1. Who we are
WarnPack ("we", "us") is operated by Aditya Kakade, Aditya Kakade, 536 Main Street, Mumbai, Maharashtra, India. For privacy questions write to privacy@warnpack.com. For purposes of data-protection law we are the controller of the personal data described here.
2. Information we collect
| Category | What | Why |
|---|---|---|
| Account | Username, a password (stored only as a salted bcrypt hash), and your email address, which we use to send a one-time verification code. We do not store your email address in readable form; we keep a one-way hash of it so we can recognise a returning account. | Create and secure your account, recover access, prevent duplicate and abusive accounts. |
| Profile | Optional profile picture. | Show your profile to other users. |
| Posts and comments | Titles, text, photos and videos you upload, the city you select, votes and comments. | Provide the community scam-alert feed. |
| Precise location | GPS coordinates from your device, only while the app is in the foreground and only after you grant permission. | Show AirDrops posted within about 100 m of you and attach your AirDrop to where you are. Posts are tagged with the city you choose, not with GPS. |
| Messages | Direct messages are encrypted on your device before they are sent. We relay and temporarily hold the encrypted data and we hold the public key you publish. We cannot read the content. | Deliver messages between users. |
| Device and notifications | A push-notification token (Firebase Cloud Messaging), app version, and basic technical data such as IP address and request logs. | Deliver notifications, secure the service, rate-limit abuse and fix bugs. |
| Reports and moderation | Reports you make or that are made about you, the content reported, and actions we take. | Keep the community safe and enforce our rules. |
We do not collect contacts, microphone audio, or your location when the app is closed. We do not currently use third-party advertising or behavioural analytics inside the app.
3. How we use information
- To operate the app: sign-in, feed, comments, votes, AirDrops and chat.
- To keep the community safe: automated and manual moderation, handling reports, blocking abusive accounts, preventing spam and promotions.
- To secure the service: detect fraud, abuse and attacks, and apply rate limits.
- To communicate with you: verification codes, security notices and replies to support requests.
- To comply with law and to establish or defend legal claims.
Legal bases (EEA/UK). Performance of our contract with you (running your account), our legitimate interests (safety, security, improving the service), your consent (location permission, push notifications), and legal obligation.
4. Location, AirDrops and your safety
- AirDrops are short messages visible to other WarnPack users within roughly 100 metres of the spot where you posted. They expire automatically after 10 minutes.
- The nearby view shows other users' usernames and approximate distance. It does not reveal their exact coordinates.
- You can turn the radar off in the AirDrop tab or revoke the location permission in your device settings at any time.
5. Messages and end-to-end encryption
Each account has a key pair created on the device. The private key stays on your device. Messages are encrypted to the recipient's public key before they leave your phone. Our servers see who sent a message to whom, when, and the size, but not what it says. Undelivered encrypted messages are kept for no more than 48 hours and are deleted once delivered. Delivered messages are stored on your own device; if you delete the app or clear its data, they cannot be recovered. Because we cannot read messages, we can only act on a chat report using what the reporting user chooses to share with us.
6. Who we share information with
We do not sell your personal information and we do not share it for third-party advertising. We use service providers (processors) who act on our instructions:
- Google Cloud - server hosting and databases.
- Google Firebase Cloud Messaging - delivery of push notifications.
- Email delivery provider - sending one-time verification codes.
- Cloudflare - DNS, content delivery and privacy-friendly website analytics that does not use cookies.
- Expo - delivery of app updates.
Content you post publicly (posts, comments, your username and profile picture) is visible to other users. We may disclose information when required by law, to respond to valid legal process, to protect someone's safety, or to enforce our Terms. If we ever show ads (for example Google AdMob or AdSense), we will update this policy and the app's data-safety disclosure first and ask for consent where the law requires it.
7. How long we keep information
| Data | Retention |
|---|---|
| AirDrops | 10 minutes, then removed. |
| Live location used for the radar | Held in memory only while you are using the app and removed within 30 minutes of the last update. |
| Undelivered encrypted messages | Until delivered, and in any case no more than 48 hours. |
| Account, posts, comments, media | Until you delete them or your account. |
| Server and security logs | Up to 30 days. |
| Reports and moderation records | Up to 24 months, to deal with repeat abuse and appeals. |
| After you delete your account | Account data is deleted or irreversibly anonymised within 30 days. Encrypted backups are overwritten within a further 35 days. |
8. Your rights and choices
Depending on where you live (including under the EU/UK GDPR, India's Digital Personal Data Protection Act 2023, and California law) you may have the right to access, correct, delete, restrict or object to our use of your data, to withdraw consent, and to complain to your local regulator. We apply these rights to all users.
- Delete your account and data: in the app go to Profile → Settings → Delete account, or use our account deletion page.
- Delete a post or comment: use the delete (bin) icon on your own content.
- Location and notifications: change the permissions in your device settings.
- Other requests: email privacy@warnpack.com. We reply within 30 days. We may need to confirm that you control the account first.
We do not sell or "share" personal information for cross-context behavioural advertising, as those terms are defined under California law.
9. Children
WarnPack is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child is using the app, email safety@warnpack.com and we will act promptly. See our child safety standards.
10. Security
All traffic between the app and our servers uses HTTPS/TLS. Passwords are hashed. Direct messages are end-to-end encrypted, and uploaded media is encrypted at rest. No system is perfectly secure; please use a strong, unique password.
11. International transfers
Our servers and service providers may be located outside your country. Where required, we rely on appropriate safeguards such as standard contractual clauses.
12. Changes to this policy
If we make material changes we will update the date above and notify you in the app or by email before they take effect.
13. Contact and grievance officer
Privacy: privacy@warnpack.com
Grievance Officer (India IT Rules, 2021): Aditya Kakade, legal@warnpack.com. We acknowledge complaints within 24 hours and aim to resolve them within 15 days.
Postal address: Aditya Kakade, Aditya Kakade, 536 Main Street, Mumbai, Maharashtra, India