Privacy Policy
theName.app Effective Date: 15 July 2026 Last Updated: 15 July 2026
This Privacy Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (India) ("DPDP Act"), the Information Technology Act, 2000, and applicable data protection laws. _This document is under active legal review and will continue to be refined before public launch._
1. Introduction
TNAP PLATFORMS PRIVATE LIMITED ("Company", "we", "us", "our") operates theName.app (the "Platform"), including mobile applications (iOS, Android), web application, desktop application, and related services (collectively, the "Services").
This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Services. We are a "Data Fiduciary" under the DPDP Act.
2. Data We Collect
2.1 Data You Provide
| Data Type | When Collected | Purpose |
|---|---|---|
| Phone number | Account registration | Account creation, authentication, security |
| Username (@name), display name | Signup | Your identity across the Platform, including your @name email address |
| Date of birth | Signup (required) | Age eligibility per your country's rules, birthday features; locked after signup |
| Profile photo | Signup (optional) | Social features, user identification |
| Contact hashes | Contact sync (with permission, skippable) | Finding people you know — see Section 3.3: we never receive your address book in readable form |
| Messages, media, files | Connect messaging (E2EE) | Message delivery — content is end-to-end encrypted and not accessible to us |
| Email and calendar data | Connect (your @name mailbox) | Providing your Platform email and calendar |
| Namiel conversations | Using the Namiel AI assistant (formerly "Angel AI") | Providing AI assistance — stored encrypted at rest; see Section 3.4 |
| Delivery addresses, trip locations | Ordering food, rides, stays | Fulfilling hyperlocal orders and trips |
| KYC documents (PAN, Aadhaar, bank details) | Seller/restaurant/host/Partner onboarding, Blessings settlement | Identity verification, legal compliance, settlement processing |
| Product listings, descriptions, images | Seller marketplace | Marketplace operations |
| Payment information (UPI ID, bank account) | Blessings settlement, seller settlement | Revenue share settlement |
2.2 Data We Collect Automatically
| Data Type | Purpose |
|---|---|
| Device information (model, OS, app version) | Service optimization, debugging |
| IP address | Security, fraud prevention, approximate location |
| Usage data (features used, time spent, interactions) | Service improvement, analytics |
| Video viewing behavior (watch time, engagement) | Blessings earning calculation, content recommendations |
| Live location of Partners while online | Dispatch matching, trip tracking, safety |
| Crash logs and diagnostics | Bug fixing, service reliability |
| Push notification tokens | Notification delivery |
2.3 Data from Third Parties
| Source | Data | Purpose |
|---|---|---|
| Phone verification providers (Firebase during early access; licensed SMS providers thereafter) | Verification result | Confirming you control your phone number |
| Payment gateway (e.g. Razorpay) | Transaction status | Payment and settlement processing |
2.4 Sensitive Personal Data
We collect the following sensitive personal data only when explicitly provided and consented to:
- Biometric data: Not collected
- Financial data: Bank account details and PAN (for KYC/settlement only)
- Health data: Not collected
- Political/religious affiliation: Not collected
- Sexual orientation: Not collected
3. How We Use Your Data
3.1 Purpose-Specific Processing
| Purpose | Legal Basis (DPDP Act) | Data Used |
|---|---|---|
| Account creation and authentication | Consent (at registration) | Phone number, date of birth, profile info |
| Providing messaging and calls | Consent + Contractual necessity | Message metadata (content is E2EE) |
| Providing your @name email and calendar | Contractual necessity | Mailbox and calendar content |
| Finding people you know | Consent (contact sync is skippable) | Irreversible contact hashes (Section 3.3) |
| Hyperlocal fulfillment (food, rides, stays) | Contractual necessity | Addresses, live trip location, order details |
| Namiel AI assistance | Consent (feature use) | Your Namiel conversations (Section 3.4) |
| Blessings earning and tracking | Consent (Blessings program participation) | Viewing behavior, engagement data |
| Content recommendations | Legitimate use (service improvement) | Viewing history, engagement signals |
| Marketplace operations | Contractual necessity | Seller info, product data, order data |
| Identity verification (KYC) | Legal obligation + Consent | PAN, Aadhaar, bank details |
| Revenue share settlement | Contractual necessity | Bank details, PAN, Blessings balance |
| Content moderation of public content | Legal obligation (IT Act) | Public User Content, reports — automated scanning + human review |
| Security and fraud prevention | Legitimate use | Device info, IP, usage patterns |
| Service improvement | Legitimate use | Aggregated/anonymized usage data |
| Legal compliance | Legal obligation | As required by law |
3.2 We Do NOT Use Your Data For:
- Selling personal data to third parties
- Behavioral tracking of users under 18 for advertising purposes (prohibited under the DPDP Act)
- Accessing or processing the content of end-to-end encrypted messages or calls
- Profiling based on sensitive personal data (religion, health, political views, etc.)
3.3 Contact Sync — How It Works
If you choose to sync contacts (it is skippable), your address book is never uploaded in readable form. Phone numbers are converted to irreversible cryptographic hashes before matching, and the server applies an additional secret key ("pepper") so the stored values cannot be reversed or matched outside our systems. We do not store your contacts' names, and we discard hashes that match no member when your contacts change.
3.4 Namiel — How Your Conversations Are Processed
Namiel (our AI assistant, formerly known as "Angel AI") conversations are processed to generate responses, including through a vetted third-party AI provider (Anthropic) under a data processing agreement; per that provider's API terms, your conversations are not used to train their models. Conversations are stored encrypted at rest (AES-256-GCM) on our infrastructure.
4. End-to-End Encryption and Messaging Data
4.1. Messages sent through the Platform's Connect (messaging) feature — both 1:1 chats and Spaces (groups) — and voice/video calls are protected by end-to-end encryption using the Signal Protocol (with Sender Keys for groups). This means:
- Message content (text, media, files) is encrypted on the sender's device
- Only the intended recipient(s) can decrypt and read the message
- The Company cannot access, read, or share message or call content
- Encryption keys are stored on your devices, not on our servers
4.2. Linked devices and backups: Additional devices (such as the web app) receive keys from your primary device through encrypted device linking. If you enable encrypted chat backup, the backup is encrypted with credentials only you hold — we cannot read or recover it without them.
4.3. Metadata we DO process: sender and recipient identifiers, message timestamps, delivery/read status, message type (text/image/video), device information. This metadata is necessary for message routing and delivery.
4.4. Data we do NOT have access to: message text content, media content, file content, voice/video call content, your encrypted backup contents.
4.5. Platform email: Email exchanged with external providers travels over standard email security (TLS) and is not end-to-end encrypted.
5. Data Sharing
5.1 We Share Data With:
| Recipient | Data Shared | Purpose | Safeguard |
|---|---|---|---|
| Other users | Profile info, @name, public content | Social platform functionality | User controls visibility settings |
| Marketplace sellers / restaurants / hosts | Order details, delivery address | Order fulfillment | Agreements with confidentiality obligations |
| Partners (delivery/ride) | Pickup/drop details needed to fulfill your order or trip | Hyperlocal fulfillment | Access limited to the active job |
| Payment gateway (e.g. Razorpay) | Bank details, PAN, settlement amount | Payments and settlement | PCI-DSS compliant, data processing agreement |
| Phone verification / SMS providers | Phone number | OTP delivery and verification | Data processing terms; India-compliant (DLT) routes for Indian numbers |
| Anthropic (AI provider) | Namiel conversation content | Generating Namiel responses | Data processing agreement; not used for model training per API terms |
| Logistics partners (e.g. NimbusPost, Delhivery, Shiprocket) | Shipping name, address, contact | Parcel delivery for marketplace orders | Data processing agreements |
| Cloud infrastructure and managed database providers | Data encrypted at rest | Service hosting | Data processing agreements |
| Law enforcement | As required by valid court order | Legal compliance | Only pursuant to valid legal process |
5.2 We Do NOT Share:
- Message or call content (technically impossible due to E2EE)
- Blessings balances or transaction history with other users (unless you initiate a transfer)
- Personal data with advertisers (advertisers see aggregate campaign metrics only)
- Data with any third party for their independent marketing purposes
5.3 Maps Without Big-Tech Tracking
Maps, routing, and address search on the Platform run on our own self-hosted map infrastructure. Your location queries are not sent to Google, Apple, or other third-party map providers.
6. Data Storage and Security
6.1. Location: Primary data is stored on infrastructure located in India (including our managed database provider and S3-compatible object storage). Encrypted backups may be stored in additional regions for disaster recovery.
6.2. Encryption:
- Data in transit: TLS 1.2+
- Data at rest: AES-256 encryption
- Messages and calls: End-to-end encryption (Signal Protocol)
- Namiel conversations: AES-256-GCM at rest
- Encryption keys: Stored in device Keychain (iOS) / EncryptedSharedPreferences (Android), never on our servers
6.3. Retention:
| Data Type | Retention Period | Reason |
|---|---|---|
| Account data | Until deletion (30-day grace) + 180 days for registration records | IT Rules 2021 registration-data retention |
| Messages (E2EE) | Until deleted by you or by disappearing-message timer; keys destroyed at account deletion | User control; crypto-shredding on deletion |
| Message metadata | Up to 2 years from message date | Service reliability, dispute resolution |
| Blessings/financial transaction records | 8 years | Companies Act and tax compliance |
| KYC documents | 5 years from relationship end | PMLA requirements |
| Trip records and SOS incidents | Up to 24 months | Rider/partner safety, aggregator guidelines |
| Usage/analytics data | 2 years, then anonymized | Service improvement |
| Server logs | Up to 1 year | Security, IT Rules |
| Crash logs | 90 days | Bug fixing |
| Content moderation records | 3 years | Legal compliance, appeals |
6.4. Security Measures: We implement industry-standard security measures including access controls, audit logging, regular security assessments, employee training, and incident response procedures.
7. Account Deletion
7.1. You can delete your account in-app (Settings → Account → Delete account) or from our web deletion page at thename.app/delete-account. You do not need to be able to open the app to request deletion.
7.2. Grace period: Deletion is scheduled with a 30-day grace period. Signing in within 30 days cancels it. After 30 days, deletion is permanent: your encryption keys are destroyed (making any remaining encrypted content unreadable), your profile and public content are removed or anonymized, and your @name is permanently retired (never reissued).
7.3. What others still see: Messages you already delivered remain on recipients' devices (as with all messaging services). Your name on past orders, reviews, and shared content is anonymized.
7.4. What we must keep: The retention table in Section 6.3 lists records we are legally required to keep after deletion (registration records, KYC, financial ledger entries, trip/SOS records, server logs), each held only for its legal period and then erased.
8. Your Rights (under DPDP Act 2023)
As a Data Principal under the DPDP Act, you have the following rights:
8.1. Right to Access: You may request confirmation of whether we process your personal data and a summary of such data and processing activities.
8.2. Right to Correction and Erasure: You may request correction of inaccurate personal data or erasure of personal data that is no longer necessary for the purpose for which it was collected. Note: Certain data may be retained where required by law (see Section 6.3).
8.3. Right to Grievance Redressal: You may raise complaints about our data processing through our Grievance Officer (see Section 14).
8.4. Right to Nominate: You may nominate another individual to exercise your rights in the event of your death or incapacity.
8.5. Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Certain Services may become unavailable if consent is withdrawn (e.g., withdrawing consent for phone number processing requires account deletion).
8.6. How to Exercise Rights: Contact us at privacy@thename.app or use the in-app Privacy settings. We will respond within 30 days.
8.7. Users outside India: Depending on your country, you may have equivalent rights (such as access, portability, rectification, and erasure under the GDPR). We honor these through the same channels.
9. Children's Data
9.1. In India, the Services are available only to users 18 years of age and older. We do not offer accounts to persons under 18 in India, and we do not knowingly process the personal data of children as defined by the DPDP Act.
9.2. Outside India, the minimum age is 13 or the local age of digital consent, whichever is higher. Where local law requires parental consent for a permitted age band, we will not offer signup to that band until a verifiable parental consent mechanism is in place.
9.3. Date of birth is required at signup and enforced per country. We do not perform behavioral tracking or targeted advertising for users under 18 anywhere.
9.4. If we become aware that we have collected personal data from an underage user, we will delete the account and associated data promptly.
10. Cookies and Tracking (Web Application)
10.1. Our web application uses essential cookies and local storage for authentication, session management, and security. These are strictly necessary for the Service to function.
10.2. We use analytics to understand usage patterns. Analytics data is aggregated and anonymized where possible.
10.3. We do not use third-party advertising trackers or cross-site tracking cookies.
10.4. You can manage cookie preferences through your browser settings.
11. Cross-Border Data Transfers
11.1. Our primary data storage is in India. We do not routinely transfer personal data outside India.
11.2. Certain third-party service providers (phone verification, crash reporting, and the Namiel AI provider) may process limited data in their global infrastructure. Such transfers are governed by data processing agreements and are to jurisdictions not restricted by the Central Government under the DPDP Act.
11.3. If you access the Platform from outside India, your data will be transferred to and processed in India, subject to this Privacy Policy and Indian data protection law.
12. Data Breach Notification
12.1. In the event of a personal data breach that is likely to cause harm to Data Principals, we will:
- Notify the Data Protection Board of India as required under the DPDP Act
- Notify affected users without undue delay through in-app notification and/or email
- Provide details of the breach, potential impact, and remedial measures taken
13. Changes to This Policy
13.1. We may update this Privacy Policy from time to time. Changes will be posted with an updated "Last Updated" date.
13.2. For material changes, we will provide 30 days' prior notice through the Platform or via email.
13.3. Continued use after changes take effect constitutes acceptance. If you disagree with changes, you may delete your account.
14. Contact Information
Privacy contact: Email: privacy@thename.app
Grievance Officer (IT Act 2000 / IT Rules 2021): Name: [Grievance Officer — to be appointed before public launch] Email: grievance@thename.app Response: Acknowledgment within 24 hours, resolution within 15 days
Company: TNAP PLATFORMS PRIVATE LIMITED CIN: U46901KA2025PTC199859 43 Residency Rd, Bangalore – 560025, Karnataka, India Email: legal@thename.app