CONNECTRA Privacy Policy

Back to Home

The short version. We collect what we need to run a safe, anonymous chat service. We do not record calls, we do not store your chat messages, and we do not sell your personal data. Other people see your profile only when you both agree (Share Connect) or when your own search settings allow it. In a group call you appear under an anonymous name such as Alpha or Beta. You can view and edit your profile at any time, and delete your account yourself from your profile page. When you do, the law requires us to keep your registration information for 180 days before it is erased. Screenshots and screen recordings of other people are prohibited on CONNECTRA. The details are below.

1. Who we are

CONNECTRA (the “Platform”) is operated from India by its developer(s), trading as GSSV (“we”, “us”). For the purposes of data-protection law we are the Data Fiduciary (India) and the data controller (EU/UK and similar laws) for the personal data described here. Contact: ping.connectra@gmail.com.

This policy forms part of our Terms of Service. By using the Platform you confirm that you have read it.

2. Laws this policy covers

We process personal data in line with the laws that apply to us and to you, including India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; the EU General Data Protection Regulation (“GDPR”) and the UK GDPR and Data Protection Act 2018 for users in those regions; the California Consumer Privacy Act as amended by the CPRA and other US state privacy laws; and, where they apply, Canada's PIPEDA, Brazil's LGPD, Australia's Privacy Act 1988 and similar laws. Where these laws give you more protection than this policy describes, those protections apply.

3. What we collect

Category	What exactly	Where it comes from
Account data	Google account ID, name, email address, profile-photo link, email-verified status, account creation and last sign-in times	Google Sign-In (Firebase Authentication), when you sign in
Public profile	Username, avatar, bio, interests, languages, country, badges, “member since” date	You, on your profile page
Optional shared details	Real name, date of birth, contact handles (e.g. Instagram, Snapchat, email, phone), up to 3 photos, and your “show on share” choices for each	You, only if you choose to add them
Privacy settings and preferences	“Who can find me” setting; interest-matching and subtitle preferences; theme; the date you were last shown our yearly reminder of the rules	You, and created when you acknowledge the reminder
Session records	Session ID, the user IDs and display names of the two participants, chat or call mode, start and end times, duration	Created automatically when a conversation ends
Group call records	For each group call: a call ID, whether it was public or private, its topic or title, keywords and language, the maximum number of people, when it started and closed and why it closed; and for each participant, their user ID, the anonymous name they had in that call (such as Alpha), and when they joined and left. The description of a public call is not kept once the call ends.	Created automatically when a group call closes
Live group calls	While a call is running, our server holds in memory who is in it, their anonymous names, who the host is, whether each person's microphone and camera are on, the call's link (for private calls), votes, and blocks made during the call	Your use of group calls; deleted from memory when the call ends
Connections and social data	Your connects, time spent talking with each connect (including time in the same group call), invites and requests (with their status and expiry), blocks, and game results and statistics	Created by your use of those features
Safety reports	Who reported whom, the session or group call (with whether it was public or private, and its topic), the reason selected and any details you type	You or another user, when a report is made
Technical data	IP address, browser and device type, and connection information needed to set up calls; basic server logs kept by our hosting provider	Your device, automatically
Analytics	Pages visited, approximate location (city/country), device and browser details, and cookie identifiers	Google Analytics on some pages (see Section 13)
Messages to us	Anything you send us by email, including grievances and data requests	You

Details you add to the optional shared section (such as date of birth, contact details and photos) are provided voluntarily and with your consent. We do not ask for passwords, financial information, biometric data, health data, government ID numbers, caste, religion or sexual orientation, and you should not put such information in your profile.

4. What we do NOT collect or keep

Call audio, video and screen shares are never recorded or stored by us, in one-to-one calls and in group calls. They travel directly between the participants' devices, or through an encrypted relay server that cannot read them.
Chat messages are not stored. Our server passes each message to the other person (or, in a group call, to the others in the call) in real time, checks it against a profanity filter on the way, and then keeps no copy. The same applies to reactions and raised hands in group calls.
Live subtitles and translations are produced on-device by your browser; captions go directly to the other user and are not sent to us or to any speech or translation service.
Icebreaker “silence” detection runs on your device and only a yes/no signal is shared with the other user; no audio leaves your device for this purpose.
Draw & Guess drawings are streamed to the other players and are not stored.
We do not monitor or record your screen. The screenshot protections and the blurring of strangers' video run entirely on your own device. The watermark is drawn on your screen from your own name and account code, which your browser already has; nothing about your screen, keystrokes or other apps is sent to us.
We do not sell or rent personal data, and we do not use it for targeted advertising.

5. How and why we use your data

Purpose	Legal basis (GDPR / UK GDPR)	Basis (DPDP Act)
Create and secure your account; sign you in; operate matching, chat, calls, group calls, games, connects, invites and search	Performance of our contract with you	Consent; use for the specified purpose you requested
Safety and moderation: blocks, reports, auto-suspension, investigating abuse, preventing fraud, enforcing our Terms	Legitimate interests (keeping users safe); legal obligation	Consent and legitimate uses under Section 7
Optional profile details and sharing them via Share Connect	Consent (you can switch sharing off or delete details at any time)	Consent
Analytics to understand and improve the Platform	Consent where required by law; otherwise legitimate interests	Consent
Complying with law, court orders and lawful requests; establishing or defending legal claims	Legal obligation; legitimate interests	Legitimate uses under Section 7
Answering your emails, grievances and data requests	Legal obligation; legitimate interests	Legitimate uses; your request

Where we rely on consent, you may withdraw it at any time (see Section 11); this does not affect processing already carried out, and some features may stop working.

6. What other users can see

During a random conversation you are anonymous (“Stranger”), unless you and the other user are already connects, in which case you both see each other's username.
Your voice and video are seen and heard by the other user as soon as you turn them on. Calls start with cameras off, and each person decides for themselves when to turn their own camera on.
In a group call you appear under an anonymous name (such as Alpha or Beta) with a colour, and the others do not see your username or profile. Everyone in the call sees whether you are the host, whether your microphone and camera are on, and anything you choose to share: your voice, video, screen, chat messages, reactions and raised hand. Your profile is shown to one person in the call only if you both Share Connect, and nobody else in the call is told.
Public group calls you start are listed to other signed-in users browsing group calls, with the topic, description, keywords and language you wrote and how many people are in the call. The listing does not show who you are. Private calls are never listed, but anyone with the link can see the call's title and how many people are in it.
Your public profile and the details you switched on for sharing are shown to another user only after a mutual Share Connect or an accepted connect request.
Username search shows your public profile only to people allowed by your “Who can find me” setting.
Shared interests (when both users switched interest matching on) are shown as “You both like: …”. At the start of a call, your first profile language (and whether your browser can make subtitles) is sent to the other user's browser so subtitles can be translated.
Your IP address: calls use peer-to-peer technology (WebRTC). When a direct connection is made, the other user's device receives your IP address, which can reveal your approximate location. In a group call your device connects to each of the other participants, so each of them may receive your IP address. This is inherent to peer-to-peer calling. When a relay server is used instead, the relay provider sees both IP addresses.

Screenshots and screen recordings are prohibited (Terms of Service, Section 9). To discourage them, the video and messages of other people are shown on your screen with a faint watermark of your own name and account code, and are hidden when the page is not on screen. Other users never see your watermark, and you never see theirs. A stranger's video is blurred on your screen until you choose to see it. Even so, a user acting in breach of our Terms could still capture what you show or say with another device, so anything you share with another user may end up under their control, and we cannot always retrieve it or stop them from passing it on.

Our administrators can see your account and profile, including the optional details you only share through Share Connect, and your activity on CONNECTRA: whether you are online, your connects, your conversation and group call records (including which anonymous name you had in each group call), and reports and blocks involving you. This is so that reports can be investigated, abuse stopped and your requests answered. Private details stay hidden until an administrator chooses to look, which they do only when needed, and access is limited to authorised administrators.

7. Service providers and other disclosures

We share personal data only as follows:

Service providers (data processors) who help us run the Platform under contracts that require them to protect it and use it only on our instructions: Google (Firebase Authentication and Google Analytics), our database provider (MongoDB), our web hosting and network providers, and our call-relay (TURN) provider.
Legal and safety: law enforcement, courts, regulators or other authorities when required by law or legal process, or when we believe in good faith that disclosure is necessary to prevent harm, investigate fraud or illegal activity, or protect the rights, property or safety of users, the public or us. Child sexual-abuse material is reported to the competent authorities. When you report nudity or sexual content, exposure, ragging, threats or a risk to a child, we preserve the records relevant to the report and may share them with the police, the cybercrime authorities, the National Anti-Ragging Helpline or the educational institution concerned, as the law allows or requires.
Business transfers: if the Platform is transferred, merged or sold, personal data may be transferred to the new operator, who will be bound by this policy or give you notice.
With your consent or at your direction (for example, when you Share Connect).

8. International transfers

We operate from India and our service providers may process data in India, the United States, the European Union or other countries. When we transfer personal data across borders we do so as permitted by the DPDP Act and, for data from the EU/UK, using appropriate safeguards such as the European Commission's Standard Contractual Clauses or the UK equivalents, or other lawful mechanisms.

9. How long we keep data

Account, profile, connects, blocks, invites, requests and game statistics: while your account exists. When you delete your account (yourself, from your profile page, or by asking us), they are removed from the Platform straight away, together with your sign-in account: your profile, photos and shared details, your connects and Friendship Clocks (so you disappear from your connects' My Connects), your blocks, invites and requests, and your game statistics. Deletion cannot be undone, and nothing is shown to anyone in the app afterwards.
Registration information after deletion: 180 days. As Rule 3(1)(h) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 requires, we keep the information you registered with (your sign-in account details, username and your profile as it was when you deleted it), together with a record of the blocks you made and received, in a restricted archive for 180 days after your account is deleted. It is used only to answer lawful requests from authorities, investigate abuse and establish or defend legal claims. It is not visible in the app, and only authorised administrators can see it, together with the time left before it is erased.
Session records, group call records and safety reports involving a deleted account: kept for the same 180 days after deletion. When the 180 days end, the archive entry is erased and these records are anonymised automatically, so they no longer identify you.
Longer only where the law requires it. If, before the 180 days end, we receive a lawful order or request from a court or government agency, or the information is needed for an ongoing investigation or legal claim, we keep the specific information concerned for as long as that requires, and then erase or anonymise it.
Analytics: according to Google Analytics retention settings (typically up to 14 months).
Emails to us: as long as needed to handle your request and any follow-up.

10. Security

We use reasonable security practices appropriate to the nature of the data, as required by the IT Act and SPDI Rules, including encryption in transit (HTTPS/WSS), end-to-end encrypted media for calls (DTLS-SRTP), verification of every sign-in token on our server, access to administrative tools limited to authorised administrators, and validation of all data sent to our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs, we will notify the Data Protection Board of India, CERT-In, affected users and any other authority as required by law, and within the time limits the law sets.

11. Your rights

Depending on where you live, you have some or all of these rights:

Access a summary of the personal data we hold about you and how we process it;
Correct or update it (you can edit your profile at any time on your profile page);
Erase it, including deleting your account, which you can do yourself at any time from your profile page (subject to the 180-day retention the law requires, described in Section 9);
Withdraw consent (for example, switch off sharing, remove optional details, or block cookies);
Data portability, restriction and objection to processing based on legitimate interests (GDPR / UK GDPR);
Nominate another person to exercise your rights in case of death or incapacity (DPDP Act, Section 14);
Grievance redressal with us (DPDP Act, Section 13), and then the right to complain to the Data Protection Board of India; if you are in the EU or UK, to your local supervisory authority or the UK Information Commissioner's Office;
California and other US state rights (see Section 15).

How to exercise them: you can view and correct your profile, and delete your account, yourself on your profile page. For anything else, email ping.connectra@gmail.com from the email address linked to your account, saying what you would like us to do. We may need to verify your identity before acting. We will respond within the time the law requires (normally within 30 days; 45 days under US state laws, which may be extended where permitted). We will not discriminate against you for exercising your rights. Some data may be kept where the law allows or requires it (see Section 9).

12. Children

The Platform is only for adults aged 18 or over. We do not knowingly collect personal data from anyone under 18, and we do not process children's data within the meaning of the DPDP Act or the US Children's Online Privacy Protection Act. If we learn that a user is under 18, we will suspend the account and delete their personal data except where the law requires us to keep it. If you believe a child is using the Platform, please tell us immediately.

13. Cookies and browser storage

Strictly necessary storage: Google/Firebase keeps your sign-in session in your browser's storage so you stay signed in.
Preferences: we save your theme (connectra.theme), interest-matching choice (connectra.useInterests), subtitle choice (connectra.subtitles) and whether your microphone and camera start on in group calls (connectra.group.media) in your browser's local storage. These never leave your device.
Group call links: if you open a group call link before signing in or setting up your profile, we keep that link in your browser's local storage (connectra.returnTo) so we can take you back to the call afterwards. It is used once, ignored after 30 minutes, and never leaves your device.
When you delete your account, we also clear these preferences from that browser, except your theme.
Analytics cookies: Google Analytics sets cookies (such as _ga) on some pages to measure usage. You can block or delete cookies in your browser settings or use Google's opt-out add-on (tools.google.com/dlpage/gaoptout). Blocking analytics cookies does not affect how the Platform works.

We honour browser “Global Privacy Control” signals as an opt-out of any sharing where the law requires it. We do not respond to “Do Not Track” signals because no common standard exists.

14. Automated decisions

Some decisions are made automatically: chat messages, custom questions, and group call topics, titles, descriptions and keywords containing listed offensive words are blocked; you may be matched by shared interests if you turn that on; and an account reported by several different users within a short period may be suspended automatically pending review. (Removing someone from a group call, by its host or by a vote of the others, is a decision made by users, not by us or by an automated system.) You can contact us to request human review of any automated decision that affects you, to express your view and to contest it.

15. California and other US state notices

In the past 12 months we collected the categories of personal information described in Section 3: identifiers (name, email, account ID, IP address); personal records you provide; internet or other electronic network activity; approximate geolocation from your IP address; and inferences limited to the interests you choose to list. We collect them for the purposes in Section 5 and disclose them to service providers as described in Section 7. We do not sell personal information or share it for cross-context behavioural advertising, and we do not knowingly sell or share the personal information of consumers under 16. We do not use sensitive personal information to infer characteristics about you. You have the right to know, delete and correct your personal information, and to not be discriminated against for exercising these rights. You may use an authorised agent, subject to verification.

16. Changes to this policy

We may update this policy from time to time. We will change the “Last Updated” date and, for material changes, tell you on the Platform before they take effect. If a change requires your consent under Applicable Law, we will ask for it.

In addition, as Rule 3(1)(f) of the IT Rules, 2021 requires, we remind every user of this Privacy Policy, our Terms of Service and our community rules at least once a year, with a notice shown in the app when you sign in. We record the date you acknowledged it so that we know when the next reminder is due.

17. Contact and Grievance Officer

For privacy questions, requests or complaints, contact our Grievance Officer (also our contact person for the DPDP Act):

Name: Gampa Sai Sasivardhan
Designation: Grievance Officer, CONNECTRA (GSSV)
Email: ping.connectra@gmail.com, with the subject line “Privacy” or “Grievance”, or “Urgent” for nudity or sexual content, ragging, threats or any risk to a child
Timelines: we acknowledge complaints within 24 hours and resolve them within 15 days of receipt; complaints about content showing a person's private area, nudity or a sexual act, or impersonating them, are acted on within 24 hours, as the IT Rules, 2021 require.
You may also complain to the Data Protection Board of India under the DPDP Act, or appeal to the Grievance Appellate Committee under Rule 3A of the IT Rules, 2021.