PRIVACY POLICY

Last updated: June 6, 2026 · Effective date: June 6, 2026

This Privacy Policy explains how Alpha Labs ("we", "us", or "our") collects, uses, stores, shares, and protects your personal information when you use the Flick mobile application or website at joinflick.in (collectively, "the Service"). By using the Service, you consent to the data practices described in this policy.

1. Information We Collect

Information you provide directly:

• Account information: full name, username, email address, password (stored encrypted via Firebase Auth)
• Profile information: profile photo, bio/about me
• Optional profile fields: birthday, gender, location, mobile number — all optional and individually controllable from Privacy Settings
• Photos and videos you submit to contests or duels
• Captions and hashtags you add to your submissions
• Private messages you send to other users
• Referral codes you use during registration or share with others
• Contest theme suggestions you submit
• Support messages or feedback you send to us directly

Information collected automatically:

• Device information: device type, manufacturer, model, operating system version, app version
• Usage data: contests entered, votes cast, duels initiated, features used, screens visited, session duration, time in app
• Engagement data: login streak count, last login date, last streak date, total submissions, total wins, total votes cast and received
• Profile view data: a count of how many times your profile has been viewed (used to power the profile views counter; we do not store the identity of individual viewers)
• Push notification token: Firebase Cloud Messaging (FCM) token used exclusively to deliver push notifications to your device
• Crash reports and diagnostics: error logs and stack traces via Firebase Crashlytics to help us fix bugs
• Analytics: aggregate, anonymised usage patterns via Firebase Analytics to help us improve the app

Information from third parties:

• If you sign in with Google, we receive your name, email address, and profile photo from Google as part of the OAuth flow

A note on photo EXIF data: Photos you upload may contain embedded metadata (EXIF data) such as GPS coordinates, camera model, aperture, and capture time. We do not actively read, process, or store EXIF metadata. However, EXIF data may be preserved in the photo file itself when stored on Firebase Storage. We recommend stripping EXIF data from photos before uploading if location privacy is a concern.

2. Legal Basis for Processing

We process your personal data on the following legal bases under applicable Indian privacy law (Information Technology Act, 2000 and IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011):

• Consent: You provide explicit consent when you register for an account, optionally provide sensitive personal data (birthday, gender, mobile number), and accept these Terms and this Privacy Policy
• Contract performance: Processing necessary to provide the Service you have requested — running contests, calculating XP, delivering notifications
• Legitimate interests: Analytics to improve the app, fraud detection, security, and abuse prevention — where these interests are not overridden by your privacy rights
• Legal obligation: Where we are required to retain or disclose data by applicable law

You may withdraw consent at any time by deleting your account or adjusting your privacy settings, where applicable.

3. How We Use Your Information

Purpose	Data used
Create and manage your account	Name, email, username, password
Display your public profile	Username, avatar, bio, level, badges, public stats, location (if enabled by you)
Run photo contests and duels	Submitted photos, username, avatar, captions, hashtags
Calculate XP, levels, streaks, and leaderboard rankings	Contest activity, votes, wins, login history, streak dates
Send push notifications	FCM token, notification preferences
Send birthday notifications	Birthday (only if you have provided it)
Enable private messaging	Messages, username, avatar, read receipts
Process referral rewards	Referral code, user ID, XP balance
Detect and prevent fraud, abuse, and ban evasion	Account activity, device info, reports from other users
Improve the app	Anonymised analytics data, crash reports
Respond to support requests	Email address, username, message content
Display ads	Device identifiers (via Google AdMob — see Section 4)

We do not use your personal information for targeted advertising based on your profile data, photos, or behaviour within the app. We do not sell your data to any third party.

4. Advertising

Flick displays in-app advertisements served by Google AdMob. AdMob may collect and use device identifiers (such as the Android Advertising ID or iOS Identifier for Advertisers) and app usage signals to serve contextual and personalised advertisements. This data collection is governed by Google's Privacy Policy.

You can opt out of personalised advertising at any time:

• Android: Settings → Google → Ads → Delete advertising ID (Android 12+) or Opt out of Ads Personalisation (older Android)
• iOS: Settings → Privacy & Security → Apple Advertising → Turn off Personalised Ads

Opting out does not remove ads from the app — it means the ads shown will be less relevant to you. We do not share your name, email address, photos, or any profile information with advertisers.

5. How We Share Your Information

We share your information only in the following limited circumstances:

• Public information visible to all users: Username, profile photo, submitted contest photos, contest rankings, XP level, badges, total votes received, total wins, total submissions, following/followers count
• Private information visible only to you: Email address, password, birthday, mobile number, gender — never displayed to other users
• Location: Only shown to other users if you explicitly enable "Show Location" in Privacy Settings
• Private profile: If your profile is set to private, your photos and activity are visible only to approved followers
• Firebase (Google): All app data is stored and processed on Google Firebase infrastructure. Firebase acts as our data processor under a data processing agreement with Google
• Google AdMob: Device identifiers for advertising as described in Section 4
• Legal compliance: We may disclose your information if required by applicable Indian law, court order, governmental authority, or to protect the rights, safety, or property of Alpha Labs, our users, or the public
• Business transfer: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to equivalent privacy protections

We never sell, rent, or trade your personal data to any third party for marketing purposes.

6. Private Messages

Private messages sent between users are stored encrypted on Google Firebase servers. Messages are accessible only to the sender and recipient. We do not read, analyse, or use the content of private messages for any purpose other than delivering them to the intended recipient, unless:

• A message is reported by a user for violating our Terms of Service, in which case our moderation team may review the reported content
• We are required to disclose message content by applicable law or court order

We do not use message content for advertising, analytics, or training purposes.

7. Local Storage and Device Data

Flick stores certain data locally on your device to improve performance and provide offline functionality:

• SharedPreferences: Used to store app preferences such as theme mode (dark/light), onboarding completion status, and notification settings
• Hive (local database): Used for local caching of app data to improve load times
• Temporary files: Photos are temporarily cached during upload and immediately removed after the upload is complete

This data is stored only on your device and is not transmitted to our servers except as described in this policy. Uninstalling the app removes all locally stored data.

8. Cross-Border Data Transfers

Flick uses Google Firebase, which stores and processes data on Google's global server infrastructure. This means your personal data may be transferred to, stored in, and processed in countries outside India, including the United States and other countries where Google operates data centres. These countries may have different data protection laws than India.

By using Flick and consenting to this Privacy Policy, you consent to this cross-border transfer of your data. Google Firebase complies with applicable data protection laws and maintains appropriate safeguards for international data transfers, including Google's standard contractual clauses.

9. Sensitive Personal Data

Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, certain categories of information are classified as "sensitive personal data or information" (SPDI). Flick may collect the following SPDI, but only with your explicit consent and only if you choose to provide it:

• Password: Stored in encrypted form via Firebase Authentication and never accessible to us in plain text
• Mobile number: Optional profile field, never shared with other users or third parties
• Birthday: Optional, used only for birthday notifications, never shown publicly

You provide explicit consent to our collection of this sensitive data by voluntarily entering it into the app. You may delete this data at any time from Settings → Edit Profile or by deleting your account.

We implement reasonable security practices as required by Rule 8 of the IT SPDI Rules to protect sensitive personal data from unauthorised access, disclosure, or misuse.

10. Data Storage and Security

All data is stored on Google Firebase servers. Firebase provides industry-standard security protections including:

• Encryption of data in transit using TLS/SSL
• Encryption of data at rest
• ISO 27001 certification and SOC 2/3 compliance
• Role-based access controls limiting who can access data

We implement Firestore security rules to ensure users can only access data they are authorised to access. Firebase App Check is enabled to prevent unauthorised API access.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data. In the event of a data breach that affects your rights, we will notify affected users as required by applicable law.

11. Data Retention

Data type	Retention period
Account and profile information	For the duration of your account. Deleted within 30 days of account deletion request
Submitted contest photos	For the duration of your account. After deletion, photos are removed from Storage within 30 days. Contest leaderboard records may retain anonymised submission data (no personal identifiers) indefinitely to preserve contest integrity
Private messages	Deleted within 30 days of account deletion
Crash reports and analytics	Retained in anonymised, aggregated form for up to 14 months per Firebase's default retention
FCM push notification token	Deleted immediately upon account deletion or token refresh
Legal hold data	Retained as required by applicable law, even after account deletion

12. Your Rights and Choices

You have the following rights regarding your personal data. Most can be exercised directly within the app:

• Right to access: View all your profile information and submitted photos within the app at any time
• Right to rectification: Edit your profile information from Settings → Edit Profile at any time
• Right to erasure: Delete your account and all associated personal data from Settings → Account → Delete Account. Deletion is processed within 30 days
• Right to withdraw consent: Withdraw consent for sensitive personal data collection by removing it from your profile or deleting your account
• Notification control: Manage notification preferences from Settings → Notifications, or disable all push notifications from your device settings
• Profile privacy: Set your profile to private from Settings → Privacy. Private profiles are visible only to approved followers
• Location visibility: Toggle whether your location is shown on your profile from Settings → Privacy
• Block users: Block any user from their profile to prevent them from seeing your content, voting on your photos, or messaging you
• Data portability: To request a copy of your personal data in a portable format, email us at support@joinflick.in
• Advertising opt-out: Opt out of personalised ads as described in Section 4

To exercise any right that cannot be performed in-app, contact us at support@joinflick.in. We will respond within 30 days.

13. Children's Privacy

Flick is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Users between 13 and 18 years of age must have obtained parental or guardian consent before using the Service and before providing any personal information, particularly sensitive personal data such as birthday or mobile number.

If we become aware that a child under 13 has created an account or provided personal information without verifiable parental consent, we will promptly delete that information and terminate the account. If you are a parent or guardian and believe your child under 13 has used Flick without your consent, please contact us immediately at support@joinflick.in.

14. Third-Party Services

Flick integrates the following third-party services. Each has its own privacy policy which we encourage you to review:

Service	Purpose	Privacy Policy
Firebase Authentication	User login, account management, Google Sign-In	firebase.google.com/support/privacy
Firebase Firestore	Database — stores all app data	firebase.google.com/support/privacy
Firebase Storage	Stores uploaded photos	firebase.google.com/support/privacy
Firebase Cloud Functions	Server-side logic — contest results, notifications, XP	firebase.google.com/support/privacy
Firebase Cloud Messaging	Push notifications	firebase.google.com/support/privacy
Firebase Crashlytics	Crash reporting and diagnostics	firebase.google.com/support/privacy
Firebase Analytics	Anonymised usage analytics	policies.google.com/privacy
Google AdMob	In-app advertising	policies.google.com/privacy
Firebase App Check	Security — prevents unauthorised API access	firebase.google.com/support/privacy

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, new features, or legal requirements. We will notify you of material changes through an in-app notification or push notification, and by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy. If you do not agree to the updated policy, you must stop using the Service and may delete your account.

16. Contact Us

If you have questions, concerns, requests, or complaints regarding your personal data or this Privacy Policy — including requests to access, correct, or delete your data — please contact us:

• Email: support@joinflick.in
• Website: joinflick.in

We aim to respond to all privacy-related requests within 30 days as required by applicable law.