Lungdi

Privacy Policy

Last updated: 15 October 2026

This Privacy Policy explains how Lushai Tech ("we", "us") collects, uses, shares, keeps and protects your personal data when you use the Lungdi mobile app and this website (together, the "Service"). We are the Data Fiduciary for your data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, and we also follow the Information Technology Act, 2000 and the rules made under it.

By creating an account you give your consent to the processing described here. You can withdraw it at any time (see section 11).

1. Data we collect

Information you give us

  • Phone number, to create your account and sign you in with a one-time SMS code.
  • Profile information: name, email address, date of birth, gender and the gender you want to meet, the age groups you want to see, relationship status, job title, bio, "what I'm looking for", and your interests and hobbies.
  • Photos: one profile picture and 3–6 gallery photos. We store each in three sizes.
  • Verification selfie, if you choose to verify (see section 2).
  • What you do with other people: connection requests (including any note you add), accepted connections, favourites, people you hide or block, and reports you file.
  • Messages: chats, photos, voice notes and videos you send (see section 5).
  • Support and grievance requests you send us.

Information collected automatically

  • Precise location (GPS), with your permission, to find people near you and to show others your approximate distance.
  • Profile views: when you open someone's profile we record that you viewed it. The other person only ever sees a count, never who viewed them.
  • Online status: whether you are connected to the app right now. We do not keep a "last seen" history.
  • Device and session information: a device description for each signed-in session (for example "iPhone 15 - iOS 18"), a push-notification token, and the public encryption keys your device generates for chat.
  • Server logs: a record of each request to our servers (time, the address requested, the result and how long it took). We use your IP address briefly to limit abuse but do not store it in our database.

Purchases

If you subscribe, payment is handled by Apple (App Store) or Razorpay. We receive your plan, billing period, status, dates and transaction identifiers. We never receive or store your card, bank or UPI details.

2. Sensitive data

Some of what we hold deserves extra care, and we treat it that way:

  • Your exact location is never shown to anyone. Other users only see a distance rounded to the nearest kilometre.
  • Your date of birth is never shown. Others see your age.
  • Your gender and who you want to meet can reveal your sexual orientation. Your preference is used only for matching and is not shown on your profile.
  • Face data. Verification uses automated face comparison (Amazon Rekognition) to check that your selfie matches your profile picture. The selfie is deleted as soon as the check finishes, whatever the result. We keep only the outcome (verified or not). We do not build or store a face template.

3. How we use your data

  • To create and secure your account and sign you in.
  • To show your profile to other users and recommend people to you based on distance, age preference and shared interests.
  • To deliver messages and send the notifications you allow.
  • To verify profiles, review reports, and enforce our Terms of Service.
  • To process subscriptions and send renewal reminders.
  • To keep the Service secure, fix problems and prevent fraud and abuse.
  • To meet our legal obligations, including responding to lawful requests from authorities.

We process your data on the basis of your consent, and, where the law allows it without consent, to comply with the law or a court or government order. We do not sell your personal data, show you advertising, or use third-party analytics or advertising trackers.

4. What other users can see

Other users can see your name, age, gender, age group, job title, bio, "what I'm looking for", photos, interests and hobbies, verification badge, and your distance from them (rounded to the nearest kilometre). People you are connected with can also see when you are online.

No other user can see your phone number, email address, date of birth, exact location, or the people you have viewed, favourited, hidden, blocked or reported.

5. Messages

Chats are end-to-end encrypted: they are encrypted on your phone and can only be decrypted on the recipient's phone. We cannot read them.

  • Our servers hold the encrypted message only until it is delivered to the recipient's device. Once delivered, we delete the encrypted content and any attached media.
  • We keep basic details about each message (who sent it, when, its type such as text or photo, and whether it was delivered and read) so your chat list and read receipts work.
  • Because we cannot read chats, we cannot review a reported conversation unless you include the relevant content in your report.
  • Message notifications never contain the message text. They may show the sender's name and small profile picture.

6. Who at Lushai Tech can access your data

A small number of authorised staff can view account details (including phone number, email and date of birth) through an internal admin panel protected by password and two-factor authentication, only to provide support, review reports and keep the Service safe. Every admin action is recorded in an audit log.

7. Service providers we share data with

We share data only with providers that help us run the Service, only what each one needs, and under contracts that require them to protect it:

  • Amazon Web Services (Mumbai, India): servers, database, verification-selfie storage and face comparison.
  • Cloudflare: storage and delivery of profile photos and encrypted chat attachments.
  • Fast2SMS (India): sending sign-in codes to your phone number.
  • Google Firebase Cloud Messaging: delivering push notifications.
  • Apple and Razorpay: processing subscription payments.

We may also disclose data when the law requires it, for example in response to a lawful order from a court or a government agency, or to protect the safety of a person. If our business is transferred, your data may move to the new owner, who must keep honouring this policy.

8. Where your data is stored

Our servers and database are in India (AWS Mumbai). Cloudflare and Google operate globally, so photos and notifications may be processed outside India. We only transfer data to countries the Government of India has not restricted under section 16 of the DPDP Act.

9. How long we keep data

  • Your account and profile: while your account is active or paused.
  • Verification selfies: deleted immediately after the check.
  • Message content: deleted from our servers once delivered.
  • Message details (sender, time, type, receipts — never content): kept so chat lists keep working; after your account is deleted they no longer identify you.
  • Server logs: 1 year, as required by CERT-In directions under the IT Act and the DPDP Rules, 2025.
  • After you delete your account: see section 10.
  • Payment and subscription records: up to 8 years, as required by tax and accounting laws.
  • Blocks, reports and records of accounts suspended or banned for breaking our rules: kept to protect other users and stop the same person returning.
  • Grievances and support emails: as long as needed to resolve them and as the law requires.

10. Deleting your account

Delete your account any time in the app under Settings → Delete account. Here is exactly what happens:

  • Immediately: your profile is hidden from everyone and you are signed out on all devices. In existing chats you appear as an unavailable user.
  • Within 30 days: you can change your mind by signing back in with the same phone number.
  • After 30 days: we permanently delete your photos, date of birth, location, bio and other profile details, your interests, connections, favourites, hidden list, profile-view records, notifications, sessions and chat keys.
  • After 180 days: we delete your name, email and phone number. We keep these until then because the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require it. After this, the phone number can be used to create a new account.

After that we keep only the records described in section 9 (payment records, blocks, reports and message details), which no longer carry your name or contact details.

If you can't use the app, email lushaitechnologies@gmail.com with the phone number on the account and we will verify and delete it the same way. Uninstalling the app does not delete your account. A subscription bought through the App Store must be cancelled in your Apple ID settings; a Razorpay autopay can be cancelled in the app or through your bank or UPI app.

11. Your rights

Under the DPDP Act you have the right to:

  • access a summary of the personal data we hold about you and how we use it, and the providers we have shared it with;
  • correct, complete or update your data (most of it directly in the app);
  • erase your data (see section 10);
  • withdraw consent: turn off location or notification permissions in your phone settings, or delete your account. Withdrawing consent stops future processing but does not affect what was done before, and some features will stop working;
  • nominate another person to exercise these rights if you die or become unable to; and
  • have your grievance resolved by us, and if you are not satisfied, complain to the Data Protection Board of India.

To use any of these rights, email lushaitechnologies@gmail.com from the email on your account or include your registered phone number so we can verify it is you.

You also have duties under the DPDP Act: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

12. Age limit

Lungdi is only for people aged 18 and over. You must enter your date of birth to create a profile, and we do not let anyone under 18 complete one. If we learn that a user is under 18, we will delete the account.

13. Security

We use encryption in transit, end-to-end encrypted chat, hashed sign-in codes and session tokens, private storage for verification selfies, two-factor authentication and audit logs for staff access, and rate-limiting against abuse. No system is perfectly secure, so please keep your phone and sign-in codes safe.

If a personal data breach happens, we will tell affected users and the Data Protection Board of India without delay, as the DPDP Rules require, and report it to CERT-In where required.

14. Changes to this policy

We may update this policy. We will change the "Last updated" date above and, for significant changes, tell you in the app before they take effect.

15. Grievance Officer and contact

For questions, requests or complaints about your data or about content on Lungdi, contact our Grievance Officer:

Grievance Officer, Lushai Tech
Aizawl, Mizoram, India
Email: lushaitechnologies@gmail.com

We acknowledge complaints within 24 hours and resolve them within 15 days. Complaints about content that shows you in a sexual or intimate way, or that impersonates you, are acted on within 24 hours.