Master Privacy Policy

EFFECTIVE DATE: SEPTEMBER 3, 2026 | VERSION 4.0

Your privacy is not a feature; it is a fundamental architectural requirement. This document outlines exactly what KENILGLOBAL TECH PRIVATE LIMITED ("we", "us") collects, what we cryptographically cannot collect, and how your data is handled on the Vyoma network.

1. Data We Do NOT Collect (The Vault)

Vyoma was engineered around trustless privacy. When you use "The Vault" for 1-on-1 direct messaging, your communications are secured using End-to-End Encryption (E2EE) via Elliptic Curve Diffie-Hellman (ECDH) key exchange and AES-GCM symmetric encryption.

  • Message Contents: We do not, and mathematically cannot, read the contents of your Vault messages.
  • Private Keys: Your private encryption keys are generated locally and stored securely on your device's keychain. They are never transmitted to our servers.
  • Media in Vault: Any images, audio, or files sent within The Vault are encrypted on your device before transmission and can only be decrypted by the recipient.

2. Data We DO Collect

To operate the network, authenticate nodes, and maintain platform stability, we must collect the following limited operational data:

  • Account Information: The email address and password hash used during registration.
  • Profile Metadata: Your chosen username, display name, avatar image, and bio.
  • Public Drops: Any text, image, or media you post to the global timeline. This data is entirely public by design.
  • Social Graph: Who you follow, who follows you, and the "Echoes" (reposts) or Likes you issue on Public Drops.
  • Network & Device Telemetry: IP addresses, connection timestamps, device fingerprints, and crash reports (via Sentry) to mitigate DDoS attacks and resolve software anomalies.

3. How We Use Your Data

We do not sell your personal data to data brokers, advertisers, or analytics firms. The data we collect is used strictly for the following purposes:

  • Authentication: Verifying your identity upon login.
  • Service Delivery: Routing your encrypted messages and rendering the chronological public feed.
  • Network Integrity: Detecting spam bots, mitigating cyber attacks, and banning malicious actors.
  • Legal Compliance: Fulfilling lawful subpoenas and identifying users involved in zero-tolerance violations (e.g., CSAM, terrorism).

4. Third-Party Infrastructure

Vyoma utilizes secure third-party infrastructure providers to operate the network. These providers are bound by strict data processing agreements:

  • Supabase: For PostgreSQL database hosting and authentication services.
  • Vercel: For edge-routing and frontend web application hosting.
  • Sentry: For anonymized crash reporting and performance monitoring.

5. Law Enforcement & Data Surrender

We will comply with valid, legally binding warrants, subpoenas, and court orders from competent jurisdictions. If compelled by law, we will surrender your account email, IP address logs, social graph, and all unencrypted Public Drops.

We will not, under any circumstances, attempt to backdoor our encryption protocols or surrender plaintext Vault messages, as we do not possess the necessary decryption keys.

6. Data Retention & Destruction (The "Erase Identity" Protocol)

You have the absolute right to delete your Vyoma account at any time via the "Erase Identity" function in the app settings.

  • Immediate Action: Triggering this function immediately destroys your local encryption keys, rendering all past and future Vault messages permanently unreadable to you and your recipients.
  • Server Purge: Your account profile, social graph, and Public Drops will be wiped from our active production databases.
  • Backup Retention: Anonymized metadata and encrypted Vault ciphertexts may remain in cold-storage backups for up to 90 days before being automatically overwritten.
  • Exceptions: If your account is actively under a preservation order by law enforcement, or you have been permanently banned for severe Terms of Service violations, we will retain your operational metadata indefinitely to prevent network re-entry.

7. International Data Transfers

By using the Platform, you consent to the transfer, storage, and processing of your data on servers located in the United States and other global regions utilized by our infrastructure partners (Supabase/Vercel). These jurisdictions may have data protection laws different from those of your country of residence.

8. Cookies & Local Storage

The Vyoma web application uses essential cookies and local storage tokens strictly for maintaining your authenticated session state. We do not deploy tracking cookies, tracking pixels, or third-party behavioral advertising scripts.

9. Policy Modifications

We reserve the right to update this Privacy Policy as our network architecture evolves. Significant changes will be announced via a Public Drop from the official Vyoma administrative account. Your continued use of the network constitutes acceptance of the revised policy.

10. Contact the Privacy Team

For questions regarding this policy, data export requests, or privacy concerns, contact our designated Data Protection Officer at:

KENILGLOBAL TECH PRIVATE LIMITED

Email: help@vyoma.kenil.in