Privacy Policy

01Information we collect

1.1 Personal information

When you register and use Avokindo, we collect:

• Account information: name, email address, phone number, date of birth, gender
• Profile information: photos, bio, interests, location, occupation, relationship status
• Verification data: the result of a liveness session run by our verification provider, one standard reference photo from that session, and verification metadata such as confidence scores and timestamps. If you choose the optional Premium ID check, the government ID documents you submit — see Section 3
• Payment information: processed securely through third-party payment processors. Subscriptions are handled by Apple, Google and RevenueCat. Ticket purchases are handled by toyyibPay, our payment gateway in Malaysia. We never see or store your full card number in either case

1.2 Usage information

• Activity data: communities joined, events created and attended, RSVPs and tickets, messages, interests expressed
• Device information: device type, operating system, unique device identifiers
• Advertising identifier: your device's resettable advertising ID (Android Advertising ID, or the iOS Identifier for Advertisers where you have allowed it) and IP address, used by our advertising partner to serve and measure ads — see Section 4.4
• Location data: approximate location (city/region) for event discovery
• Analytics: app usage patterns, features used, performance data

02How we use it

We use your information to:

• Provide services: create and manage your account, run communities and events, enable communication
• Verification: confirm a real person is behind an account before it takes a gated action, using the liveness check described in Section 3
• Discovery: use your preferences, interests, and location to suggest relevant communities, events, artists and venues
• Advertising: show ads to users on the free tier, and measure whether those ads were seen and tapped — see Section 4.4
• Safety and security: detect and prevent fraud, abuse, and illegal activity
• Improve services: analyze usage patterns to enhance features and user experience
• Communications: send notifications about your communities, events, messages, and updates
• Legal compliance: comply with applicable laws and regulations

03Face data & verification

3.1 What face data is collected

During the liveness verification process:

• Facial liveness check: a short video-based liveness challenge is performed by a trusted third-party verification service to confirm you are a real person and not a photo or a mask. The service processes facial geometry data in real time and returns a confidence score and a single reference image. Avokindo does not perform any biometric or facial recognition processing itself.
• Reference photo: one standard JPEG reference image from the liveness session is stored for future profile photo consistency checks.
• Face comparison: when you update your profile photo, the image is sent to our verification service to compare against your stored reference photo. The service performs the comparison and returns a similarity score. Avokindo does not perform facial comparison processing itself.

3.2 How face data is used

Face data is used solely for identity verification purposes:

• Confirming a real person is present (liveness detection)
• Checking that a profile photo you upload is the same person as your liveness reference image
• Preventing impersonation and fraud on the platform

Face data is never used for advertising, marketing, tracking, profiling, or any purpose other than identity verification.

3.3 Third-party processing

All facial analysis and biometric processing is performed by Amazon Web Services (Rekognition). Avokindo does not perform any facial recognition or biometric processing itself. Our provider processes face data solely for the purpose of liveness detection and face comparison on our behalf, and does not retain face data after processing is complete. For details on our third-party providers, please contact ask@avokindo.com.

3.4 Storage and retention

• What we store: Avokindo stores only a standard JPEG reference photo and verification metadata (confidence scores, timestamps, session IDs). We do not store biometric templates, faceprints, or facial geometry data.
• Storage location: the reference photo and session metadata are stored in encrypted cloud storage, encrypted at rest.
• Retention period: face data is retained for as long as your account is active. Upon account deletion, all face data — reference photos and session records — is deleted within 30 days.

3.5 Your rights regarding face data

• You can request deletion of all face data at any time by contacting ask@avokindo.com.
• You can re-verify at any time, which replaces previous face data.

3.6 Government ID verification (premium, optional)

Government ID verification is optional and is available to premium members only; that restriction is enforced on our servers, not just in the app. No feature of Avokindo requires it — you can use the app fully without ever starting it. It runs only when you choose to start it yourself, from the Verification Hub, from the premium reminder on your home screen, or from your subscription settings.

• Who performs it: Sumsub, an identity verification provider. Sumsub's own software runs the check inside the app.
• What Sumsub collects: a photo of your government-issued identification document, and a selfie for liveness. These are captured and uploaded by Sumsub's own software directly to Sumsub — they do not pass through Avokindo.
• What we send Sumsub: your Avokindo account identifier, your email address, your display name, your subscription tier and your language preference, so that it can open and label the check.
• What we receive back: only the outcome — whether the check passed, its current status, the date, and, if it did not pass, the reason labels Sumsub returns. Avokindo does not store your document image, your document number or your date of birth from this check.

04Information sharing

4.1 With other users

• Your profile information, photos, and bio are visible to other users
• Your approximate location (city/region) is shared for event discovery
• Messages are shared only with the people in that conversation — your connections, and the members of a community or event group you belong to

4.2 With third parties

4.3 Legal requirements

We may disclose your information if required by law, court order, or to protect the safety of our users and the public.

4.4 Advertising

The free tier of Avokindo is supported by advertising. Two kinds of ad can appear:

• Google AdMob ads. Banner and interstitial ads supplied by Google's advertising network. To serve and measure these, the AdMob SDK on your device processes your device's resettable advertising identifier, IP address, coarse location derived from it, device and app information, and whether an ad was shown and tapped. This processing is carried out by Google as described in Google's own advertising and privacy policies.
• Ads sold directly by Avokindo. Creative supplied by an advertiser and served by us on browse surfaces. These are not targeted using your profile, and no personal data leaves Avokindo to deliver them.

What we do not do:

• We do not sell your personal data.
• We do not send your name, phone number, email address, date of birth, photos, facial verification data, or the contents of your messages to any advertising partner. Ad requests carry no profile or interest data from your Avokindo account.
• Face data is never used for advertising — Section 3.2.

Your choices:

• Subscribe. Avokindo Premium is ad-free; no ad is requested for a subscriber's device.
• iOS. We ask for App Tracking Transparency permission before your IDFA can be used for advertising. If you decline — or never answer — the IDFA is not available to the ad SDK. You can change this any time in Settings → Privacy & Security → Tracking.
• Android. You can reset your advertising ID, or delete it entirely, in Settings → Google → Ads.

05Automated processing

5.1 Automated image screening

Images you upload are checked automatically by Google Cloud Vision's SafeSearch, which rates each image for adult, violent and racy content. This check is performed by software; no person looks at your image as part of it.

It applies to images you upload to your profile and photo gallery, and to posts, moments, events, communities, squads and chats. It does not apply to the selfies you submit for facial verification, to advertising creatives, to invoices, or to images attached to a bug report. Audio, video and other non-image files are not screened.

5.2 Automatic removal

• If the check returns the highest confidence rating for adult, violent or racy content, the image is deleted from our storage immediately and permanently. This decision is made by software alone. No person reviews it before the image is removed, and the file cannot be recovered afterwards — we do not keep a copy.
• We record the outcome for our safety team, and we send you a notification in the app telling you that an image was removed and why.
• If you believe a removal was wrong, contact us through Help & Support in the app or at ask@avokindo.com, and a person will look at it. Because the file is deleted at the moment of removal, we cannot restore the original image; you can upload a replacement.
• If the check returns a lower confidence rating, nothing is removed. The image stays where it is and is placed in a queue for a member of our team to review.

5.3 Writing assistance (optional)

Avokindo offers an optional writing assistant that drafts text for you — a profile bio, or the title or description of a post. It runs only after you tap the assistant button and then tap Generate. It never runs on its own, and you never have to use it.

When you use it, we send the following to Google's Gemini generative AI model:

• The text you type into the assistant yourself
• For a bio: your display name, your occupation and your interests
• For a post: the post's category, its location name, its title, and what kind of post it is

Nothing else about you is included in what we send to the model — not your bio, your age, your email address, your phone number, your messages or your photos. The draft that comes back is shown to you to accept, edit or discard. It is not saved to your profile and it is not posted until you save it yourself.

06Data security

We implement industry-standard security measures:

• Encryption: all data is encrypted in transit (TLS/SSL) and at rest
• Access controls: strict access controls limit who can view your data
• Regular audits: security audits and vulnerability assessments
• Server-side protection: integrity-critical fields — your Trust Score, which records how many verification steps you have completed, and your verification status — are calculated and written only by our backend services. Clients cannot write to them

07Your rights & choices

7.1 Access and control

• Access your data: request a copy of your personal data
• Update information: edit your profile and preferences in the app
• Delete your account: delete it yourself from Settings. Deletion runs immediately; a limited set of records is kept where the law requires it — Section 8
• Opt out: disable push notifications and email communications

7.2 Location and permissions

• You can disable location services in your device settings
• Revoke camera, photo library, and notification permissions anytime

08Data retention

We retain your data for as long as your account is active and for a reasonable period thereafter:

09Children's privacy

Avokindo is intended for users aged 18 and older. Your date of birth is collected before your account is created and checked against that threshold on our servers. We do not knowingly collect data from users under 18. If we discover a user is under 18, we will promptly delete their account and data. Our full child safety position is set out in our Child Safety Standards.

10International data transfers

Your data may be transferred and stored in countries other than your own:

• Google Cloud Platform (Firebase), which provides our backend, authentication and storage: servers primarily in the United States
• Amazon Web Services, which performs the facial verification described in Section 3: the United States
• Sumsub, which performs the optional government ID verification described in Section 3.6, and Google's Gemini model, which powers the optional writing assistant described in Section 5.3: these are processed on those providers' own systems

We ensure appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

11Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via:

• In-app notification
• Email to your registered address
• An updated "Last updated" date at the top of this page

12Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us:

13Legal basis (GDPR / PDPA)

For users in regions with data protection laws (EU GDPR, Malaysia PDPA, and others), our legal basis for processing your data includes:

• Consent: you provide consent when creating an account and using optional features
• Contract performance: processing necessary to provide our services
• Legitimate interests: fraud prevention, security, service improvement
• Legal obligations: compliance with applicable laws