out in compliance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act).

a) Account Information:

• Name, email, mobile number, date of birth, gender, and other information verified via DigiLocker.
• Profile details including profile picture, bio, interests, and account type (e.g., Business, Premium & Creator).
• User preferences, language, and timezone for personalized service.

b) Content You Create:

• Posts, thoughts, comments, photos, videos, live-stream content, screen-sharing content, and other media uploaded or shared through Harborleaf.
• Metadata such as timestamps, device information, location (if shared), captions, hashtags, and tags.
• Content shared publicly, with connections, or in groups/forums on the platform.

c) Usage Information:

• Device type, operating system, app version, IP address, network information, and browser type.
• Platform interactions including likes, shares, follows, searches, clicks, views, and engagement metrics.
• Information relating to the use of live-streaming, messaging, emergency, and other platform features.

d) Payment & Transaction Data:

• Payment information for subscriptions, in-app purchases, or other commercial transactions.
• Transaction history, billing address, and receipts.
• Fraud prevention, verification, and transaction-related information used to protect users and the platform from misuse.

e) Cookies and Tracking Technologies:

• Unique identifiers used for personalized experiences, performance monitoring, security, and analytics.
• Advertising and marketing technologies, where applicable, for eligible adult accounts.
• Analytics data used to understand platform usage and improve functionality.

f) Other Information:

• User reports and complaints submitted through in-app tools or email.
• Feedback and surveys provided voluntarily by users.
• Logs of interactions with Harborleaf support teams.
• Information required to investigate abuse, fraud, security incidents, policy violations, or misuse of Harborleaf services.

Advertisements & Promotions

Harborleaf may display limited, non-intrusive advertisements to adult users. Ads are clearly labeled and separated from user content. Ad personalization is based on in-app behavior — not sensitive or personally identifiable information.

Harborleaf uses collected data for multiple purposes to ensure the platform functions efficiently, safely, and responsibly:

Service Delivery:

• Provide, maintain, and enhance Harborleaf's platform, features, and services.
• Ensure platform stability, detect bugs, and improve app performance.
• Personalize the user experience, recommendations, and content feeds.

Safety & Security:

• Enforce community guidelines, Terms of Use, and legal compliance.
• Detect, prevent, and respond to unsafe or illegal activity, including harassment, CSAE/CSAM, and spam.
• Monitor accounts to ensure safe usage, screen time compliance, and age-appropriate content.

Communication & Notifications:

• Send updates about platform changes, policies, promotions, and feature announcements.
• Deliver safety alerts, security notifications, or reminders about responsible usage.

Analytics & Research:

• Analyze user engagement, platform usage patterns, and feature performance.
• Conduct research to enhance user experience and digital wellbeing.
• Aggregated, anonymized data may be used for reports, studies, or industry insights.

Legal & Regulatory Compliance:

• Respond to law enforcement requests or regulatory investigations.
• Retain and manage data in compliance with DPDP Act 2023, IT Rules 2021, POCSO Act 2012, and other applicable laws.
• Protect against fraudulent transactions, unauthorized access, and security incidents.

Marketing & Personalization:

• Display personalized content, promotions, and advertisements.
• Measure effectiveness of marketing campaigns and partnerships.

2.3.1 Third-Party SDKs & Integrations

Harborleaf uses trusted third-party SDKs and APIs for analytics, performance monitoring, crash detection, and content moderation. These may include (but are not limited to): Firebase, Razorpay, and AI moderation APIs. Each SDK is vetted for data protection compliance and adheres to the Digital Personal Data Protection Act, 2023. SDKs are used solely for functional or analytical purposes — not for profiling or advertising without consent.

Harborleaf does not sell your data. Data sharing occurs strictly in specific, lawful circumstances:

With Authorities:

• CSAE/CSAM content reporting to law enforcement, CERT-IN, NCPCR, or relevant cybercrime units.
• Compliance with legal processes, subpoenas, or government investigations.

With Service Providers:

• Trusted partners for operational purposes such as hosting, payment processing, content moderation, analytics, and customer support.
• Partners are contractually bound to maintain confidentiality and security.

Business Transfers:

• In the event of mergers, acquisitions, or restructuring, user data may be transferred to successor entities, maintaining privacy protection obligations.

Aggregated or Anonymized Data:

• Data stripped of identifiers may be shared for research, analytics, or reporting.
• Helps Harborleaf improve safety features, product design, and user experience.

Examples of Situations Where Data May Be Shared:

• To prevent fraud, abuse, or unlawful activity on the platform.
• To provide legal evidence in cases of disputes or criminal investigations.
• To comply with Indian financial regulations for transactions and payments.

• Harborleaf retains personal data only as long as necessary for operational, legal, and regulatory purposes.
• Deleted data may persist in backups for disaster recovery or as required by law (typically up to 90 days).
• Users can request access, correction, or deletion of their data under DPDP Act 2023.

Harborleaf implements strong security measures to protect user data:

• Encryption: TLS/HTTPS for data in transit, AES-256 for data at rest.
• Access Controls: Restricted access to authorized employees and partners.
• Monitoring & Incident Response: Continuous detection of unauthorized access, phishing, or breaches.
• Periodic Security Audits: Regular assessments of systems, applications, and third-party vendors.

Harborleaf maintains security monitoring systems and incident response procedures to detect, investigate, and mitigate unauthorized access, data breaches, or cybersecurity incidents.

In the event of a significant security incident, Harborleaf may:

• Temporarily restrict access to affected systems
• Notify impacted users
• Report incidents to CERT-IN or relevant authorities
• Conduct internal forensic investigations
• Implement corrective security measures

Notifications may be provided through:

• Email
• In-app alerts
• Website announcements
• Legal or regulatory disclosures

Harborleaf continuously improves security controls to minimize operational and cybersecurity risks.

• Cookies improve platform performance, security, and personalization.
• Types of cookies:
  • Essential Cookies: Required for app functionality.
  • Performance Cookies: Track platform usage for optimization.
  • Advertising Cookies: Serve personalized ads to adult accounts.
• Users can manage cookies via browser or app settings and opt-out of non-essential cookies.

• Harborleaf uses AI and algorithms for:
  • Content recommendations, feed ranking, and trend analysis.
  • Detecting unsafe content, grooming, or CSAE/CSAM activity.
• Users may request a review of automated decisions affecting account restrictions, content visibility, or recommendations.

Harborleaf uses automated systems, artificial intelligence, and machine learning technologies to support:

• Content moderation
• Safety detection
• Spam prevention
• Fraud monitoring
• Recommendation systems

Automated systems may occasionally make errors, including false positives or incorrect restrictions. Users may request human review of:

• Content removals
• Account restrictions
• Recommendation limitations
• Automated moderation decisions

Harborleaf combines AI moderation with human oversight to improve fairness, safety, and accuracy. Appeals may be submitted through in-app support tools or support@harborleaf.in.

Data Deletion Requests

Users can request deletion of their data through the in-app "Privacy Settings" or via email at support@harborleaf.in. Upon verification, data deletion requests are honored within 15 working days, unless retention is required by law.

For transparency, Harborleaf provides a public-facing data deletion form at www.harborleaf.in/privacy/delete (optional to implement later).

Users have the following rights:

1. Access your personal information.
2. Correct inaccurate or incomplete data.
3. Delete personal data, subject to legal retention requirements.
4. Restrict processing for specific purposes.
5. Withdraw consent for optional data use (marketing, cookies).
6. Data portability for applicable personal information.

Requests can be submitted to: support@harborleaf.in

• Data may be stored or processed outside India by trusted service providers.
• Transfers comply with Indian laws and ensure adequate data protection measures.
• Data is handled securely and used only for legitimate operational purposes.

Google Play Data Safety Compliance Summary

In accordance with Google Play's Data Safety requirements, Harborleaf transparently discloses how user data is collected, used, shared, and protected:

• Data Collected: Account info, content data, usage data, device info, and permissions-based data (e.g., location, camera).
• Purpose: Service functionality, personalization, safety monitoring, and analytics.
• Data Sharing: Only with trusted service providers or legal authorities under compliance.
• Security Measures: AES-256 encryption at rest, TLS/HTTPS in transit.
• User Rights: Access, correction, deletion, opt-out, and data portability.
• Storage: Encrypted AWS India servers.
• Transparency: Users can review the full policy via in-app "Data Safety" section.

• Harborleaf updates this policy periodically to reflect new services, legal requirements, or security improvements.
• Material changes are communicated via in-app notifications, email, or website announcements.
• Continued use of Harborleaf constitutes acceptance of updated policies.

Harborleaf provides optional emergency safety features designed to help users during unsafe or emergency situations. When users manually activate the SOS feature, Harborleaf may temporarily collect and process:

• Real-time GPS location
• Device movement/location updates
• Emergency contact details
• Device and network metadata necessary for emergency alert transmission

This information is used strictly for:

• Sending emergency alerts
• Sharing live location with trusted contacts
• Assisting emergency coordination
• Safety escalation and response support

Location access for SOS functionality is activated only:

• During manual SOS activation
• When explicitly permitted by the user

Harborleaf does not continuously track users in the background outside approved emergency functionality.

Emergency-related location data is encrypted and retained only for the minimum period necessary for:

• Safety purposes
• Fraud prevention
• Legal compliance
• Dispute resolution