Privacy policy

Last updated: 9 November 2026

Gharmatch is an open-source project. You can read how our code handles your data in our public repository, for example src/server/contacts.ts and src/lib/safety.ts. This policy explains what personal data the live Gharmatch service collects, why, and your rights under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). The project maintainer named in section 7 is the Data Fiduciary, and you are the Data Principal.

1. What we collect, and why

We collect only what is needed to run house-rule matching and keep people safe.

• Sign-in details: your email address, name and profile picture as Google gives them, and a Google account identifier, to sign you in. Sign-in is with Google only. We do not keep Google’s access tokens.
• Phone number: required to rent out a home, optional for tenants. It is stored privately, left out of ordinary database queries, and shown to another user only after an interest between you is accepted.
• Your agreement: the date and version of the Terms and Privacy Policy you accepted, so we can record your consent and ask again if they change.
• Listings, searches and messages: your house rules and preferences, photos shrunk to WebP, a private full address, an approximate map pin, interest messages and visit plans.
• Verification dates, no ID files: when we check an ID, an ownership document or a building, we record only the type of check and its date. We never keep copies of your Aadhaar, PAN, passport or property papers.
• Trusted contact (optional): a name and number you enter to address your own visit-safety message. We never contact or message them.
• Agreed house rules: when an interest is accepted, a saved copy of the home’s house rules and disclosures at that moment, so both sides can check what was agreed.
• Safety report copies: when someone files a report, a saved copy of the reported listing, search or account, account ids, and recent messages between the two accounts, so evidence cannot be erased by editing or deleting.
• Anonymous counters: simple counts such as “interest sent”, with no name, email or phone attached, to see whether the project is useful.

2. Who can see your data

• Public visitors see listings with house rules, photos and a map showing only an area of about 1 km. They never see your phone, email or exact address.
• Accepted matches only: your exact address, email and phone open to one specific person only after an interest between you is accepted.
• Extra care for women’s searches: for searches by women or mixed groups, landlords see only the requirements. No name or free-text introduction is shown until the tenant replies.
• Project maintainers (admins) can see flagged posts and safety reports, only to moderate abuse and support dispute snapshots.

3. What we do not do

• No selling data. We never sell, rent or share user data with brokers, marketers or lead-generation companies.
• No personal data in logs. Phone numbers and emails are kept out of our server logs.
• No marketing. We only send essential service emails, such as reports and appeals you file, or critical account and safety notices, and never promotional spam.
• Today there are no ads and no fees. If the project ever adds optional paid features to cover server costs, we will give notice and update these documents first, and we will still never sell your personal contact details to third parties.

4. Infrastructure and service providers

These providers store and process data on our behalf, under security duties:

• Vercel: hosting, with functions set to Mumbai (bom1).
• Neon: the PostgreSQL database.
• Cloudflare R2: photo storage.
• Google: sign-in and map links or embeds.
• Resend: report and appeal emails, when switched on.

Some providers may process or back up data on servers outside India, including in the United States or the European Union, unless the Central Government restricts a destination under Section 16 of the DPDP Act, 2023. Because the project uses free and low-cost tiers, a provider’s limits or outage can make the service slow or unavailable.

5. Safety, mediation and law enforcement

We may keep and share saved report copies, account ids, messages and timestamps:

1. with the police or a court when we receive a valid legal request under Indian law, including Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023 or the Information Technology Act, 2000, or when needed in good faith to prevent serious physical harm, unlawful surveillance, extortion or fraud; and
2. with both people in a match during Step 2, neutral rule-snapshot facilitation, under our Terms of Use, so neither can falsely say the house rules were different when they matched.

6. Retention, deletion and your rights

• Listings expire after 30 days unless you press “Still available” on your dashboard.
• Edit and delete: you can edit or delete your listings and searches at any time.
• Account deletion and withdrawing consent: delete your account from the account page. Your name, email, phone, picture and trusted contact are removed at once, and the empty record is removed for good after 30 days. If you are part of an active or past abuse report, its saved copy is kept to prevent repeat abuse and meet legal duties, as the DPDP Act allows. Processing done before you withdraw consent stays lawful.

Under the DPDP Act, 2023 you have the right to:

1. ask for a summary of the personal data we process about you and what we do with it;
2. have inaccurate data corrected, completed or erased;
3. withdraw your consent;
4. nominate another person to exercise your rights if you die or cannot act for yourself; and
5. complain to our Grievance Officer first, and then approach the Data Protection Board of India if you are not satisfied or hear nothing within the time allowed.

Security and your duties. We protect your data with encryption in transit (HTTPS) and strict server-side access controls (see src/server/contacts.ts). Under Section 15 of the DPDP Act, 2023, you must not impersonate anyone, give false information during verification, or file false or frivolous reports or grievances.

7. Grievance contact

For data requests, bugs or safety grievances, write to:

• Name: Ayush, Project Maintainer and Grievance Officer
• Email: gharmatch1@gmail.com
• Location: Ahmedabad / Gandhinagar, Gujarat, India
• Response time: acknowledged within 24 hours and resolved within 15 days.