Privacy Policy

Effective date: May 06, 2026

1) What this policy covers

This Privacy Policy explains how we collect, use, share, and protect information when you use the PasPas mobile application and related services (the “Service”).

2) Information we collect

A) Information you provide

Account information: email address, password, and OTP verification (sent to your email for registration and password reset).
Profile information: name and other profile details you provide, including profile photo (if uploaded).
Publication/package details: pickup/drop-off locations, timing, notes, and any other details you submit when publishing/managing a package.
Messages: chat content and related metadata (time, participants).

B) Information collected automatically

Device information: device type (iOS/Android) and device identifier (for iOS, identifierForVendor) for security, session integrity, and service operations.
Diagnostics: operational logs necessary to maintain reliability and troubleshoot issues.

C) Location information

We process location/place data to support location-based features (e.g., selecting pickup/drop-off places, route-related experiences). You control location permissions in your device settings.

D) Photos and camera

If you choose to upload images (e.g., profile photo, Aadhaar), we request access to:

Camera (to take a photo)
Photo Library (to select an existing photo)

E) Aadhaar verification (Sensitive Personal Data)

If Aadhaar verification is enabled, we collect and process:

Aadhaar front image and Aadhaar back image
Associated verification metadata (submission time, account reference)

3) How we use information

We use information to:

Provide the Service: create accounts, authenticate users, manage profiles, enable publishing and coordination.
Enable messaging: provide chat and support communication between users where applicable.
Aadhaar verification (fraud detection & trust): verify identity to reduce fraud, prevent misuse, and maintain a trusted community.
Maintain safety, security, and compliance: detect abuse, investigate suspicious activity, and comply with lawful requests.
Operate and improve: reliability, debugging, and performance improvements.

4) Aadhaar verification: manual review, no third parties, deletion after verification

Manual verification by us: Aadhaar submissions are reviewed and verified manually by Noob Stack Developers.
No third-party Aadhaar handling: We do not use third-party vendors to process or verify your Aadhaar images for identity verification.
Deletion after verification: Once your Aadhaar is successfully verified, we delete the Aadhaar front/back images and related sensitive verification data from our backend (subject only to minimal records required for audit/security where legally required, and only if applicable).
If verification fails or is abandoned: We retain the submission briefly as described in “Data retention” below and then delete it.

5) How we share information

We do not sell your personal information.

We may share information only:

With other users (as required by the Service): limited profile/publication details you choose to publish to support coordination.
With infrastructure/service providers (processors) needed to run the Service (hosting, storage, email delivery for OTP, etc.). They may process data only to provide services to us under contractual confidentiality/safeguards.
With Google services for Places/Maps: place and map features may process place/location queries under Google’s policies.
For legal and safety reasons: to comply with law, enforce policies, and protect users and the Service.
Business transfers: if the Service is involved in a merger/acquisition/sale.

6) Data retention (specific)

We retain personal data for the shortest time needed to operate the Service, then delete or de-identify it.

Chats/messages: retained for 5–7 days, then removed from our backend (unless longer retention is required to handle abuse, disputes, or legal obligations).
Published package/publication data: retained for 5–7 days, then removed from our backend (unless needed longer for safety, fraud prevention, dispute handling, or legal obligations).
Operational logs/diagnostics: retained for 5–7 days, then removed or de-identified.
Aadhaar images (front/back): retained only until verification is completed, then deleted immediately after verification as described above (or deleted after the short retention window if verification is not completed).

7) Security

We use reasonable administrative, technical, and organizational safeguards to protect information. No system can be guaranteed 100% secure.

8) Your choices and rights

You can:

Update certain profile details within the app (where available).
Control permissions (location, camera, photos) in device settings.
Request access, correction, or deletion by contacting us.

If you are in India, you may have rights under applicable Indian privacy/data protection law (including DPDP Act obligations, as applicable), subject to legal exceptions.

9) Children’s privacy (18+)

The Service is not intended for anyone under 18 due to identity verification (KYC) and contractual/transactional aspects. We do not knowingly collect personal information from minors. If you believe a minor has provided data, contact us to request deletion.

10) International transfers

Your information may be processed in countries other than where you live depending on server/service-provider locations. We take steps intended to ensure appropriate safeguards.

11) Changes to this policy

We may update this Privacy Policy. We will update the effective date and provide additional notice where required.

12) Contact us

Noob Stack Developers

Email: support@paspaspackage.com

Last updated: May 06, 2026