Privacy Policy for Ghoom

1. Who We Are

Ghoom is a location-based exploration app that lets you discover places, check in when you arrive, earn points, record travel paths, play mini-games, compete on leaderboards, contribute places and photos, and connect with other explorers.

Contact for privacy and support: travelrama1993@gmail.com

2. Information We Collect

A. Account and identity

When you create or use an account, we may collect:

• Phone / mobile number
• Username and display name
• Password (stored only as a secure hash)
• Referral code you enter or are assigned
• Profile photo (optional)

During signup, we verify your phone number with a one-time password (OTP) sent by SMS. Your phone number is stored on your account for future login identification. After signup, you sign in with your password using your username or mobile number. SMS OTPs may also be used for account security flows such as password reset.

B. Location information

Location is essential to Ghoom. With your permission, we collect precise location from your device to:

• Show your position on the map
• Detect when you enter a place zone and award check-in points (including in the background)
• Support manual check-in
• Find nearby places
• Help reverse-geocode approximate area (for example, district/state)
• Support location submission and related features
• Send periodic location updates (location pings) that we store as history to run anti-hack checks and help prevent fraudulent activities
• Power Track My Path, which records a route of GPS points while a tracking session is active

If you grant "Allow all the time" / Always location access, Ghoom may detect arrivals and continue supported tracking features while the App is in the background. On Android, you may optionally enable Persistent Tracking, which shows an ongoing notification so background visit detection and related location features remain more reliable.

What we store: When you check in, we match your coordinates to a place and store the visit association (place, related visit records, and score). Separately, we store a history of location pings (including coordinates and related metadata such as accuracy and time) to run anti-hack checks and help prevent fraudulent activities. When you use Track My Path, we store session path points and may generate a path map image for you.

Who can see it: We do not show your live location to other users. Track My Path sessions and path maps are visible only to you (unless you choose to share an image or similar content yourself outside the private path view). Other users may still see visit-based or profile activity you make public (for example, check-in feed posts or place ownership), not a live GPS stream or your private path history.

C. Photos and media

• Profile photos you upload
• Photos you add to places or location requests
• Track My Path map images generated for your sessions
• Generated trip-recap media you choose to create (which may expire after a limited period)

We access the camera or photo library only when you choose to capture or select media.

D. Exploration, scores, and gameplay

• Check-ins, revisits, and place visit history
• Exploration, contribution, and game scores
• Lucky Pick / game play records
• Titles, badges, leaderboard ranking data
• Place ownership scores
• Referral relationships and referral rewards
• Locations and photos you contribute for review

E. Social, feed, events, and chat

• Friend requests and friend connections
• Feed posts generated from your activity (subject to your privacy preferences)
• Likes and comments
• "Going To" / travel events you create or join
• In-app notifications
• Chat conversations and message content, which are stored on our servers

F. Device, push, and technical data

• Device platform (for example, Android or iOS)
• Push notification tokens (FCM) so we can send alerts
• App version and basic diagnostic / security signals needed to operate and protect the App
• IP address and standard server logs generated when you use our APIs
• Authentication tokens (access and refresh tokens) to keep you signed in

We use Firebase Cloud Messaging for push delivery and Firebase App Check to help verify that requests come from genuine app installs. We do not use advertising SDKs in the App.

G. Information we do not sell

We do not sell your personal information.

3. How We Use Your Information

• Create and manage your account and keep you signed in
• Verify your phone during signup and certain security flows
• Provide map, check-in, Track My Path, scoring, game, badge, title, and leaderboard features
• Enable background visit detection and path tracking when you grant the required permissions
• Store location ping history to run anti-hack checks and help prevent fraudulent activities, and store Track My Path sessions for your own use of that feature
• Show public profile information and activity you choose to make visible
• Power friends, feed, events, referrals, and chat
• Send transactional and activity notifications (check-ins, social, awards, security)
• Review user-submitted places and photos
• Prevent fraud, abuse, spoofing, and unauthorized access
• Improve reliability, security, and performance of the App
• Respond to support requests and comply with law

4. Background Location (Important Disclosure)

Ghoom requests background / "all the time" location access so core features can work even when you are not actively looking at the App.

Background location is used for:

• Automatic check-in and visit detection
• Track My Path route recording while a session is active
• Related periodic location pings used by those features
• Related notifications (for example, that points were earned)
• Optional Persistent Tracking reliability on Android

Background location is not used to show your live position to other users, to advertise to you, or to sell location data.

You can change location permissions in your device settings at any time. If you limit location to "While using the app" or deny it, automatic background check-ins, Track My Path in the background, and related features may not work.

5. What Others Can See

Other users may see information such as:

• Username, display name, and profile photo
• Public scores, titles, badges, and leaderboard standing
• Place ownership display (top scorers at a place)
• Feed activity you allow to be public (check-ins, badges, titles, contributions, etc.)
• Event participation details you share through Events / Going To
• Chat content with people you converse with

Your phone number is not shown on public profiles. Location ping history and Track My Path data are private to your account. You can control many feed visibility preferences in Settings. Live GPS location is not shared with other users.

6. How We Share Information

We share information only as needed to operate Ghoom:

• Service providers: hosting, database, SMS OTP delivery, content delivery / caching for images, and push notification delivery
• Message Central: to send SMS one-time passwords for phone verification during signup
• Firebase: push notifications and App Check
• OpenStreetMap Nominatim: reverse geocoding requests may be sent with coordinates to determine approximate area labels
• Other users: the social and public profile information described above
• Legal / safety: when required by law or to protect users, Ghoom, or others from fraud, abuse, or security threats

We do not share your precise location with advertisers, and we do not sell personal data.

7. Permissions Used

• Location (foreground and background): check-ins, map, nearby places, automatic visit detection, location pings, and Track My Path
• Notifications: check-in alerts, social activity, awards, and important account messages
• Camera: profile photos and photos you contribute for places / location requests
• Photos / media library: when you choose existing images to upload

8. Data Storage and Security

Account, visit, location ping, Track My Path, social, chat, and related data are stored on our servers and databases. Photos and similar media are stored on our infrastructure and may be delivered through a content delivery network.

We use reasonable administrative, technical, and organizational safeguards, including:

• Encrypted transport (HTTPS)
• Hashed passwords and hashed sensitive verification codes
• Access controls and session token management
• App integrity checks and anti-abuse measures

No method of transmission or storage is completely secure.

9. Data Retention

We retain personal information while your account remains active and as needed to provide the App, prevent fraud, resolve disputes, enforce our Terms, and comply with legal obligations. Some generated media (such as trip recap videos) may be retained only for a limited period.

Chat messages, visit history, location ping history, and Track My Path sessions are stored on our servers until you delete your account, or until they are deleted or anonymized as otherwise required by law.

10. Account Deletion

You may permanently delete your Ghoom account yourself from within the App. When you delete your account, we delete or anonymize associated personal information — including your account profile data, location ping history, and Track My Path sessions — unless we must retain certain information for legal, security, fraud-prevention, dispute-resolution, or accounting reasons. Residual copies may remain in backups for a limited period until those backups are rotated.

If you need help with account deletion, contact travelrama1993@gmail.com and include your username and the phone number linked to your account.

11. Your Choices and Rights

Depending on applicable law, you may:

• Access or update profile information in the App
• Control feed privacy preferences in Settings
• Start or stop Track My Path sessions in the App
• Turn off notifications in device or App settings
• Revoke location, camera, or photo permissions in device settings
• Disable Persistent Tracking in Settings
• Delete your account from within the App

To exercise privacy rights or ask questions, contact travelrama1993@gmail.com.

12. Children's Privacy

Ghoom is not directed to children under 13. You must be at least 13 years old (or the minimum digital consent age in your country, if higher) to use the App. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us and we will take appropriate steps to delete it.

13. International Processing

Your information may be processed on servers located in India or other countries where we or our service providers operate. Where required, we take appropriate measures to protect personal data in accordance with applicable law.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last Updated" date and, for material changes, may provide additional notice in the App or by other reasonable means.

15. Contact Us

Privacy and support contact:

• Email: travelrama1993@gmail.com
• Website: https://ghoom.brainybaba.com

16. Compliance

This Privacy Policy is intended to help Ghoom comply with applicable requirements, including:

• Information Technology Act, 2000 (India)
• Digital Personal Data Protection Act, 2023 (India), where applicable
• Google Play User Data Policy (including prominent disclosure for background location)
• Apple App Store requirements for privacy disclosures and account deletion