OffRecord Privacy Policy

Effective 7 October 2026 · Contact: xt.harshh@gmail.com

1. Who we are

OffRecord ("we") runs the OffRecord voice-social app. For questions, corrections, deletion, or grievances, write to xt.harshh@gmail.com. We acknowledge grievances within 24 hours and resolve them within 15 days, as the IT Rules, 2021 require.

2. Data we collect

• Account: email (stored hashed), chosen handle, gender icon choice, avatar or mascot pick.
• Voices: recorded audio, waveform levels, caption, title, topic, location you add, and playback/engagement counts.
• Messages & replies: direct messages, comments, reports and blocks you file.
• Device & delivery: push token, app version, basic diagnostics. Your private display name never leaves your phone.
• Payments: processed by Razorpay or manually verified by us — we never see or store full card or UPI credentials, only plan, amount, and status.

3. Why we use it

To run the service (feeds, playback, messages), keep it safe (spam, abuse, legal compliance), and bill premium plans. We never sell personal data, and we never use voice content for advertising.

4. Where it lives

• Account and app data: managed Postgres database.
• Voice audio: Backblaze B2 object storage.
• Profile images: Cloudinary via our PixelWalls media service.
• Push delivery: Expo push service.
• Payments: Razorpay.

5. How long we keep it

Until you delete it. Stories auto-archive after 24 hours. Deleting your account (Settings → Delete account, or /delete) removes your profile, voices, messages, and uploads; backups expire within 90 days. Web deletion requests are verified and completed within 30 days.

6. Your rights

Access and export a JSON copy anytime (Settings → Export my data), correct your profile in Edit profile, withdraw consent by deleting your account, and nominate another person for your data in case of death or incapacity by writing to us — as the DPDP Act, 2023 provides.

7. Children

OffRecord is for ages 13 and up. Under-18 users need verifiable parental consent; accounts found to belong to under-13 children are removed with their data. See our child safety standards.

8. Security & breaches

Encrypted transport, hashed credentials, least-access admin roles. If a breach affects your data we will tell you and the Data Protection Board as the law requires.

9. Changes

Material changes are announced in-app at least 7 days before they take effect. Continued use means acceptance.

10. Law

Governed by the laws of India, including the DPDP Act, 2023 and the IT Act/Rules on intermediary duties.