Privacy policy

Allyo is a people-to-people marketplace app for Android and iOS, with this website at allyoapp.com. Allyo is operated by Allyo Technologies (Kolkata, West Bengal, India), who is responsible for the personal data described here.

• We collect what Allyo needs to work: your account and profile, your Offerings and requests, your Credit history, and basic device and security information.
• Other Members see your username, age in years and public profile — never your full name, email, exact date of birth or phone number.
• Chat is only possible after a booking request is accepted. Your messages are stored on our servers so they reach the other Member and sync to your phone.
• Your phone number is never shown to other Members. Once a booking request is accepted, you talk in Allyo chat.
• Location, notifications and photos are optional permissions.
• We don't sell your personal data. There are no third-party ads and no ad tracking in Allyo. ("Sponsored" profiles and boosted Offerings are Members who promoted themselves with Credits.)
• Allyo never processes payments and never asks for card, bank or UPI details.

• Account: email address, full name, mobile number, confirmation that you're 18 or over, and your acceptance of the Terms. Your 6-digit PIN is stored only as a secure one-way hash — never the PIN itself.
• Profile: username, date of birth, gender, education, profession, description, profile photo, cover photo and feature photos.
• Offerings: category, title, description, experience, pricing type and starting price, availability, the area you serve (its name and map point), keywords and a cover photo.
• Requests: which Offerings you requested or received requests for, their status and any decline note.
• Chat messages: the messages you send and receive in Allyo chat, the message you replied to, when each was sent, delivered and read, and whether it was deleted.
• Reports and blocks: the Members you block, and any report you send us.
• Credits: your balance and an immutable history of every Credit earned or spent.
• Messages to us: whatever you send when you contact support.
• Early-access list: if you join the waitlist on our website, the email address and/or mobile number you enter. We use it only to send your invite, a welcome email about Allyo and launch news, and delete it when you ask.

If you continue with Google, we receive your verified email address and a Google account identifier, and use them to create or sign in to your account.

• What: if you allow it, your phone's location (precise or approximate — your choice) only while you use the app. Allyo never collects location in the background.
• Why: to find the area you're in, show Offerings near you and sort results by distance.
• What we keep: the area you choose — its name, map coordinates and your search radius — saved to your account so it follows you to a new phone. You can change it or search for an area instead of sharing your location.
• Offering areas: the area you pick for an Offering (not your live location) is shown to other Members with the approximate distance.
• Area names and map points are looked up through Google Maps Platform by our server.

• What: your chat messages and their timing and status (sent, delivered, read, deleted); whether you're online, when you were last seen, and when you're typing.
• Who sees it: only the other Member in that chat. Online status and "last seen" are shown only to Members you already have a chat with. The Allyo team may look at messages only when investigating a report, a safety issue or a legal request.
• Delete for everyone: removes the message text from our servers for both of you. Delete for me only hides it on your side.
• On your phone: a copy of your chats is kept in the app's private storage so they open instantly and work offline. It's removed when you sign out.

Some things never leave your device: Offerings you mark as favourites, Members you save, your recent searches and your onboarding/permission choices. They are removed if you uninstall the app.

When you sign in we record, for security and for Settings → Login Devices:

• An installation identifier — a random ID the app creates when it's first installed. It isn't linked to your phone's hardware and changes if you reinstall the app.
• Platform (Android or iOS), device model, operating-system version and app version.
• Sign-in method, sign-in time and when the device was last active.
• IP address and browser/user-agent string of sign-in requests.

We don't collect hardware identifiers such as IMEI or serial numbers, your contacts, or advertising identifiers.

If you allow notifications, Firebase Cloud Messaging (Google) gives the app a push token for your phone. We store it against your account and that installation so we can tell you about new booking requests, replies, Offering reviews and new chat messages. A chat notification shows the sender's username and the start of the message on your lock screen; you can hide previews in your phone's notification settings. The token is never shown to anyone. It is removed when you sign out on that phone or delete your account, and replaced when Firebase issues a new one. If you turn notifications off, the app keeps working without it.

We keep records needed to protect accounts: hashed one-time codes (deleted after they expire), counts of sign-in and code attempts used for rate limiting, and sign-in sessions.

• To run Allyo: create your account, show your profile and Offerings, deliver requests, chat messages and replies, keep your Credit balance.
• To suggest people and Offerings near you on Home and in Nearby.
• To review Offerings before they're published and keep the community safe.
• To send one-time codes, account emails and the notifications you've allowed.
• To secure your account: verify sign-ins, rate-limit attempts, show your signed-in devices and detect misuse.
• To answer your messages and fix problems.
• To meet legal obligations and enforce our Terms.

• Other Members and visitors: your username, age in years (worked out from your date of birth — the date itself is never shown), profile and cover photos, description, profession, education, Trusted badge, member-since date and your approved Offerings (including their area and distance). If you buy a Sponsored listing, your profile may be shown on Home in a "Sponsored" card.
• A Member you chat with: your messages, your online / last-seen status and when you're typing.
• The Allyo team: account and activity data when needed to review Offerings, provide support, investigate reports and keep Allyo safe.
• We don't sell or rent personal data or share it with advertisers or data brokers.

These providers process data on our behalf for the purposes above, and some may process it outside India under their own safeguards. We may also disclose information when the law requires it, to protect the safety of Members or others, or as part of a business transfer.

• Your account data is kept while your account is active.
• Chat messages are kept while both Members' accounts exist, so the conversation stays available to both of you, unless they are deleted for everyone.
• One-time codes expire after a few minutes and are then deleted automatically; rate-limit records expire on their own.
• Sign-in sessions expire after 30 days without use.
• When you delete your account, some information is removed straight away and some is kept — see Delete account for the exact list. Retained records are kept only as long as those purposes need, or longer where the law requires it.

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023, you can:

• Access and correct your data — most of it directly in Profile and Settings.
• Withdraw consent for optional processing: turn off location or notifications in your phone's settings at any time.
• Erase your data by deleting your account in Settings, or by asking us.
• Raise a grievance with us, and if you're not satisfied, with the Data Protection Board of India.

Email support@allyoapp.com from your registered address to make a request. We may need to confirm your identity first.

Data travels over encrypted HTTPS connections. PINs and one-time codes are stored only as salted one-way hashes. Sign-in tokens on your phone are kept in the operating system's secure storage. Every request is checked on our server — you can only see and change your own data. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Allyo is only for people aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a child has an account, contact us and we will close it.

To raise a grievance about how your personal data is handled, email support@allyoapp.com. We acknowledge grievances within 24 hours and aim to resolve them within 15 days.

We'll post any change here with a new "last updated" date, and tell you in the app or by email before significant changes take effect.