Privacy policy

Draft: requires legal review before launch. This text is a working draft prepared for review by a qualified Indian lawyer. It is not legal advice and may change.

Last updated 23 October 2026

This policy explains what personal data Veyra collects, why, who sees it and what you can do about it. We act as the “data fiduciary” for your data under the Digital Personal Data Protection Act, 2023 (DPDP Act), and we follow the Information Technology Act, 2000 and its rules. It is read together with our Terms of use.

1. What we collect

  • Sign-in data: your email address. If you choose Google sign-in, Google tells us your verified email address and your name. We do not receive your Google password, contacts or any other Google data.
  • Profile data you give us: your handle, display name, and optional bio and photo.
  • Age check: the date of birth you enter at sign-up is used on your device to confirm that you are 13 or older. We do not store it.
  • Activity: your posts, replies, likes, follows, votes, fan-club memberships, the cards you own, your orders and your notification settings.
  • Photos: images you attach to posts. They are resized and compressed, and location and camera details (EXIF) are removed.
  • Usage and feed data: which posts were shown to you and which you opened, liked or replied to, to rank your feed and detect abuse. We do not use it to profile you outside Veyra.
  • Payment records: order and payment identifiers and the amount. Your card, UPI or bank details go to our payment partner (currently Razorpay) and are never seen or stored by us.
  • Technical data: your IP address, browser type and security logs, kept for a limited time to keep the service secure and to prevent abuse.

2. Why we use it, and on what basis

We process your data with your consent, which you give when you create an account, and for the legitimate uses the law allows, to:

  • create and secure your account, and send you sign-in codes;
  • run Veyra: show your collection, rankings and posts, and issue and certify your cards;
  • take payments, issue refunds and keep the accounting records we must keep by law;
  • send notifications you have not switched off, and service messages such as security notices;
  • personalise your feed, prevent fraud and manipulation, and enforce our rules;
  • comply with law and respond to lawful requests.

We do not sell your personal data, and we do not show third-party advertising.

3. Who can see it

Your handle, name, photo, bio, posts, replies and public activity are visible to other people, and the Weekly War shows support counts. Your email address is never shown publicly. We share data only with the service providers that help us run Veyra, under contract and only as needed: cloud hosting and storage, an email delivery provider, our payment partner, error monitoring and a bot-protection service. Some of these providers process data outside India. We may also disclose data when the law or a lawful order requires it, or to protect people from harm.

4. Cookies and similar storage

Veyra stores a small amount of data on your device: a sign-in token, your theme choice and some interface preferences. These are needed for the app to work. We do not use advertising or cross-site tracking cookies.

5. How long we keep data

  • Photos: deleted at the end of the competition week after the week they were posted (between 7 and 14 days), together with the post they belong to, its replies and likes.
  • Text posts, replies and profile data: kept until you delete them or your account.
  • Sign-in codes: expire within minutes and are stored only in hashed form.
  • Order, ownership and points records: kept, without your name, for accounting, tax and the integrity of the competition, for as long as the law requires.
  • Security and technical logs: kept for a limited period, normally no more than 90 days.
  • Backups: encrypted copies are kept for up to 30 days and then removed.

6. Your rights

You have the right to access your data, to correct it, to have it erased, to withdraw consent, to nominate someone to exercise your rights if you cannot, and to complain.

  • Download your data and delete your account yourself in Settings. Deleting removes your profile, posts, replies, likes and follows.
  • For anything else, use the Contact page. We will reply within 30 days at the latest. We may need to confirm your identity first.
  • If you are not satisfied with our reply, you may complain to our Grievance Officer, and then to the Data Protection Board of India once it is operational.

7. Children

Veyra is for people aged 13 and over. If you are under 18, a parent or guardian must agree to our terms for you and must consent to any purchase. We do not knowingly collect data from children under 13. If you think a child under 13 has an account, tell us and we will delete it.

8. Security

We protect your data with encryption in transit, hashed sign-in codes, access controls, rate limits and logging. No system is perfectly secure. If a breach affects your personal data we will tell you and the authorities as the law requires.

9. Changes

We may update this policy. If a change is material we will tell you in the app or by email.

10. Contact and Grievance Officer

Privacy questions and requests: our support team (contact details are being set up). The name and details of our Grievance Officer are on the Contact page.