Privacy Policy

1 Introduction

Loona ("we", "us", "our") is a campus social platform for college students in India. We are committed to protecting your privacy and handling your personal data responsibly, in compliance with the Digital Personal Data Protection Act (DPDPA), 2023.

This policy explains what data we collect, why we collect it, how long we keep it, and how you can exercise your rights.

2 Data We Collect

• Google Account Info: Your name, email address, and Google ID — collected during sign-in via Google OAuth.
• Campus: The college you select during onboarding.
• Anonymous Identity: A randomly generated display name and emoji avatar used for your posts.
• Location: Approximate GPS coordinates (only when you grant permission) — used for the "Nearby" radar feature.
• Device Token: Your Expo push notification token (only if you allow notifications).
• Content: Posts, comments, confessions, reactions, and messages you create within the app.
• Usage Data: Screen views and feature usage for analytics (no personally identifiable information is attached).

3 How We Use Your Data

• To provide the core campus social feed and community features.
• To power the "Nearby" feature and show people near your campus.
• To send push notifications for waves, messages, and comments (only if enabled).
• To moderate content and enforce community guidelines.
• To improve the app experience through anonymous usage analytics.

We do not sell your personal data. We do not use your data for advertising profiling.

4 Anonymous Confessions

When you post a "Confession", your real name and profile are never associated with that post. The confession is stored as an anonymous post with no traceable identity.

Even administrators cannot trace a confession back to a specific user in normal operations. Confessions are only investigated in response to legal orders from Indian law enforcement.

5 Data Sharing

• Cloudinary: Images you upload are stored on Cloudinary's CDN servers.
• Google Firebase (FCM): Push notification delivery.
• Sentry: Crash and error reporting (no personal data is included).
• No other third parties. Your data is not sold or shared for advertising.

6 Data Retention

• Your account and posts are retained until you delete them or delete your account.
• "Burn" posts are automatically deleted after 24 hours.
• Notifications are automatically purged after 30 days.
• Location coordinates are updated in real-time and not stored historically.
• After account deletion is requested, all data is permanently wiped within 30 days.

7 Your Rights (DPDPA 2023)

• Right to Access: You can view all your posts and activity within the app.
• Right to Correct: You can update your name, avatar, bio, and campus at any time from Profile → Settings.
• Right to Erase: You can delete your account from Profile → Settings → Delete Account. All data is permanently deleted within 30 days.
• Right to Withdraw Consent: You can disable notifications or location access at any time from your device settings.
• Right to Grievance Redressal: Contact us at the email below for any data-related concerns.

8 Account Deletion

You can delete your account directly from within the app:

1. Open the app → Go to Profile tab
2. Tap the Settings (gear) icon
3. Scroll to Delete Account
4. Confirm deletion

Your account enters a 30-day grace period — you can log back in at any time to cancel. After 30 days, all data is permanently and irrevocably deleted.

If you cannot access the app, you can also request deletion via our web form:

9 Security

We use industry-standard security practices including:

• JWT authentication with short-lived access tokens (1 hour) and refresh tokens (30 days)
• All API communication over HTTPS/TLS
• Rate limiting on all authentication endpoints
• NoSQL injection protection
• Content moderation for harmful content

10 Children's Privacy

Loona is designed for college students and is intended for users 18 years and older. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, please contact us immediately.

11 Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last Updated" date at the top. Significant changes will be notified in-app.