Privacy Policy

What we collect

• Your account: a username you choose and a password. The password is stored only as a one-way hash; nobody, including us, can read it.
• Your email address and Indian mobile number: each is confirmed with a 6-digit code and then stored only as a one-way fingerprint, never as the address or number itself. The fingerprint keeps each email and mobile to one account and lets you sign in or reset your password with them.
• A random pseudonym given to you at sign-up, shown with your posts, comments and chat instead of your username.
• What you write: your disclosures (as you wrote them and an automatically redacted copy), comments, group chat messages and your votes.
• Reports and blocks: when you report a post, comment or chat message, we keep the reason you chose, any detail you add and a copy of what you reported; when you block a member, we keep who you blocked.
• How you use ExiThreat: the days you use it, the time spent on it, and which disclosures you have read, used to work out your own and your group's weightage. Days of use are kept for 60 days.
• ProMic backups, only if you link a ProMic account: the server then fetches your own ProMic backup recordings when you open them, to play them to you. They are not stored by ExiThreat.
• Technical data: your device's network address is used briefly to limit repeated requests, and the servers keep short-lived logs of errors.

We do not collect your location, contacts, photos or files. There are no ads and no third-party analytics or tracking. The Android app asks for no permission other than internet access.

Who can see what

• Other members see your pseudonym, never your username, email or mobile number.
• A disclosure goes to randomly chosen groups you are not in. Their members may read the original once, as an image, then see the redacted copy. Disclosures that spread widely reach the common page, where members see the redacted copy.
• Police officers registered through ProMic's law-enforcement programme can read both the original and the redacted copy of disclosures on the common page.
• The administrator can read posts, comments and group chat, reads the reports members send, and can suspend or delete accounts and content that break the Terms of Use.
• Nobody is told that you reported or blocked them. Your list of blocked members is seen only by you.

Services we use

• Fly.io hosts the website, the server and the database (in Singapore).
• Google Firebase confirms mobile numbers by SMS. The temporary Firebase sign-in this creates is deleted straight after the number is confirmed.
• Gmail sends email confirmation codes.

We do not sell or share your data with anyone else.

Security

Everything travels over encrypted connections (HTTPS). Passwords, email addresses and mobile numbers are stored only as one-way hashes. You can sign out of every device from your Account page.

Keeping and deleting your data

Your account and what you wrote are kept until you delete your account. You can delete it at any time from the Account page in the app or on the website; this permanently removes your account, your disclosures, comments, chat messages, votes, reports, blocks and usage records straight away. See how to delete your account.

Changes and contact

If this policy changes, the new version will be posted here with a new date. Questions or requests: senkumram777@gmail.com.