Privacy Policy

1. Introduction & Who We Are

Truly ("we", "us", or "our") provides an intentional platform for structured, small-group video conversations ("Circles") hosted in Bangalore, India. Truly is committed to transparent, lawful, and privacy-first data processing in accordance with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

This Privacy Policy explains what personal data we collect, how it is processed, who receives it, how long it is retained, and how you can exercise your rights of access, correction, and erasure.

2. Personal Data We Collect

We practice strict data minimization and collect only the information necessary to authenticate you, cohort small conversation groups (8 participants per Circle), and facilitate optional post-call introductions:

• Account & Authentication: Your email address and cryptographically hashed one-time verification tokens (OTPs). We do not collect or store passwords.
• Participant Profile: Your first name, city, age bracket (e.g., 23–27), occupation (optional), conversation intent, and an optional conversational spark prompt ("bio quirk").
• Social Reveal Handle (Optional): Your Instagram handle, which remains strictly private and is only revealed to another participant when both of you confirm mutual interest after a call.
• Booking & Transaction Records: Circle slot selection, booking reference ID, seat fee (₹199 / 19,900 paise), transaction status, and tokenized payment reference IDs from authorized payment aggregators.
• Technical Session Metadata: IP address, browser user-agent, and session timestamps used solely for rate limiting, brute-force security defense, and session persistence.

Zero Collection: We never collect Aadhaar numbers, PAN, biometric data, credit/debit card numbers, CVVs, or real-time GPS coordinates.

3. Live Video Calls — Zero Recording Architecture

Truly Circles are real-time, ephemeral conversation sanctuaries.

• No Video/Audio Persistence: Video and audio streams are transmitted directly between participant browsers using a peer-to-peer WebRTC mesh network. Truly does not record, intercept, or store live video or audio streams on any server or disk.
• Participant Code of Conduct: Recording, screen-capturing, or publishing any portion of a live Circle is strictly prohibited and constitutes grounds for immediate removal and account termination.

4. Double-Blind Contact Privacy

To eliminate social anxiety and prevent unsolicited outreach, post-call connection exchange operates on a strict double-blind model:

• After a Circle ends, you may privately indicate interest in staying in touch with individual participants.
• Your interest is never revealed to the other person unless they independently express mutual interest in you.
• If mutual interest is confirmed, only your approved Instagram handle is shared. Your phone number and personal email address are never disclosed.

5. Technical Infrastructure, Cookies & Optional Technologies

We practice strict data minimization. Below is the complete inventory of technical providers and storage mechanisms currently active in Truly:

You can view or update your preferences for optional technologies at any time by clicking Cookie Preferences in the website footer.

6. Data Retention & Snapshot Lifecycles

We retain personal data only as long as necessary for the specified purpose or as required by Indian law:

• Login OTPs: Automatically expire and are invalidated within 10 minutes.
• Active Sessions: Retained for 30 days or invalidated immediately upon signing out.
• Profile Information: Retained during active platform membership and erased upon account deletion.
• Financial/Booking Records: Retained for 7 years with personal identity decoupled to comply with statutory Indian corporate and tax audit requirements.
• Database Backup Snapshots: Encrypted operational disaster-recovery backups rotate on a 30-day rolling expiration lifecycle.

7. Your Rights & Account Erasure

Under the DPDP Act, 2023, you have the right to access, correct, and erase your personal data:

• Right to Access: View your active bookings and profile directly from your member dashboard.
• Right to Correction: Update your profile details at any time via the onboarding settings.
• Right to Erasure: You can permanently erase your profile and personal data at any time via our automated deletion mechanism (POST /api/auth/delete-account) or by contacting our support desk. Upon request, all profile fields are wiped, active sessions are revoked, and your email is permanently anonymized.

8. Security Safeguards

We protect your information through industry-standard technical and organizational security controls:

• All network communication is encrypted in transit via TLS 1.3.
• Session cookies use HttpOnly, Secure, and SameSite=Lax protections.
• System logs strictly redact sensitive identifiers, OTP codes, session tokens, and payment references.
• Rate limiting and brute-force defenses prevent automated abuse of verification endpoints.

9. Contact & Grievance Redressal

If you have questions regarding this Privacy Policy, wish to exercise your data principal rights, or wish to report a privacy concern, please contact our support team: