Privacy policy

Account data: name, email, display name, preferred language, and an angler code we generate. Vendors additionally provide business name, address, GST/FSSAI numbers, identity and licence documents, and payout details (UPI ID or masked bank account).

Transaction data: bookings, bids, orders, tickets, wallet balance and subscription status. Card and UPI credentials are handled by Razorpay and never reach our servers.

Content you add: photos, catch logs, trip notes, reviews, group messages and event scores. Photos are stripped of EXIF location metadata before public display.

Location: approximate device location only when you enable "near me" or "Best fishing time". Exact catch spots you record in the Catch Vault are stored privately and never shown to others.

Technical data: device type, app version, crash logs and basic usage analytics. On the web we may show advertising from Google AdSense, which uses cookies under Google's policy; you can opt out in your browser.

To create and secure your account; to complete bookings, auctions, orders and event registrations; to pay vendors and issue refunds; to show you nearby trips and weather windows; to send transactional notifications; to verify vendors and prevent fraud; to meet legal obligations such as tax records and FSSAI compliance; and, with your separate consent, to send offers.

You give consent when you create an account (age 18+ and these terms) and for optional purposes such as location and marketing, each of which you can withdraw at any time from Me → Settings → Privacy & consent. Withdrawing consent does not affect processing done before withdrawal, and some services (for example bookings) cannot work without the related data.

Fishing Journey is not for children. We do not knowingly process data of anyone under 18.

Vendors receive your name, angler code and booking or order details needed to serve you; your phone number is shared only after a confirmed booking or paid order and only with that vendor. Vendors see exact pickup or venue details you choose to give them.

Processors: Supabase (database and storage, hosted in India/Asia-Pacific regions), Razorpay (payments), weather data providers (anonymous coordinates only), push-notification and email services. Each is bound by contract to protect your data.

We never sell personal data, and we never sell or publish exact fishing locations. We disclose data to authorities only when required by Indian law.

Under the DPDP Act you can access a summary of your data, correct or update it, withdraw consent, nominate a person to exercise your rights if you are unable to, and request erasure. Most of this is self-service in Me → Settings. Account deletion removes your profile, vault, messages and cart; transaction records we must keep for tax or dispute purposes are retained for up to 8 years in a restricted ledger and then deleted.

When you report content we store the report, your user id and the content reference so we can investigate and show you the outcome. When you block a member we store the pair of ids to hide messages both ways. Uploaded photos are checked (automatically and by our team) for children's faces, protected species and personal documents; photos that fail are hidden or removed. Moderation records are kept for 180 days after a case closes.

We keep data only as long as needed for the purposes above. Vendor verification documents are kept while the vendor is active and for 1 year after. Data is encrypted in transit and at rest, access is role-restricted with row-level security, and we review access logs regularly. No system is perfectly secure; we will notify you and the Data Protection Board of India of a personal data breach as the law requires.

Grievance Officer: Vlightsoft, admin@vlightsoft.com. We acknowledge within 24 hours and resolve within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.

Grievance Officer and your DPDP rights: see the Grievance Officer page.

We may update this notice; material changes are announced in-app and the date above is revised.

Account & identity (name, email, phone, angler code) — to run your account. Transactions (bookings, orders, wallet, payouts) — to deliver services and meet tax law. Content (photos, catches, reviews, messages) — to show what you share. Location (approximate) — only for nearby results and weather when you allow it.

ID verification (optional, separate consent): document type, last 4 characters of the number, name as on the ID, year of birth and the AI check result. ID images are deleted 30 days after the decision. We never store a full Aadhaar number and we do not use face recognition.

Account data: while your account is active. Transaction records: up to 8 years (tax law). Reports and moderation records: 3 years. ID images: 30 days after the decision; the verification result while your account is active. Security/audit logs: at least 180 days, at most 2 years.

Access: Account → Identity & safety → Download my data. Correction: edit your profile in Settings. Erasure: Settings → Delete account. Consent withdrawal: Settings → Privacy & consent, or Identity & safety for ID verification. Nomination: email the officer naming the person who may exercise your rights if you die or become unable to. Grievance: see below.

Grievance Officer, Vlightsoft — admin@vlightsoft.com. We acknowledge within 24 hours and resolve within 15 days. You may escalate to the Data Protection Board of India.

Security controls: HTTPS everywhere with HSTS, a strict Content-Security-Policy, row-level security on every table, private storage buckets for documents, rate limits on reporting and joining groups, an append-only admin audit log and automated security alerts.

We keep security and audit logs for at least 180 days, as required by the CERT-In Directions of 28 April 2022, and report cyber-security incidents to CERT-In within 6 hours. Found a vulnerability? Email admin@vlightsoft.com (see /.well-known/security.txt).

Website visit statistics are first-party (no third-party analytics). Until you press Accept on the cookie notice — or if your browser sends Global Privacy Control — we only count visits anonymously per day and device type; no identifier is stored. If you accept, we keep a random visitor ID in your browser and record pages viewed, the landing page, the referring website (domain only), campaign tags, device/browser/OS family, language and an approximate city/state from your network (never GPS). We never store your IP address; a daily-rotating one-way hash is used only to stop abuse. Choosing "Essential only" later removes the visitor ID from your browser. Visit records are deleted after 13 months.

When you request a callback, ask a vendor, subscribe to tips, contact us or register interest as a vendor, we store what you typed, the page you sent it from and the consent you gave. Callback requests are shared with that vendor so they can reply. If you sign in later, your earlier requests and visits on this browser are linked to your account.

Enquiries that do not lead to a booking or account are deleted after 18 months. Marketing messages are sent only if you opted in and you can stop them at any time. Staff access to contact details is restricted and logged.