Privacy Policy

Last Updated: September 5, 2026  ·  Effective Date: September 5, 2026

1. Introduction

Init ("we," "us," "our") operates the Init mobile application (the "App"), a location-based social app. The App's primary feature is Init Lounge: you check in to a real-world place, post a short "vibe" describing what you're up for, see other people checked in around you, and connect when both sides vibe each other. The App also includes a private interest-matching feature that lets you privately record interest in someone you already know; that interest is revealed only if it is mutual.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the App.

By creating an account or using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the App.

Contact: privacy@initmatch.com

Address: Om Chambers, 648/A, 4th Floor, Binnamangala 1st Stage, Indiranagar, Bengaluru — 560038, Karnataka, India

2. Information We Collect

2.1 Information You Provide Directly

• Phone number — used for registration and OTP verification.
• Date of birth — collected at registration for age verification (must be 18+). Your age range and gender are shown on your Lounge vibe cards.
• Password — stored as a secure hash; never stored in plain text. If you register via Google or Apple Sign-In, you never set a password.
• Display name — shown to users you match with.
• Username (Init ID) — a unique identifier you choose after registration; revealed to someone only after you mutually match.
• Profile photo — optional. Shown on your Lounge vibe card only if you turn photo visibility on; you can choose to show it to everyone in a lounge or only to people you have vibed.
• Vibe card text — a short line (15–100 characters) you post when you check in, visible to other people checked in to the same lounge.
• Vibes — when you vibe on someone's card. One-way and private; the other person is not told unless they have also vibed you.
• Lounge / venue details — if you create a lounge that isn't already listed (venue name and location).
• Interest expressions — the person you privately express interest in (by phone number or username) and the category you select.
• Messages — content you send in conversations opened by a match.
• Reports — when you report a user, card, or venue.

2.2 Location Information

Location is collected only in connection with Init Lounge, and only while you are actively using it:

• Precise location (GPS) — when you check in to a lounge, and during periodic checks while the App is open in the foreground and you have an active check-in. Used to confirm you are at the venue (within ~300 m to check in), keep the "here now" list accurate (you are automatically checked out if you move more than ~500 m away, or after a 3-hour cap), and detect location spoofing.
• Approximate location — when you open the Lounge tab, if you have granted only approximate/coarse location permission. Used to show nearby lounges in browse-only mode (roughly a 5 km radius). You cannot check in with approximate location only.
• Map viewport — while you pan or zoom the Lounge map, to request the correct map tiles for the area you are viewing.

We do not collect location in the background, when the App is closed, or when you are not using the Lounge feature. We do not build a location history or movement profile, and we do not use location for advertising. See Section 5A for how to limit or disable location access.

2.3 Information Collected Automatically

• Device tokens — for delivering push notifications (via Firebase Cloud Messaging).
• Authentication tokens — for maintaining your logged-in session.
• IP address and basic request metadata — logged by our servers for security and abuse prevention; also received by our map-tile CDN and geocoding providers when the App requests maps or place data. Not stored long-term.
• Device integrity signals — on Android, whether "mock location" is enabled (used to block spoofed check-ins); coarse device characteristics used as a soft anti-abuse signal.
• Session records — which lounge you are checked in to and the check-in / check-out / "away" timestamps, retained for safety and abuse prevention.

2.4 Content Filtering

Vibe card text is checked on your device and our servers against deterministic rules before it is posted: no links, no sequences of four or more digits (to discourage sharing phone numbers), no long runs of repeated characters, and at least one letter. We do not use this text for any purpose other than displaying your card and enforcing these rules.

2.5 Information from Third Parties

• Google Sign-In — if you register or log in with Google, we receive your Google account email address and display name. We do not receive your Google password.
• Apple Sign-In — Apple ID token; name and email only if you choose to share them via Apple's private relay.
• Geocoding providers — place names and coordinates returned for your searches and check-ins (see Section 6.3).

3. How We Use Your Information

• Account creation and authentication — to create your account, verify your identity via OTP, Google Sign-In, or Apple Sign-In, and maintain your session.
• Init Lounge — to show you nearby lounges, verify that you are at a venue when you check in, show your vibe card to other people checked in to the same lounge, let you and others cast private vibes, and open a chat when two people vibe each other.
• Proximity and anti-abuse checks — to confirm you are within range of a venue, check you out automatically when you leave, and detect mock-location or physically impossible movement.
• Private mutual-interest detection — to determine whether two users have expressed reciprocal interest in each other. Your interest expressions are never visible to anyone unless the other person has also expressed interest in you. This is a core privacy guarantee of the App.
• Identity resolution — to match interest expressions made via phone number or username to the correct user.
• Post-match communication — to enable real-time messaging between users who have matched, whether through Lounge or the private interest feature.
• Notifications — to notify you of new matches and messages via push notifications and in-app alerts.
• Age verification — to confirm you meet our minimum age requirement of 18 years.
• Safety, moderation, and security — to review reports, act on venue takedown requests, protect against fraud and unauthorized access, and enforce our Terms.
• Service improvement — to maintain, troubleshoot, and improve the App's functionality.

4. Our Core Privacy Guarantees

• In Lounge, when you vibe on someone's card, they are not notified. Only if that person independently vibes one of your cards in the same lounge are you both told, a match is formed, and a chat opens. If it is not mutual, the other person never learns that you vibed them.
• In the private interest feature, when you express interest in another person, your interest record is stored in encrypted form and the other person is not notified. Only when the other person independently expresses interest in you — with at least one overlapping category — are both parties notified of the match. If the interest is not mutual, the target person never learns that you expressed interest.

Your identity is withheld until you match. In a lounge, other people see your vibe card — its text, your age range and gender, and your photo if you have enabled it — but not your name, username, or profile until you and they have matched.

These invariants are enforced at the code level and are central to how Init works.

5. How We Protect Your Information

5.1 Encryption at Rest

Personally identifiable information (PII) is encrypted using AES-256-GCM with AWS KMS-managed envelope encryption before being stored in our database. This includes phone numbers and chat message content. Each encrypted field uses a unique initialization vector (IV) and authentication tag.

5.2 Hashed Lookups

For matching and duplicate-detection purposes, we store HMAC-SHA256 hashes of phone numbers. These hashes allow us to detect matches without decrypting stored data, minimizing exposure of plaintext PII.

5.3 Encryption in Transit

All data transmitted between the App and our servers is encrypted using TLS 1.2 or higher. WebSocket connections for real-time messaging also use encrypted transport.

5.4 Secure Token Storage

Authentication tokens are stored in platform-specific secure storage — Android Keystore on Android and iOS Keychain on iOS.

5.5 Biometric Authentication

You may optionally enable biometric authentication (fingerprint or Face ID) for app access. Biometric data is processed entirely on your device and is never transmitted to our servers.

5A. Location Permissions and Controls

• Granting precise location enables the full Lounge experience, including checking in.
• Granting only approximate location limits you to browsing nearby lounges; you will not be able to check in.
• Denying location means Init Lounge is unavailable. The rest of the App — the private interest feature, matches, and messaging — continues to work.
• You can change or revoke location permission at any time in your device settings (iOS: Settings → Privacy & Security → Location Services → Init; Android: Settings → Apps → Init → Permissions → Location).
• Checking out of a lounge (manually, by walking away, by logging out, or after the 3-hour cap) stops all location use associated with that session.

The App requests location with an on-device explanation: "Init uses your location to show lounges near you and to confirm you're at a venue when you check in."

6. Information Sharing and Disclosure

6.1 We Do Not Sell Your Data

Init does not sell, rent, or trade your personal information to third parties. We never have and never will.

6.2 What Other Users Can See

Other people checked in to the same lounge can see, before any match:

• Your vibe card text
• Your age range and gender
• Your profile photo — only if you have turned photo visibility on for that card (and, if you chose "vibed only," only after they have vibed you)

They cannot see your name, username, profile, phone number, date of birth, exact location, or the fact that you have vibed anyone (unless it is mutual).

When you match (through Lounge or the private interest feature), we share with the matched user your display name, your username (Init ID), the lounge where you matched (for a Lounge match) or the overlapping interest categories (for an interest match), and the messages you send in that conversation.

We never share your phone number, your date of birth, your precise location, or your non-mutual vibes or interests with any other user.

6.3 Third-Party Service Providers

We use the following third-party services to operate the App. These providers process data on our behalf and are prohibited from using your data for their own purposes.

Geocoding providers receive only what is needed to answer a place query. We do not send them your name, account identifiers, or contact details.

6.4 Legal Requirements

We may disclose your information if required to do so by law or in good faith belief that such action is necessary to comply with a legal obligation or court order, protect and defend our rights or property, prevent or investigate possible wrongdoing, or protect the personal safety of users or the public.

7. Data Retention

Account deletion: your account enters a 30-day grace period during which you can reactivate it. After 30 days, all your data is permanently and irreversibly deleted — including your profile and photo, all vibe cards, Lounge sessions and vibes, all interest records, all chat messages, and all match records and notifications.

8. Your Rights

8.1 All Users

• Access — request a copy of the personal data we hold about you.
• Correction — update inaccurate or incomplete personal data via your profile settings.
• Deletion — delete your account and all associated data at any time from Profile → Delete Account.
• Withdraw location consent — revoke location permission in your device settings at any time; Init Lounge stops working while the rest of the App continues.

8.2 Indian Users — Digital Personal Data Protection Act, 2023 (DPDP)

8.2.1 Your Rights Under the DPDP Act

• Right to information about processing (Section 11) — you may request a summary of the personal data we hold about you and the processing activities we have carried out or are carrying out with that data.
• Right to correction and erasure (Section 12) — you may request correction of inaccurate or incomplete personal data, and erasure of personal data that is no longer necessary for the purpose for which it was collected or if you have withdrawn your consent.
• Right to grievance redressal (Section 13) — you may raise a grievance with our Grievance Officer (see Section 14). We will acknowledge receipt within 48 hours and resolve it within 30 days.
• Right to nominate (Section 14) — you may nominate another individual to exercise your rights under the DPDP Act in the event of your death or incapacity.

8.2.2 Consent and Purpose

Under Section 6 of the DPDP Act, we provide the following consent notice:

How to withdraw consent: delete your account via Profile → Delete Account. Account deletion is the withdrawal of consent under the DPDP Act. Upon deletion, your data will be permanently erased within 30 days. You may withdraw location consent separately at any time through your device settings.

8.2.3 Data Breach Notification

In the event of a personal data breach that is likely to cause harm to you, we will notify the Data Protection Board of India and affected users as required under Section 8(6) of the DPDP Act, without undue delay.

8.2.4 Cross-Border Data Transfers

Your personal data is processed on servers located in the United States (AWS us-east-1). Map-tile and geocoding requests may also be served from infrastructure outside India. Cross-border transfers are subject to Section 16 of the DPDP Act. We will comply with any restrictions on cross-border data transfers that the Government of India notifies under the Act, and will migrate to India-based infrastructure if required.

8.3 California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete your personal information (via account deletion); to non-discrimination for exercising your rights; and to opt out of the sale of personal information — Init does not sell personal information, so this right is satisfied by default. Contact privacy@initmatch.com to exercise these rights.

8.4 EEA, UK, and Brazil Residents (GDPR / UK DPA / LGPD)

If you are located in the EEA, UK, or Brazil, you additionally have the right to data portability (receive your data in a machine-readable format), restriction of processing, the right to object, and the right to lodge a complaint with your local data protection authority.

Legal basis for processing: account operations, Init Lounge, location collection for proximity verification, and matching are performed on the basis of contractual necessity (and, for location, your device-level permission); anti-spoofing, safety, and security on the basis of legitimate interest; age verification as a legal obligation; push notifications on the basis of your consent.

International data transfers: your data is processed on servers in the United States (AWS us-east-1). For transfers from the EEA/UK, we rely on AWS's Standard Contractual Clauses (SCCs). Geocoding providers used for non-India lookups (Komoot, OpenStreetMap Foundation) are based in the EEA/UK.

9. Children's Privacy

Init is strictly for users aged 18 and older. We require date of birth verification at registration. We do not knowingly collect personal information from anyone under the age of 18. If we become aware that a user is under 18, we will immediately terminate their account and delete all associated data.

If you believe a minor is using the App, please contact us at privacy@initmatch.com, or use the in-app report option and select "Suspected underage user."

10. Push Notifications

You may receive push notifications for a new match (Lounge or interest), a match ending, and new messages from a matched user. You will not receive a notification when someone vibes or expresses interest in you but you have not reciprocated — unreciprocated interest is never surfaced. You can disable push notifications at any time through your device settings; this does not affect the core functionality of the App.

11. SMS and Email Communications

We send SMS messages and emails only for transactional purposes: one-time passwords (OTP) for account verification. We do not send marketing messages via SMS or email. By registering with a phone number, you consent to receiving verification codes necessary for account security.

12. Cookies and Tracking

The Init mobile app does not use cookies or web-based tracking technologies. We do not use advertising trackers or pixel tags in the App. See our Cookie Policy for details on how our website uses browser storage.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via an in-app notification and update the "Last Updated" date at the top of this page. Continued use of the App after notification constitutes your acceptance of the updated policy.

14. Contact Us & Grievance Officer

14.1 General Privacy Inquiries

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Email: privacy@initmatch.com
• Subject line: "Privacy Inquiry — [Your Username]"

We will respond to all privacy-related inquiries within 30 days.

14.2 Grievance Officer (India — DPDP Act 2023 & IT Act 2000)

In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Init has designated a Grievance Officer for India:

• Name: Bipin Bettadalli Neelakanta
• Designation: Grievance Officer
• Email: privacy@initmatch.com
• Postal address: Om Chambers, 648/A, 4th Floor, Binnamangala 1st Stage, Indiranagar, Bengaluru — 560038, Karnataka, India
• Response time: Acknowledgement within 48 hours; resolution within 30 days of receipt

You may contact the Grievance Officer to exercise your rights under the DPDP Act (access, correction, erasure, nomination), to report a privacy concern, or to raise any grievance related to the processing of your personal data. If your grievance is not resolved to your satisfaction, you may approach the Data Protection Board of India once it is constituted.