Privacy policy

DraftThis is a draft (version 0.1, 4 November 2026) for MilApp's closed beta. It has not yet been reviewed by our lawyer and will be updated before MilApp's public launch. Items marked PLANNED describe features that are not built yet.

Item	Detail
Who this is for	Everyone who uses the MilApp app on Android (and later on iPhone), including people taking part in the closed beta.
Who is responsible	The founders of MilApp, Kinshuk Mishra and Saurabh Upadhyay. A company will be formed to run MilApp and will be named here.
Contact	milapp.meet@gmail.com
Laws in play	India: the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. Hong Kong: the Personal Data (Privacy) Ordinance (Cap. 486).
How to read it	Items marked PLANNED describe features that are not built yet. They will apply only when that feature launches.

1. About this policy

This policy explains what personal information MilApp collects, why we collect it, how long we keep it, who we share it with, and what you can do about it. We have tried to write it in plain English. Where we use a technical word, we explain it.

"Personal information" (the law also says "personal data") means information about you that can identify you, such as your name, your photo or where you are.

In this policy, "MilApp", "we" and "us" mean the founders of MilApp, Kinshuk Mishra and Saurabh Upadhyay. "You" means the person using the app. "Other people" means other MilApp users.

2. Who we are

MilApp is a mobile app that helps adults who are near each other right now to meet in person, in a public place, for networking or company. It was founded by Kinshuk Mishra and Saurabh Upadhyay.

The company has not been formed yet. Until it is, the founders are responsible for MilApp and for your personal information.

3. The short version

You must be 18 or over to use MilApp.
Other people see your profile (first name, one photo, work, education, interests and write-up) only while you are both using the app nearby. They never see your age, gender, date of birth, email or exact location.
We use your exact location only while you are live (15 to 30 minutes at a time) and, if you choose to share it, during an agreed meeting. Your exact live location is deleted as soon as your live session ends.
When a session or meeting ends, we keep one sealed record of your last exact location for 30 days, in case the police or a court asks for it after an incident. Nobody else can see it.
Chats can be read by the two people in them for 30 days after the chat closes. Then they are deleted.
We do not sell your personal information and we do not show advertising.
You can delete your account at any time. PLANNED: an in-app Delete account button is coming soon; until then, email us and we will delete it for you.

4. What we collect, why, and how long we keep it

The table below lists each kind of information, why we need it, and how long we keep it. Most periods are settings in our database, so we can change them without changing the app; if we change one, we will update this policy first.

"Until you delete your account" means we keep it while your account exists and erase it when you delete your account, except where section 10 says otherwise.

4.1 Your account and profile

Information	Why we need it	How long we keep it
Email address and password (stored only in a scrambled form called a hash, which cannot be turned back into the password)	To create your account, let you sign in, and send you sign-in codes and important messages about your account.	Until you delete your account.
Google account link (if you sign in with Google): your Google account number, name and email from Google	To let you sign in with Google instead of a password.	Until you delete your account.
Apple account link PLANNED: Sign in with Apple, with the iPhone version	To let you sign in with Apple.	Until you delete your account.
The version of the terms and this policy you accepted, and when	To show that you agreed, and to ask you again if they change.	Until you delete your account.
A random number for your phone (device id), created by the app	To stop people who were removed for breaking our rules from signing up again on the same phone, and to tell your phones apart for notifications.	Until you delete your account. If someone tried to give a date of birth under 18, we keep a note of that refusal with the phone number and no date.
Date of birth	To check that you are 18 or over. It is locked once saved; a founder can correct it if you ask (section 9).	Until you delete your account. Never shown to other people. If you are under 18, the date is refused and not kept.
Gender	Used privately on our server. Never shown to other people.	Until you delete your account.
Name (first name or the name you choose)	Shown on your profile so people can recognise you.	Until you delete your account. You can change it at most once every 30 days (changes in the first 24 hours after sign-up do not count).
Your earlier names	Kept in a sealed history that only the founders can see, so that a person who was reported cannot escape by changing their name.	Until you delete your account. PLANNED: if a founder removes your account for breaking our rules, a sealed record (your earlier names, date of birth, city and photo) is kept for 395 days (about 13 months) to spot the same person signing up again.
Profile photo (one photo)	Shown to people who can see your profile, so they can recognise you at a meeting.	Until you replace it (the old file is deleted) or delete your account. The app removes the hidden details a photo file carries, including where it was taken, before it is uploaded.
Selfie for the photo check (optional)	You take a selfie copying a random pose (for example two fingers up). A founder compares it with your profile photo, to confirm the photo is really you. We do not create or keep a face template or any other biometric data.	The selfie is deleted as soon as a founder approves or rejects it. We keep only the result: "photo checked", the date, and which founder decided.
Photo screening	Before a photo is accepted, a nudity-detection model checks it on your phone. Unsure or flagged photos go to a founder to review.	During the beta the check runs only on your phone and nothing is sent to anyone else. PLANNED: from the public launch we intend to use Google's image check, which means sending the photo to Google (section 6).
City of origin, identity line and write-up	Shown on your profile; the city is also used to find things you have in common.	Until you delete your account.
Interests (8 to 12) and your top three	To show what you have in common with people nearby and to rank the list.	Until you delete your account.
Work and education (job title, organisation, dates, college, degree)	Shown on your profile; a shared college or company is a reason to meet.	Until you delete your account.

4.2 Location

MilApp only works with location, but it is designed to use as little of it as possible. There are four separate uses. Each is explained on screen before your phone asks for permission.

Information	Why we need it	How long we keep it
Exact location while you are live (Go Live)	While you are live (15 to 30 minutes, your choice), your phone sends its position to our server about every 30 seconds, only while the app is open. The server uses it to work out who is within reach on foot or by car.	Only while your live session lasts. It is deleted the moment the session ends, however it ends (you stop, the time runs out, or your account is held, removed or deleted).
Rounded position of a live session (to a 200-metre square)	All distances shown to other people are worked out from this rounded position, never from the exact one, so nobody can pin-point you.	Kept with the record of the session until you delete your account.
Sealed last-known location	When a live session or a meeting ends, we keep one sealed record of your last exact position, the time it was taken and why the session ended (and, for a meeting, the agreed place). It exists only so we can answer a police or court request after an incident (section 11). No app user, including you, can see it. A founder can open it only for such a request, with a reason, and every opening is logged.	30 days from the time the position was taken, then deleted automatically. It is not linked to your account, so it stays for its 30 days even if you delete your account.
Your exact location during an agreed meeting (only if you choose to share it)	When you agree to meet someone, you can tick "Share my live location for this meeting". It is off unless you turn it on. If you do, the other person sees your position on a map until you meet. Sharing is one-way: your dot shows to them as soon as you share, whether or not they share theirs. While sharing, the phone shows a notification with a Stop button and keeps sending its position even when the app is in the background.	Sharing stops when either of you taps "We met", when you have both been within about 50 metres of each other for 3 minutes and you agree (or do not answer), about 30 minutes after the meeting time (up to 60 minutes later if someone is running late), when you tap Stop, or when the meeting ends. The positions and the route the phone sent are deleted 24 hours after the meeting ends.
Coarse area for nearby alerts PLANNED	If you turn on nearby alerts, the phone tells our server roughly where you are (an area of about 1 km) when you move noticeably, even when the app is closed. This needs "Allow all the time" location permission, which we ask for only when you turn alerts on. We use it to tell you, at most once a day, when a strong match goes live near you.	We keep only your latest area, never a history. It is deleted after 6 hours without an update, and at once if you turn alerts off.
Travel-time and place-search lookups	To show how long it takes to reach someone, and to find public places to meet, our server asks a maps service (section 6). It sends only the centre of a 500-metre square, never your exact position or your name.	Answers are kept in a shared cache with no names: travel times for 30 minutes, place searches for 24 hours.

4.3 Using MilApp with other people

Information	Why we need it	How long we keep it
Live sessions (when you went live, for how long, walking or driving, filters)	To run the live list and the rules (for example the time limit).	Until you delete your account.
Who was shown to whom in the live list	To decide who may open your profile or invite you (only people who were shown you in the last 10 minutes, or someone you have been in touch with in the last 7 days), and to learn what kind of person you choose.	7 days after the viewer's live session ends. Deleting an account removes these records on both sides.
What the list learns about your choices	The order of the list adapts to the people you invite. These adjustments fade by 10% a week.	Until you delete your account.
Invitations (called Pings in our design)	To let you ask someone to chat, and let them accept or decline.	Shown in Invites for 24 hours after they end; deleted 30 days after they end.
Chats and messages	Text chats between two people, open for 15 minutes after an invitation is accepted, and longer around an agreed meeting.	Readable by the two people for 30 days after the chat closes, then deleted. Copies used to deliver messages instantly are deleted after 3 to 4 days.
First messages containing a link or a phone number	Copied for the founders to check for scams. The message is not blocked.	30 days.
Meetings (who, the agreed place, the times, "I've arrived", "We met", the outcome)	To run the meeting screens and to know who you have met recently (people you met in the last 7 days are ranked lower).	30 days after the meeting ends, then deleted.
Blocks	To hide you and the blocked person from each other everywhere.	Until either of you deletes their account. PLANNED: unblocking in Settings.
Ratings PLANNED	After a meeting, each person rates the other from 1 to 5 stars, with optional chips and a comment. You see only your average and how many ratings you have, never a single rating or who gave it.	Until the account of the person rated is deleted. If the person who gave a rating deletes their account, the rating still counts in the average, without their name.
"Are you okay?" follow-up questions PLANNED	After a 1 or 2-star rating, you may agree to share that one chat with the MilApp team, and answer up to three follow-up questions.	Kept with the moderation case (below).
Reports PLANNED	You can report someone from their profile, a chat or a meeting, for up to 30 days after you were in touch, even if they blocked you or deleted their account. A report includes a copy of the chat.	Reports, the copy of the chat and the founders' decisions are kept for 395 days (about 13 months); the record of each decision is kept with no end date.
Emails we send about your account PLANNED	Warnings, deletion confirmations and similar.	A log of what was sent is kept for 90 days.

4.4 Your phone, notifications and app quality

Information	Why we need it	How long we keep it
Notification token (a code from Google or Apple that lets us send a notification to your phone), with the phone's platform and whether you allowed notifications	To send you notifications such as "Someone 6 min away wants to meet".	Until you sign out on that phone, delete your account, or the phone has not been seen for 60 days. A log of notifications sent (with no text) is kept for 30 days.
Crash and error reports	When the app crashes or something goes wrong, the app sends a technical report to Sentry (section 6) so we can fix it: the error, the screen, the phone model and system version, and the app version. We switched off Sentry's option to collect personal information, and reports contain no screenshots and no positions.	As long as Sentry keeps them under our plan.
Usage events (analytics)	The app and the server record what happens in the app, for example "went live", "sent an invitation", "meeting agreed", with the time and a few details such as counts. They never include message text or positions. We use them to run the service, fix problems and see whether people actually meet.	13 months. When you delete your account, they are kept without your account number (anonymised). PLANNED: a "Share usage data" switch in Settings; when off, events are recorded without your account number.
Bot check at sign-up	An invisible check from Cloudflare (Turnstile) at sign-up tells people from automated programs.	We keep only the pass or fail result. Cloudflare's own handling is described in its privacy policy.

We never ask for: your phone number, your contacts, your social-media accounts, payment details, or your exact home or work address.

5. Beta testers

During the closed beta (invited testers only), the founders look closely at how the app is used so they can fix it before the public launch. If you are a beta tester:

The founders can see a named timeline of what you did in the app: for example which screens you opened, when you went live, sent or answered an invitation, agreed or finished a meeting, and any errors or slow screens on your phone.
The timeline is built from the usage events in section 4.4. It never includes the text of your messages or your exact location. It may show the general area (for example the city or neighbourhood) where sessions happened.
It is shown on a private "Beta stats" page that only the two founders can open, on our own computer, over a private network. It is not shared with anyone else.
Your test data may be reset or deleted during the beta.
You agree to this in the separate beta tester agreement before you join.

We do not sell your personal information. We share it only with the companies below, which run parts of MilApp for us (the law calls them "processors": they may use it only to provide their service to us), with app stores, and where the law requires (section 11).

Company (where based)	What it does for MilApp	What it receives
Supabase Inc. (USA), on Amazon Web Services computers	Hosts our database, stores photos, runs our server programs and delivers live updates.	Everything in section 4, stored in Supabase's Mumbai, India data centre.
Google LLC (USA): Firebase Cloud Messaging	Delivers notifications to Android phones (and to iPhones through Apple).	Your phone's notification token and the notification. Notifications on the lock screen never contain names, photos, message text, colleges, companies or places, for example "Someone 6 min away wants to meet".
Apple Inc. (USA): Apple Push Notification service PLANNED with the iPhone version	Delivers notifications to iPhones.	The same as Firebase.
Google LLC (USA): Google Sign-In	Lets you sign in with your Google account, if you choose.	Google tells us your Google account number, name and email. Google knows you used it to sign in to MilApp.
Google LLC (USA): Google Maps	Draws the map on the meeting screen. PLANNED: from the public launch, also travel times and place search.	The map on your phone loads map pictures for the area shown, which includes where the meeting is. For travel times and places, only the centre of a 500-metre square, never a name.
HeiGIT gGmbH (Germany): OpenRouteService	Works out travel times and finds places to meet during the beta.	Centres of 500-metre squares and search words (for example "cafe"). Never names or exact positions.
Google LLC (USA): image check PLANNED, public launch	Checks profile photos for nudity on our server.	The photo. During the beta, the check runs on your phone instead and nothing is sent.
Functional Software Inc., trading as Sentry (USA), EU data centre	Crash and error reports.	Technical error details, the phone model and system, and a random number for the app install. No name, email, position or screenshot.
Cloudflare Inc. (USA)	The invisible bot check at sign-up (Turnstile), and our domain name (milapp.app).	Technical signals from your phone during sign-up, such as its internet address and browser details.
Resend (USA)	Sends sign-up codes and emails about your account.	Your email address and the text of the email.
Anthropic PBC (USA) PLANNED	An AI model (Claude) that helps a founder review a report or a low rating, by summarising it and, for a low rating, suggesting up to three follow-up questions. It never takes any action: a founder always decides (section 8).	Only the report or rating, the answers to the follow-up questions, and the one chat that was reported or that you agreed to share. Names are replaced by "reporter" and "subject", and phone numbers in messages are masked. Never positions or emails. Anthropic does not train its models on this data.
Google LLC (Google Play) and Apple Inc. (App Store, TestFlight)	Distribute the app and its updates; Google Firebase Test Lab runs automatic tests on test accounts only.	What the stores collect when you download the app, under their own privacy policies. They do not receive your MilApp profile.
Telegram PLANNED	Alerts the founders to an urgent report so they can act quickly.	Only a case number, the kind of report and the time left. Never a name, a message or a place.

Some of these companies process information outside India and Hong Kong, for example in the USA and the European Union.

If MilApp is ever sold or merged with another company, your information may pass to the new owner, who must keep to this policy.

7. What other people can see, and what they never see

7.1 What other people can see

While you are both live and nearby: your name, photo, identity line and write-up, the work and education you chose to show, your interests, your city of origin, the "Photo checked" badge if you have it, and why you match (for example "Same college, +2 interests").
Your distance, rounded, and the travel time (for example "6 min walk"), worked out from your rounded position. Also how long you are still live.
People who were shown you in the last 10 minutes, or who were in touch with you in the last 7 days, can open your full profile. Nobody can open it across a block, or while your account is on hold or removed.
In a chat: your messages, and when you have received and read theirs (ticks).
In an agreed meeting: the place, your "I've arrived" and "We met", and your live position on a map only if you chose to share it.
If someone shares the meeting with a friend: from the safety screen, the other person can send a friend a message such as "I'm meeting Ben from MilApp at Central Cafe, 12 MG Road, at 6:40 pm". It includes your first name and the place.
Your other chat partners: if you agree a meeting, your other open chats close and those people see a notice that you have committed to a meeting. It names you to them, never the person you are meeting.
PLANNED Your average rating and how many ratings you have ("New" until 3).

7.2 What other people never see

Your exact location (except your own shared dot during a meeting, if you chose to share it).
Your age, date of birth, gender, email address or device.
Your earlier names.
Who reported you, who blocked you, or that you were reported or blocked. A blocked person simply stops seeing you.
Single ratings or who gave them.
Whether you declined their invitation for a particular reason.

MilApp blocks screenshots and screen recording inside the app on Android, to protect the people you see. This does not stop someone photographing their screen with another device.

8. How we use information for safety and moderation

The founders (Kinshuk Mishra and Saurabh Upadhyay) review photos the screening was unsure about, selfies for the photo check, and PLANNED reports and low ratings. They can see a reported chat only through the copy attached to the report; otherwise nobody at MilApp reads your chats.
Holds and removals: a founder can put an account on hold (it cannot go live, invite or chat) or remove it. PLANNED, from the public launch: if two different people make serious safety reports about an account within 7 days, the account is hidden automatically until a founder reviews it. Low ratings never lead to any automatic action.
PLANNED AI-assisted review: an AI model helps a founder by summarising a report and recommending an action. It never acts by itself, it cannot change the rules, and a founder always decides. The text sent to it is described in section 6.
PLANNED Ban list: if a founder removes an account, we keep scrambled forms (hashes) of its email address, Google or Apple account number and device number, so the person cannot simply sign up again.

9. Your rights and choices

Depending on where you live, you have rights over your personal information. These include the right to know what we hold, to get a copy, to correct it, to have it erased, to withdraw consent, to name someone to act for you if you die or cannot act yourself (India), and to complain.

What you can do	How
See and edit your profile	Profile tab, then Edit profile.
Correct your date of birth	It is locked once saved. Email us; a founder may ask to see a photo of an ID, which stays in our email and is never stored in the app. Every correction is logged with its reason.
Choose whether to share your live location in a meeting	A switch on the meeting invitation, off unless you turn it on. Stop at any time from the notification or the meeting screen.
Location permission	Your phone's settings. MilApp asks only for "While using the app", except for nearby alerts PLANNED, which need "Allow all the time". Refusing it leaves everything else working.
Notifications	Your phone's settings. PLANNED: separate switches for each kind in Settings.
Who can invite you	PLANNED: "Only photo-checked people can invite me" in Settings.
Share usage data	PLANNED: a switch in Settings. When off, usage events are recorded without your account number.
Block someone	From their profile or a chat. PLANNED: the list of blocked people in Settings.
Get a copy of your data	PLANNED: a download in Settings. Until then, email us and we will send it.
Delete your account	PLANNED: Settings, then Delete account. Until then, email us. See section 10.
Withdraw consent	Turn off the switch concerned, or delete your account. Withdrawing does not affect what we did before.
Complain	Email us first. In India you may complain to the Data Protection Board of India; in Hong Kong, to the Office of the Privacy Commissioner for Personal Data.

10. Deleting your account

PLANNED: in-app deletion is coming soon. Until then, email milapp.meet@gmail.com from your account's email address and we will delete it for you, following the same rules. When the button launches, you will sign in again, type DELETE and confirm. Deletion is immediate and cannot be undone.

What happens	To what
Erased	Your sign-in (email, password, Google or Apple link); your profile (name, write-up, city, gender, date of birth, device number, settings); your work, education and interests; your photo and any selfie; your earlier names; your live sessions and any exact position; your notification tokens; who was shown to whom; what the list learnt about your choices; your blocks; your nearby-alert area and settings PLANNED.
Ended	Any live session, open invitation, open chat or meeting. The other person is told the chat or meeting has ended.
Kept for the other person, then deleted	Your messages stay readable by the people you chatted with, shown as from "MilApp member (account closed)", until the normal 30 days after the chat closed. The meeting record stays for the other person for its normal 30 days. Your route during a shared meeting is deleted 24 hours after the meeting as usual.
Kept without your name	Usage events (anonymised). Ratings you gave still count in the other person's average. PLANNED Ratings and reports about you, and reports you made, are kept with a scrambled code instead of your account, for moderation, for 395 days.
Kept, sealed, for a limited time	Sealed last-known locations (section 4.2): 30 days from when each was taken, with no link to your account. PLANNED If a founder removed your account, or it was on hold or under review when you deleted it: the ban list or review entry, and the sealed removal record for 395 days.

If you used the app without deleting your account, we do not automatically delete inactive accounts.

11. Safety and requests from the police or courts

MilApp is not an emergency service. In an emergency, call the local number: 112 in India, 999 in Hong Kong. The safety screen opens your phone's dialler with the number; you press call yourself. MilApp never calls anyone for you.
We may share personal information with the police, a court or a government authority when the law requires it, or when we believe in good faith that it is needed to protect someone's life or safety.
We disclose the sealed last-known location (section 4.2) only in answer to a written request from the police or a court. A founder opens it with the reason recorded; every opening is logged, and the log is kept with no end date.
Where the law allows, we will tell you about a request for your information.

12. Children

MilApp is only for adults aged 18 and over. We ask for your date of birth at sign-up and refuse anyone under 18. We do not knowingly collect personal information from children. If we learn that a user is under 18, we will close the account and delete their information. If you believe a child is using MilApp, please tell us at milapp.meet@gmail.com.

13. How we protect your information

Every table in our database has rules that let each person read only what they are allowed to (row-level security). Exact positions, the sealed records and earlier names are in a private area no app user can reach.
Photos are private files. The app gets a link to a photo that works for about an hour, and only for someone allowed to see that profile.
Passwords are stored only as hashes. Connections between the app and our server are encrypted.
The app blocks screenshots on Android. Lock-screen notifications never show names or messages.
Only the two founders have administrative access. PLANNED: two-step sign-in for the founders' moderation tools.
If a data breach affects you, we will tell you and the authorities as the law requires.

14. Changes to this policy

We will update this policy when MilApp changes, for example when the planned features launch. The date at the top shows the latest version. If a change is important, we will tell you in the app and ask you to accept it again before you continue; the version you accept is recorded.

15. Contact

For any question about this policy or your information, or to use your rights: email milapp.meet@gmail.com.