Privacy Policy

Hukkup ("Hukkup", "we", "us") is a social discovery app for LGBTQ+ adults, available on the web at hukkup.com and as mobile apps. It is operated from India by [Legal entity name], [Registered address] (the "Data Fiduciary" for the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act")).

This policy applies to everyone who uses Hukkup. It should be read with our Terms of Service. If you do not agree with this policy, please do not use Hukkup.

Hukkup is a service for LGBTQ+ people. Simply having an account may reveal, or suggest, your sexual orientation or gender identity. We treat all of your data with that in mind.

When you create an account you give your explicit consent for us to process your personal data — including data that may reveal your sexual orientation, gender identity, sex life or relationship preferences — for the purpose of providing the service described in this policy. Profile fields such as pronouns, gender identity, relationship status, position and what you are looking for are optional; fill in only what you are comfortable sharing.

We never sell your personal data, and we do not use it to target advertising, or share it with advertisers or data brokers.

We collect only what we need to run Hukkup. Depending on the features you use, this includes:

Account data

Your email address, a hashed (never readable) password, display name, date of birth, and — if you add one — a phone number. We store whether your email and phone have been verified. Others see your age, never your date of birth.

Profile data

Anything you choose to add to your profile: bio, pronouns, gender identity, height, weight, relationship status, profile type, position, what you are looking for, interests, languages, music, city and country, and your privacy settings.

Photos and media

Profile photos, album photos, story posts and photos sent in chat. Every image is re-encoded when uploaded, which removes all embedded metadata (EXIF), including the GPS location tags phones add to photos.

Approximate location

If you allow it, your device location is rounded to a grid of about 500 m before it is stored — your exact position is never saved. Other members only see a rounded distance, and you can hide your distance or go invisible. A stored location is deleted outright once it has not been refreshed for a set period (currently 30 days by default). A Travel destination you choose is stored as the city you picked until your trip ends. Your position on the map only appears when you check in to a venue, and only until that check-in expires.

Messages

Messages you send and receive, with timestamps and delivery and read status (read receipts can be turned off). See "Messages and encryption" below for what we can and cannot read.

Call information

For voice and video calls: who called whom, when the call was requested, accepted, started and ended, its duration, why it ended, and the coins charged. We do not record or store the audio or video of calls.

Activity on Hukkup

Likes, favourites, matches, blocks, people you have hidden from, reports, check-ins, meetups, events and communities you join, stories you post or view, and the coins and subscriptions on your account.

Device and session data

For each signed-in device: the browser or app's user-agent string and a readable label derived from it (for example "Chrome on Windows"), the IP address, sign-in and last-seen times, and a random per-install device identifier generated by the app. You can see and sign out your devices in Settings. Push notification tokens are stored if you enable notifications.

Technical and security data

IP addresses and request counts used to limit abuse (rate limiting), and an audit log of security- and moderation-relevant actions. On the mobile apps we may ask Google Play Integrity (Android) or Apple DeviceCheck (iOS) to confirm the request comes from a genuine copy of our app on a real device.

Text messages in chat are end-to-end encrypted when the apps on both sides support it: the words are encrypted on the sender's device for each of the recipient's devices, and our servers store only the encrypted version. Encrypted messages show a lock. We cannot read them, and our automated moderation cannot scan them.

• Photos, view-once photos and shared albums are encrypted in transit (HTTPS) but are not end-to-end encrypted, so they can be checked by our automated image moderation.
• A text message that is sent without end-to-end encryption is checked by automated moderation for signs of scams, solicitation and abuse before it is delivered.
• If you report a conversation, your device can attach the messages you choose so a moderator can read them. That is the only way a moderator can see the content of an encrypted conversation.
• When you delete a message it disappears from the conversation for both of you, but we keep the stored record so moderators can review it if it is reported. It is deleted with your account.
• Disappearing-message timers and view-once photos limit what the other person can see in the app. They cannot stop someone photographing their screen.

Hukkup offers two separate, optional checks (one may be required for certain features, such as becoming a Boss, or where the law requires it).

Photo (selfie) verification

To earn the verified badge you take a short series of live selfies in a pose we choose at that moment. We score the frames for signs that they were taken live (for example, capture time and natural movement between frames) — we do not use face recognition. A moderator compares them with your profile photos and decides. The selfies (with metadata removed) are kept as the record of your verification until you delete your account. If an operator has set a minimum liveness score and your capture falls below it, the frames are refused and not stored.

Identity document check

Where used, your identity document is checked by a verification provider: either a moderator reviewing images you upload, Stripe Identity, or a licensed KYC vendor. Images uploaded for moderator review are stored separately from other media, have their metadata removed, and are permanently deleted as soon as a decision (approval or rejection) is made. After a check we keep only: the result, the document type and issuing country, your date of birth, a keyed one-way hash of the document number (to stop one document verifying many accounts) and its last four characters. We never store the full document number.

Aadhaar

Aadhaar-based verification is only offered through a licensed KUA/AUA or registered DigiLocker partner. Hukkup never connects to UIDAI directly and never receives or stores your full Aadhaar number.

We use your personal data, on the basis of your consent and for the legitimate uses the DPDP Act allows, to:

• Create and secure your account, sign you in and keep track of your signed-in devices.
• Show your profile to other members according to your privacy settings, and show you people, places, events and rooms nearby.
• Deliver messages, calls, audio rooms, notifications and emails or texts you ask for (such as sign-in and verification codes).
• Process payments for Premium, boosts and coins.
• Keep members safe: verify identities and photos, moderate content, review reports, run Safe Meet, and stop banned members returning.
• Prevent fraud, spam and abuse, including limiting how often requests can be made.
• Answer your questions to Hukkup AI on the map.
• Meet our legal obligations and respond to lawful requests.

Photos and unencrypted text are scored by automated checks — our own detectors and, where configured, an external image-classification service. These checks produce a score, not a final decision: an uncertain result sends the content to a human moderator, and only the clearest cases may be refused automatically if the operator has enabled that.

Automated flags are never counted as complaints against you. Reports from members are reviewed by people. If an action is taken on your account, you are told what happened.

Safe Meet

When you start a Safe Meet you give a place, a check-in time and, optionally, trusted contacts (a name and an email address or phone number). The place is stored as a venue name and a location rounded to about 1 km. Each contact you share a meet with gets their own private link, which you can revoke, showing the details you shared. If you do not confirm you are safe by the deadline, your shared contacts are alerted and, if the operator has turned this on, a safety case is opened for our team. You are responsible for having your contacts' permission to give us their details.

Safe-place suggestions and flags

If you suggest a venue, we store the venue's name, category, public address and coordinates, and link the suggestion to your account so moderators can review it. Your own location is not used. Flags you raise against a venue are stored with your account and reviewed by a moderator.

Audio rooms

Audio rooms are live and are never recorded by Hukkup. We store who hosted and joined a room, their roles, and moderation actions taken in it. Live audio is carried by our media-server provider (LiveKit) and is not stored.

We share personal data only with service providers that process it on our behalf and under our instructions ("Data Processors"), and only what each needs:

Payments — Stripe

Card payments are handled on Stripe's checkout pages. We never see or store your full card details; we receive a customer reference and the payment status.

Push notifications — Google Firebase Cloud Messaging

Your device's push token and the notification content needed to deliver it.

Email and SMS providers

Your email address or phone number and the message, to send sign-in codes, verification codes and account emails. SMS is sent through Twilio; email through the email provider we use at the time.

Identity verification providers

Stripe Identity or a licensed KYC vendor, if you complete a document check through them. They process your document under their own terms and return only the result described above.

Bot protection

Cloudflare Turnstile (or hCaptcha) at sign-up on the web, and Google Play Integrity / Apple DeviceCheck in the apps.

AI map assistant — Anthropic

The text of a question you ask Hukkup AI on the map, to turn it into search filters. It is not sent your profile, other members' data or any location.

Content moderation

Images, where an external image-classification service is configured.

Calls and audio rooms

Relay (TURN) servers that carry call media when a direct connection is not possible, and LiveKit for audio rooms. Media passes through and is not recorded.

Hosting

The cloud infrastructure that runs our servers and stores data.

We may also disclose data where required by law, a court order or a lawful request by a government authority in India, or where necessary to protect someone's life or safety. Other members see what you choose to put on your profile and send them, subject to your privacy settings.

Some of our processors (for example Stripe, Google Firebase, Twilio, Cloudflare and Anthropic) may process data outside India. Where they do, we transfer data only as permitted under the DPDP Act and any restrictions notified by the Government of India, and under contracts that require them to protect it.

• Account and profile data: while your account exists.
• Approximate location: deleted after it has not been refreshed for the configured period (30 days by default).
• Identity document images uploaded for moderator review: deleted as soon as a decision is made.
• Selfie verification frames: until your account is deleted.
• Stories: shown only until they expire.
• Payment records: as long as needed for accounting and tax law.

When your account is deleted, your profile, photos, messages, calls, Safe Meets and sessions are permanently deleted. We keep a minimal audit record that the account existed and was deleted at your request (including the email address it used), to evidence that we acted on your request and to protect the platform from abuse.

Invisible

Hide from discovery while everything else carries on as normal.

Pause

No new interactions reach you, nothing is lost, and you can come back at any time.

Delete

Your profile is hidden immediately and your account is permanently deleted after a grace period (currently 30 days by default). You can cancel during that time. Once the grace period ends, the deletion happens even if you never sign in again.

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we process about you and the processing activities, and the identities of those we have shared it with.
• Correct, complete or update inaccurate or incomplete data — most of it you can edit yourself in your profile and settings.
• Erase your data — delete your account in Settings → Privacy & Safety, or ask us.
• Withdraw consent at any time. Withdrawal does not affect processing already done, and because consent is needed to run your account, withdrawing it means closing your account.
• Grievance redressal — have a complaint handled by our Grievance Officer, and if you are not satisfied, complain to the Data Protection Board of India.
• Nominate another person to exercise your rights if you die or become incapable.

To exercise any of these rights, email hukkupsupport@gmail.com from the email address on your account. We may need to confirm your identity before acting. We aim to respond within the time limits set under the DPDP Act and its rules.

Hukkup is strictly for people aged 18 or over. We ask for your date of birth at sign-up and refuse anyone under 18, and in some countries a higher minimum age or an identity check applies. We do not knowingly process the personal data of children. If you believe a child is using Hukkup, report the profile or email hukkupsupport@gmail.com and we will remove the account.

• All connections to Hukkup are encrypted with HTTPS.
• Passwords are stored only as one-way hashes. Verification codes are never stored in readable form.
• End-to-end encryption for chat text where supported, as described above.
• Location rounded before storage; photo metadata removed on upload; identity documents deleted after review.
• Each signed-in device is a session you can see and revoke, and you are told about sign-ins from new devices.
• Access to moderation tools is restricted to authorised staff, and moderation actions are recorded in an audit log.

No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by law.

We may update this policy when Hukkup changes or the law requires. We will change the "Last updated" date above and, for significant changes, tell you in the app or by email before they take effect. Where a change needs your consent, we will ask for it.

For privacy questions, requests or complaints, contact our Grievance Officer:

Grievance Officer

[Name]

Email

hukkupsupport@gmail.com

Address

[Legal entity name], [Registered address], India

We will acknowledge your grievance and aim to resolve it within the time prescribed under the DPDP Act and its rules.