Privacy Policy & Cryptographic Notice

1. Cryptographic Architecture & End-to-End Encryption (E2EE)

PRIV SPACA (priv.asvtrstudio.in / privspaca.asvtrstudio.in) is engineered for private 1-to-1 communication under the Digital Personal Data Protection Act, 2023 (DPDP Act, India):

• Secret Chats (ECDH P-256 + AES-256-GCM): When Secret Chat mode is enabled, cryptographic keypairs are generated locally inside your browser's WebCrypto enclave. Plaintext messages are encrypted before leaving your device and cannot be deciphered in transit.
• Passphrase-Wrapped Cloud Key Backup: If you enable multi-device key backup, your private key is wrapped client-side using PBKDF2-HMAC-SHA256 (100,000 iterations) + AES-256-GCM before storage.
• P2P WebRTC Audio & Video Calls: Live voice and video calls use encrypted peer-to-peer WebRTC DTLS-SRTP media streams and are never recorded or stored on our servers.
• Disappearing Messages: Messages configured with ephemeral timers (10s, 1m, 5m, 1h, 24h) are automatically purged upon expiry.

2. Categories of Personal Data Processed

• Account Identity: Username, display name, optional bio/avatar, bcrypt-hashed password, bcrypt-hashed 4-digit recovery PIN, and optional WebAuthn Passkey public credentials.
• Community & Message Storage: Encrypted/community messages, stories, and uploaded media stored on isolated PostgreSQL infrastructure with strict access controls.
• Safety & Moderation Logs: Block lists, user abuse reports, and basic connection timestamps required to prevent spam, automated scraping, and unlawful abuse under Indian law.

3. Data Principal Rights (Access, Erasure & Withdrawal of Consent)

• Clear & Delete History: You can delete individual messages, clear entire 1-to-1 conversation histories, or revoke WebAuthn Passkeys directly inside the app.
• Right to Account Erasure: You may request complete permanent deletion of your account and associated profile/media records at any time via in-app settings or by contacting the Grievance Officer.