Privacy Policy

1. Data Fiduciary Notice

RIVA operates as the Data Fiduciary in respect of the personal data collected from users ("Data Principals") under India's Digital Personal Data Protection Act, 2023 (DPDPA). This policy constitutes our statutory notice prior to and during the collection and processing of your personal data.

2. Categories of Personal Data Collected

We collect only the personal data that is strictly necessary for platform functionality and safety:

• Identity & Account Data: Display name, permanent unique handle (@username), avatar image, cover image, and biographical description.
• Authentication Data: Email address provided through OAuth identity providers (Google Sign-In or Apple Sign-In).
• Date of Birth (DOB): Collected during user onboarding solely to verify age categories (13+ Youth vs. 18+ Adult) and enforce age-restricted community access barriers. Your exact Date of Birth is never shared publicly or displayed to other members.
• User Content: Text posts, comments, photos, videos, and community memberships created or joined by you.
• Place Interactions: Real-world places you bookmark, visit, or anchor communities to via geographical coordinates.

3. Specified Purpose of Processing (Section 5 Notice)

Your personal data is processed strictly for the following specified purposes:

• To verify identity, establish your authenticated account, and prevent bot or automated spam.
• To compute your age category and protect minors by barring accounts under 18 from viewing or entering adult-only spaces.
• To host, stream, and deliver place-anchored community feeds and interactive maps.
• To enable moderation, platform safety governance, and audit logging.

4. Protection of Children & Minor Safety (DPDPA Section 9)

In adherence to DPDPA Section 9 obligations regarding children (individuals under 18 years of age):

• No Behavioral Tracking or Targeted Ads: RIVA does NOT engage in behavioral tracking, profiling, or targeted advertising directed at children.
• Strict Adult Content Barrier: 18+ and 21+ adult-governed communities and posts are cryptographically gated and completely invisible to unauthenticated guests and minor accounts.
• Minimum Age Limit: Individuals under 13 are strictly barred from platform onboarding.

5. Data Principal Rights & Right to Erasure (DPDPA Section 12)

Under the DPDPA, you possess the following enforceable rights:

• Right to Access & Summary: You can review your profile, active memberships, and posted content directly in the application.
• Right to Correction: You may edit your display name, bio, photos, and social links at any time via Account Settings.
• Right to Erasure (Account Deletion): You can permanently schedule your account for deletion via the Danger Zone in Edit Profile. Our automated system:
  • Permanently erases all personally identifiable information (PII).
  • Cryptographically hashes your handle using one-way SHA-256 to prevent impersonation.
  • Transfers community ownership to active moderators to maintain community continuity.

6. Grievance Redressal & Data Protection Officer Contact

If you have questions, privacy requests, or wish to exercise your rights under the Digital Personal Data Protection Act, 2023, you may write directly to our designated Grievance Officer:

If your grievance is not resolved satisfactorily by our officer, you retain the statutory right under Section 13 of the DPDPA to appeal to the Data Protection Board of India.