Privacy Policy

Version 1 · Updated 4 November 2026

This policy explains what Raahi collects about you, why, who sees it, how long we keep it and what you can do about it. We wrote it to be read.

Who we are

Raahi is run by Kairox Private Limited (CIN U62011PN2025PTC250070), 401B, Lotus Excellence, Lane Opp. Janata Sahakari Bank, Sus, Haveli, Pune 411021, Maharashtra, India. We are the controller of your personal data.

Questions, requests and complaints about privacy: [email protected]. This address is also our single point of contact for users and authorities under the EU Digital Services Act and our grievance contact under India's Digital Personal Data Protection Act.

What we collect

Things you give us:

• Account: your name and email from Google or Apple sign-in, and a phone number if you add one.
• Profile: photos, date of birth (to confirm you are 18 or older), gender, bio, interests, languages, travel style, home country and the places you list.
• Trips, hangouts, reviews, your travel history, and your friends and blocks.
• Messages and photos you send in chats.
• Safety contacts you add (their name, phone number and relation), and safety timers and SOS alerts you start.
• Reports you send and messages to our support team.

Things from your phone, only when you allow them:

• Location: while the app is open, and only in the mode you choose (off, approximate or precise). We never track you in the background.
• Camera: for the live selfie check, and for photos you take in the app.
• Photos you pick, through the system picker. Calendar: only to add a trip when you ask.
• Notification permission and a push token so we can notify you.

Things created by using Raahi:

• Your subscription status (from the app store and RevenueCat; we never see your card).
• Technical data: device type, app version, language, IP address and when you were last online, used to keep the service secure and working.
• A hidden trust and safety score, explained below.

Why we use it, and our legal basis

• To run your account and match you with other travelers, trips and hangouts. Basis: contract (GDPR Art. 6(1)(b)).
• To show you nearby trips and people and to share your location in the way you chose. Basis: your consent (Art. 6(1)(a)); you can switch it off at any time.
• The live selfie check that earns the verified badge. Basis: your explicit consent (Art. 9(2)(a)), because comparing faces is biometric processing. See the next section.
• Safety features: SOS, check-in timers, live-location links to people you pick. Basis: your consent, and protecting your vital interests in an emergency (Art. 6(1)(d)).
• Keeping Raahi safe: spotting fake or abusive accounts, filtering unsafe images and text, handling reports, enforcing the guidelines and Terms. Basis: our legitimate interest in a safe community (Art. 6(1)(f)), balanced against your rights.
• Notifications you ask for (messages, trip updates). Basis: contract; marketing messages only with your consent.
• Subscriptions and receipts. Basis: contract and legal obligation (tax and accounting records).
• Meeting legal requests and defending legal claims. Basis: legal obligation and legitimate interest.

We do not sell your data, we do not show ads, and we do not use advertising identifiers or third-party advertising trackers.

The live selfie check

To verify you, the app streams short live camera frames while you follow on-screen prompts (look straight, turn your head, open your mouth). Our own server analyses each frame in memory to confirm a real, live person, and compares two moments of the check to confirm they are the same face. The frames and the face measurements are not stored; we keep only whether you passed and when, and the number of attempts.

We ask for your explicit consent before the camera opens. You can say no and keep using Raahi without a verified badge. You can withdraw consent in Settings; this does not remove a badge you already earned, but you will need to consent again to repeat the check.

Separately, a face detector runs over profile photos you upload to make sure a photo shows a person, and a safety filter blocks explicit images. The result of that detector can feed the trust and safety score below.

Trust and safety score

We keep a hidden score for each account, built from signals such as verification, account age, reports, how complete a profile is and whether profile details are consistent. It decides in what order we suggest people and may limit some features when an account looks risky.

A person reviews any decision to restrict or close an account. If you think we got it wrong, write to us and we will look again.

Who can see what

• Other members see your profile (name, photos, bio, interests, verification, age and country) and what you post. Your exact date of birth, email and phone number are not shown.
• Your location is visible only in the mode you set, to the audience you set. People you add to a live-location link see your position through that link until it ends.
• Trip and hangout members see each other as you would expect in a group.
• Safety contacts get alerts only when you start an SOS, timer or live-location link.

Who we share it with

We use service providers (processors) under contracts that limit them to our instructions:

• Hosting and storage: a virtual server provider for the app and database, and Cloudflare for media storage. Our database and file storage run on servers in Mumbai_India.
• Sign-in and notifications: Google (Sign-In and Firebase Cloud Messaging) and Apple (Sign in with Apple and push notifications).
• Subscriptions: RevenueCat, together with Google Play and the Apple App Store.
• Maps: Mapbox in the app. The live-location web page loads map tiles through our own server, so your contact's browser does not talk to a map company.
• Cover images: when a trip or hangout uses a suggested cover photo, the photo is loaded from Unsplash's image servers (images.unsplash.com), which therefore see your IP address like any website would.
• Text messages (when phone sign-in is on): MSG91.

We may also disclose information if the law requires it, to protect someone's safety, or in a merger or sale of the business (we would tell you first).

Moving data between countries

Kairox Private Limited is in India. If you are in the European Economic Area, your data is processed in India and by the providers above, some of them in the United States and other countries. For these transfers we rely on the European Commission's standard contractual clauses, or the EU–US Data Privacy Framework where the provider is certified, together with security measures described below.

How long we keep it

• Your account data, trips, hangouts, chats, photos and travel history: until you delete your account.
• When you delete your account we remove your profile and everything tied to it straight away, delete your uploaded photos, and ask Apple and RevenueCat to remove their records. Copies in our encrypted backups disappear when the backup rotates, within 30 days.
• Sessions: until they expire or you sign out. Push tokens: removed after 90 days unused.
• Read notifications: 60 days. All notifications: 180 days. Notification delivery records: 90 days.
• Safety-filter scan records: 14 days if the image was allowed, 180 days if it was blocked.
• Selfie check attempts (pass or fail only, no images): 180 days.
• Closed support tickets: 365 days. Admin action logs: 2 years.
• Server logs with IP addresses: up to 30 days.
• Billing records we must keep for tax: as the law requires (in India, usually 8 years).
• Your last known location: until you turn location sharing off, which erases it at once.

Your rights

You can ask us to access, correct, delete, restrict or move your data, and to stop processing it where we rely on legitimate interest. Where we rely on consent, you can withdraw it at any time without affecting what happened before.

• Delete your account: Profile → Settings → Delete account. Or see /delete-account if you cannot open the app.
• Download your data: Settings → Privacy → Download my data (a file in a common format).
• Everything else: email [email protected]. We answer within one month.

You can also complain to a data protection authority. In the EU that is the authority in the country where you live or work (list at edpb.europa.eu); in India, the Data Protection Board.

Security

Connections are encrypted. Sessions can be revoked. Access to production systems is limited and logged. Private chat media is served only to members of the chat. If a breach puts your rights at risk we will tell you and the regulator within the time the law sets (72 hours for the regulator in the EU).

Age

Raahi is for people aged 18 and over. We ask for your date of birth, refuse sign-up under 18, and delete accounts we learn belong to someone younger.

Cookies and our website

The app does not use cookies or advertising trackers. Our website (https://raahi.app) uses Google Analytics only if you accept it in the banner; if you decline, nothing is stored. Fonts and scripts on our pages are served from our own domain. You can change your choice from the link in the page footer.

Changes

If we change this policy in a way that matters, we will tell you in the app before it applies and ask you to accept it again if the law requires. The date at the top shows the current version.