Dosth App

1. Who We Are

Dosth App ("the App", "we", "us", "our") is developed and operated by Dosth App Team, an independent developer based in Singapore. As Data Fiduciary under India's Digital Personal Data Protection Act 2023 (DPDP Act), we are responsible for how your personal data is collected, used and protected. We also comply with Singapore's Personal Data Protection Act 2012 (PDPA) where applicable.

2. Data We Collect

• Account data: Name, email, hashed password (Firebase Authentication). Google Sign-In users share name, email and Google profile ID — no password stored.
• Profile data: Display name, Dosth Tag (auto-generated unique @username), preferred language, theme preference. No phone number collected.
• Age verification: Date of birth collected at sign-up to verify 18+ eligibility (DPDP Act 2023 compliance). Stored in your profile.
• Group & expense data: Group names, members, expense amounts, splits, settlement records (Bill Groups, Squads).
• D Carry data: Item carry requests posted between India ↔ Singapore — item description, weight, budget, contact preference, expiry date. Visible to all authenticated users browsing the D Carry section. Auto-expires after 30 days.
• DosthSell data: Item listings, photos (Firebase Storage), buyer-seller chat messages, deal history. Chat includes in-app reporting (⚠️ icon).
• Dosth Drop data: Dosth Drop is peer-to-peer (browser-to-browser or via OS Quick Share). We never see file content. A 6-digit session code and the public IP addresses of both devices are briefly visible to PeerJS Cloud during the ~5-second connection handshake on web. Nothing is stored on Dosth servers.
• Sign PDF data: PDFs you sign are processed locally in your browser/device. Signatures are flattened onto the PDF and never uploaded to Dosth servers.
• Health Tracker data: Manually-logged vitals — weight, blood pressure, blood sugar, heart rate, SpO2, temperature, sleep, water and steps. All data is manually entered by you. Dosth App does not automatically read phone sensors or integrate with Android Health Connect.
• To-do, Habits, Medications data: Tasks, habit streaks and medication schedules stored locally on your device (AsyncStorage). Not synced to servers. Private to the device.
• Family Tree data: Family member entries you create. Stored locally on device. CSV import/export available on web only.
• Kids Learning data: Quiz progress, scores and unlocked stickers. Stored locally on device. No personal data of children collected (app is 18+ — parents teach with kids).
• Home Vault data: Inventory, warranties, home docs and contacts — stored locally on device only. Never uploaded.
• Login history: Each device sign-in records device platform, model, OS and timestamp in a private loginHistory subcollection visible only to you. Powers the Security Scan "Recent sign-ins" view.
• Location data: Approximate GPS coordinates (foreground only) used for: (a) home screen weather widget via Open-Meteo, and (b) Kisan AI district auto-detection. Sent to the respective API only — never stored permanently or linked to your account.
• AI feature inputs: Text/photos you submit to AI features (Kisan AI, Trip Planner, AI Greetings, Smart Listings) are sent to Anthropic Claude API and Google AI APIs. Per their API terms, inputs are NOT retained for AI model training.
• Passport Photo data: Photos processed locally in your browser. Background removal sends the photo to remove.bg API for processing under their privacy policy. Dosth does not retain passport photos.
• Security Scan data: When you use Security Scan, your email is sent to Have I Been Pwned (HIBP) — a public security database — to check breach exposure. Results stored on-device only (24-hour cache). NEVER stored on Dosth servers.
• Contribution data: If you use "Support the Team" — your DosthTag (or "Anonymous"), contribution amount and message are stored and publicly visible in the contributions feed.
• Ideas: Text submitted to the Ideas board is publicly visible to all users.
• Push notification token: Expo Push Token stored in your user profile (up to 3 devices), used solely to deliver app notifications including security alerts for new device sign-ins.
• Usage data: Last login timestamp, AI feature usage counts, and estimated daily read statistics (stored in app_stats collection for admin monitoring). No advertising IDs collected. No browsing history collected.
• Crash logs: Anonymous error logs via Firebase — device model, OS version, stack trace only.

3. How We Use Your Data

• To provide core features: expense splitting, groups, D Carry India↔SG, DosthSell marketplace, Health manual vitals, Dosth Drop file sharing, Sign PDF, Scanner, Passport Photo, AI tools, games and 30+ other utilities.
• To authenticate your identity and secure your account.
• To send push notifications about group activity, expenses, DosthSell messages, and security alerts when a new device signs into your account.
• To power Security Scan — checking your email against HIBP and displaying your recent sign-in history.
• To display the contributions feed and Ideas board publicly.
• To provide AI-powered features by sending inputs to Anthropic and Google AI APIs.
• To show local weather and Kisan AI district detection using GPS location via Open-Meteo.
• To monitor app stability via anonymous crash logs.
• We do NOT use your data for behavioural profiling, sale to data brokers, advertising, or non-essential third-party sharing — ever.

4. What We Never Do

• No advertisements. No AdMob, no AdSense, no in-app ads of any kind. No banner ads, no interstitials, no rewarded ads.
• No advertising ID collected. The Android Advertising ID permission has been explicitly removed from the app manifest. We have declared "No" to Google Play's advertising ID question.
• No selling of personal data. Ever, to anyone, for any reason.
• No behavioural tracking for ads or profile-building.
• No reading of Dosth Drop file content. Files transfer peer-to-peer; we have no server access.
• No reading of Sign PDF content. PDFs signed locally never leave your device/browser.
• No reading of Home Vault, To-do, Habits or Medications data. All stored locally on your device only.

5. Dosth Drop (Phone-to-Phone File Sharing)

How it works:

• On Android (native app): Uses the operating system's Quick Share / Nearby Share feature. Files travel over Bluetooth + Wi-Fi Direct between phones. No internet required. Dosth App is not involved in the actual transfer beyond invoking the OS share intent.
• On web (dosth.org/drop): Uses WebRTC peer-to-peer. Devices exchange a small (~5KB) handshake via PeerJS Cloud, then file content flows directly device-to-device encrypted with DTLS. Over LAN if both on same Wi-Fi, otherwise over the internet.
• The 6-digit session code is not stored by Dosth.

What we store: Nothing. Dosth has no server-side component for Dosth Drop. We cannot recover, inspect, revoke or replay transfers.

What is briefly visible to third parties (web only): PeerJS Cloud sees the 6-digit code and public IP addresses of both devices during the ~5-second handshake — never file content. Google STUN servers see IP addresses only.

Honest limits of encryption: Dosth Drop encrypts files in transit between the two devices (DTLS on web; OS-level on native). However, encryption does not protect the devices themselves. If you are on a monitored device (work laptop, school laptop), endpoint monitoring software on that device may see file content before it is encrypted for transit.

Your responsibilities: You are responsible for what you transfer. Dosth Drop must not be used to send illegal content, CSAM, copyrighted material without rights, malware, or non-consensual intimate images. We cannot enforce this technically (we do not see file content), but such use violates our Terms of Use.

6. D Carry — Community Carry Service

• D Carry allows users to post requests to carry items between India and Singapore via fellow travellers.
• Posts include item description, weight, budget, preferred contact and expiry date.
• D Carry listings are visible to all authenticated Dosth App users.
• Expired listings are automatically hidden after the expiry date.
• Dosth App is an intermediary platform — we do not verify items, guarantee delivery or take responsibility for carry arrangements made between users.
• Users are responsible for complying with customs regulations and airline baggage rules when carrying items internationally.

7. Voluntary Contributions & Ideas (Public Data)

• Contributions via "Support the Team" — your DosthTag, amount and message are stored in Firestore and publicly visible in the contributions feed.
• Ideas submitted to the Ideas board are publicly visible to all users.
• You may request deletion by emailing support@dostu.app.

8. Consent (DPDP Act 2023 / PDPA 2012)

By creating a Dosth App account, you provide free, informed and specific consent to the collection and processing of your personal data as described. You may withdraw consent at any time by deleting your account from Settings → Account → Delete Account.

9. Health Tracker — Manual Vitals Tracker

• Health Tracker allows you to manually log health vitals: weight, blood pressure, blood sugar, heart rate, SpO2, temperature, sleep, water intake and steps.
• All data is manually entered by you — Dosth App does not automatically count steps, use device sensors or integrate with Android Health Connect.
• Data is stored in your private Firebase account, accessible only to you.
• ImportantHealth Tracker is NOT a medical device. Always consult a qualified healthcare professional for medical decisions.

10. AI Features & Third-Party AI Processing

• AI features: Kisan AI, Trip Planner (D Travel AI), AI Greetings, Smart Replies (DosthSell chat), Smart Listings (DosthSell), Invite Generator.
• Inputs sent to Anthropic Claude API and Google AI APIs via our Firebase Functions proxy. Per their API terms, inputs are NOT retained for AI model training.
• AI features have monthly usage limits tracked per user (free tier).
• ImportantAI-generated content may contain inaccuracies. Always review before acting on AI output. Kisan AI is informational only — not professional agronomy advice.

11. Location Data (GPS / IP)

• Location is used foreground only — no background location tracking.
• Weather widget: Coordinates sent to Open-Meteo — not stored, not linked to account.
• Kisan AI district detection: Approximate location used to auto-detect your district for crop advice. Not stored.
• Falls back to IP-based city-level location via ip-api.com if GPS is denied.

12. DosthSell Marketplace Data

• Listing data (title, description, photos, price, location) is visible to all authenticated Dosth App users.
• Chat messages are visible only to the buyer and seller involved.
• Chats include in-app reporting (⚠️ icon) — reports are sent to Dosth admins for review.
• Dosth App is an intermediary platform under India's IT Act 2000.

13. Data Storage & Security

• Cloud data stored in Google Firebase (Asia-Pacific region) with TLS in transit and AES-256 at rest.
• Local-only data (To-do, Habits, Meds, Home Vault, Family Tree, Kids Learning progress) stored on your device using AsyncStorage. Cleared when you uninstall.
• Passwords never stored — Firebase Authentication handles all credentials.
• Firestore Security Rules enforce that users access only their own data and shared group data.
• We do not store payment card, banking or UPI credentials.

14. Third-Party Services

No adsWe do NOT use Google AdMob, AdSense, Facebook Ads, or any other ad network. No advertising ID collected. The Android AD_ID permission is explicitly stripped from our app at build time.

We are not responsible for third-party service privacy practices. Each service is governed by its own privacy policy.

15. UPI Payments & Contributions

• Dosth App displays UPI IDs for voluntary contributions ("Support the Team") only.
• We do NOT process, hold or facilitate UPI payments. Transactions occur directly between users via their own UPI apps.
• All UPI transactions governed by NPCI / RBI regulations.
• We do not store your UPI ID, bank account or any payment credentials.

16. Data Retention

• Active accounts: Data retained while account exists.
• Deleted accounts: Profile, health data, login history and group memberships deleted immediately.
• Shared expense records: Anonymised to "Deleted User" — retained for other members' history.
• D Carry listings: Auto-expire 30 days after the posted expiry date.
• DosthSell chat: Retained 90 days after a deal for buyer-protection review purposes.
• Security Scan results: Stored on-device only (24h cache), never on servers.
• Dosth Drop / Sign PDF / Home Vault / To-do / Habits / Meds: Stored on your device only. Cleared on uninstall.
• Crash logs: 90 days rolling.

17. Your Rights — DPDP Act 2023 (India)

Under India's DPDP Act 2023 you have the right to access, correct, erase and nominate. PDPA 2012 (Singapore) provides similar rights. Raise a grievance with our Grievance Officer.

Grievance Officer (DPDP Act 2023): Dosth App Team
Data Protection Officer (PDPA 2012): Dosth App Team
Email: support@dostu.app
Response time: Within 30 days.

18. Age Restriction — 18+ Only

Dosth App is for users aged 18 and above. Age verification is performed at sign-up. We do not knowingly collect data from users under 18. The "Kids Learning" feature is designed for parents (who are 18+) to teach Primary-1 to Primary-5 content to their own children — children themselves should not have a Dosth account. Contact support@dostu.app if a minor has provided personal data.

19. Changes to This Policy

Material changes communicated via in-app announcement at least 7 days before taking effect. Last updated: June 2026 (app v1.0.29).