Privacy Policy

Last updated: 13 October 2026

Dayzi ("Dayzi", "we", "us", "our") is a social events application that helps people discover, create, and join local events. Dayzi is owned and operated by Solika Ventures Pvt Ltd, a company incorporated in India, which is the data controller (and, where applicable, the "data fiduciary" or "business") responsible for your personal data.

This Privacy Policy explains what personal data we process, why, the legal bases we rely on, how long we keep it, who we share it with, how we protect it, and what rights you have. It applies to:

• the Dayzi mobile application (the "App"); and
• the Dayzi website at dayzi.live (the "Site"), including our waitlist / early-registration sign-up.

We process your personal data only where we have a valid legal basis. Some processing is necessary to provide Dayzi under our Terms; some is based on your consent; some is required by law; and some rests on our legitimate interests, such as keeping Dayzi safe. Where we rely on consent, we ask for it separately and you may withdraw it at any time, as easily as you gave it.

If you do not agree with this policy, please do not use Dayzi.

1. Information We Collect

Fields marked required are needed to create and operate your account. All others are optional and you can add, change, or remove them at any time.

1.1 Information You Provide

• Account information (required): first name, last name, email address, password (stored only as a secure hash), age, username
• Account information (optional): gender
• Profile information (optional): profile photo, bio ("about me"), favourite song, favourite show, user vibes, profile prompts, profession, and a link to your Instagram profile
• Event information: event title, description, category, area/location, date and time, cover image
• Communications: messages you send in event group chats, event join requests, appeals, bug reports, and support or grievance requests
• Safety contact (required to use the App, see Section 3B): the name and phone number of one safe person (your trusted contact). This is stored only on your own device and is never transmitted to us.
• Face verification (optional): if you choose to verify, we process a selfie (with a gesture for liveness) together with your profile photo (see Section 3)
• Waitlist (Site): the email address you submit on dayzi.live

1.2 Information Collected Automatically

• Device and connection information: device type, manufacturer and model, operating system version, app version and build, device locale, IP address, and general network information
• Location: the city and country you choose for your profile, and the coordinates of that city. Coordinates saved for your profile or for an event are rounded to roughly one kilometre before storage, so they identify an area and not an address. Nearby events are worked out from that city, not from your device's GPS. Your device's location is used only by the SOS safety feature. If you allow it, the SOS screen reads your phone's last known position to show the emergency number for the country you are in (your phone's own Apple or Google location service turns it into a country, and we do not store it), and pressing SOS records your exact location at that moment (see Section 3B). We do not track your location continuously or in the background.
• Usage data: events viewed, joined, and created; app interactions; screen names; session duration
• Advertising identifier: our analytics component (Firebase Analytics) collects the Android Advertising ID on Android devices. We do not use it for advertising, do not sell or share it, and run no advertising SDKs. It is disclosed here because it is technically collected.
• Analytics identity: analytics events are associated with your Dayzi account identifier. Our in-app analytics are therefore not anonymous.
• Logs and security events: authentication events, access logs, rate-limit and abuse-prevention signals, and other security telemetry
• Moderation results: the outcome of automated content moderation, content hashes of images and text that have been checked, and verification status including limited records of failed attempts
• Push notification tokens: Firebase Cloud Messaging (FCM) device tokens
• Crash and performance data: crash logs, via Firebase Crashlytics; and performance timings — how long the App takes to start, to draw a screen and to download the event feed — via Firebase Performance Monitoring
• Motion sensor (on-device only): the App reads the accelerometer so that shaking your phone can open the bug-report tool. This stream stays on your device and is never transmitted.
• Bug reports: if you submit one, we collect a screenshot of your screen at that moment, your device model and OS, the app version, your locale, and your email address. A screenshot may capture whatever was on screen, including another person's message, so please review it before sending.

1.3 Information From Third Parties

If you sign in with Google or Apple, we receive the basic profile information you authorise, including the provider's user identifier and, where you permit it, your name and email address.

1.4 Information We Deliberately Do Not Collect

• Your safe person's phone number. It stays on your device. We never receive it, store it, or contact that person ourselves.
• Your own phone number. Dayzi does not require or store one.
• Continuous or background GPS. Your exact location is recorded only at the moment you press SOS.
• Payment card or bank details. Dayzi does not currently take payments.
• Sensitive attributes by inference. We do not use automated systems to infer religion, political views, sexual orientation, caste, health, or ethnicity.

2. How We Use Your Information, and Our Legal Bases

We do not sell your personal data, and we do not use it for third-party or cross-context behavioural advertising.

Where we rely on legitimate interests we balance them against your rights, and you may object (Section 8). Where we rely on consent you may withdraw it at any time, without affecting processing already carried out.

3. AI, Content Moderation, Biometrics, and Automated Processing

These tools assist our safety decisions. They can make mistakes, and they do not by themselves permanently terminate your account without the possibility of human review (Section 3.7).

3.1 Image Moderation

Profile photos and event cover images are analysed by SightEngine to detect inappropriate content such as nudity or violence. Flagged images may be blocked or removed. Where SightEngine is unavailable, Google Gemini may perform the same check as a fallback. We store a hash of images that pass or fail, not the moderation scores.

3.2 Text Moderation

Event names and descriptions, and free text on your profile — your "about me", profile prompt answers, profession and social links — are analysed by Google Gemini API (via Google Cloud) to detect offensive, hateful, or inappropriate language. Profile text is checked after it is saved; text that fails is removed and you are notified.

3.3 Optional AI-Generated Descriptions

An optional feature uses Google Gemini API to draft an event description from details you provide. It runs only when you choose it.

3.4 Face Detection on Profile Photos — this applies to everyone

When you upload a profile photo, it is sent to Amazon Rekognition (Amazon Web Services, region ap-south-1, Mumbai) to check whether it contains a human face. This is a face-detection check — it counts faces. It does not identify you and does not create a faceprint. It runs on every profile photo, including for people who never use face verification. Today it is advisory only and does not block your upload. We keep a record only where no face was found.

3.5 Face Verification — optional, and biometric

Face verification is optional. It confirms you are a real, unique person and reduces fake accounts. It is not a background check and is not a guarantee of anyone's identity, character, or safety.

• Explicit consent. A facial image used to identify a person is special-category / biometric data. We ask for your explicit consent before processing your selfie and profile photo for this purpose.
• Who performs the comparison. Your selfie and your profile photo are sent to Amazon Rekognition (AWS, ap-south-1, Mumbai), which compares the two faces and returns a similarity score. Your selfie is then sent to Google Gemini API for a separate liveness check, confirming you performed the requested gesture. Amazon Rekognition, not Google, performs the face match.
• What we keep. Neither image is stored by Dayzi after the check. We retain your verification status (pass or fail), the date, the method used, and limited audit logs of attempts for security and abuse prevention.
• One exception. If verification fails and you choose to appeal, the selfie from that attempt is uploaded with your appeal so a person can review it against your profile photo. It is deleted once the appeal is resolved.
• No secondary use. Face data is never used for advertising, profiling, model training, or any unrelated purpose.
• Refusal. Declining verification does not block general use of Dayzi, though it may limit specific trust-and-safety features.

3.6 AI and Vendor Data Terms

We use the Google Gemini API as a paid service through a Google Cloud project. Under Google's paid API terms, Google does not use submitted prompts, images, or responses to train or improve its products, and processes that data under its applicable Data Processing Addendum. We do not use unpaid Gemini services for moderation, description generation, or verification.

Amazon Web Services processes images submitted to Amazon Rekognition under the AWS Service Terms and its Data Processing Addendum. Under those terms AWS may, by default, use content submitted to its AI services to improve those services, including for model training. We have opted out. An organisation-wide AI services opt-out policy is in force across our AWS account, so your photos and selfies are not used for service improvement or model training, and AWS has deleted any such content it previously held for that purpose.

SightEngine processes images under its data-processing terms. It trains its models only on media a customer voluntarily submits through its feedback mechanism. We do not use that mechanism, so your images are not used to train SightEngine's models.

3.7 Human Review and Appeals

If your content is removed, restricted, or flagged, or if verification fails, you may request human review at developer@dayzi.live or through the in-app appeal flow. We do not use AI moderation to infer sensitive attributes.

3A. What Other People, and the Public, Can See

Dayzi is a social product, so some information is shared by design. Please read this section rather than relying on assumptions.

• Visible to any signed-in Dayzi user: your first and last name, username, profile photo, age, gender, vibes, prompts, profession, Instagram link (if set), ghost count, and the events you are attending or have attended.
• Visible on the open internet, with no sign-in: if you create an event, our public event feed publishes the event's title, description, the location you choose for it, exactly as shown in the App — which can be a full street address, city, date, approximate coordinates (rounded to about 1 km) and cover image, together with your name, account identifier and a small copy of your profile photo (added only once the photo has passed our image check). Your username is not in the feed. Anyone with the feed address can read it. If someone shares an event's link, it opens a public page on dayzi.live that shows the event's title, type, city and cover image, and nothing else. If you are hosting at a private home, consider choosing a nearby landmark as the location. If you do not want this, do not create public events.
• Visible to other members of an event group: everything you post in that group chat.
• Visibility settings. "Show Attending Events" and "Show Past Events" control whether those rows are displayed in the Dayzi app. They are display preferences, not access restrictions. Treat anything you put on your profile as visible.
• Ghost counter. Your ghost count is shown on your public profile and cannot currently be hidden.
• Peer voting. After an event ends, attendees may vote on who did not turn up. A voting record can be read by the people who were at that event and by its host, and by no other user. Do not treat a vote as anonymous: the other people at the event can see how you voted. Closed voting records are deleted one year after the vote opened.

Your controls

• Location. You may turn off location access at any time in your device settings. Nearby events use the city on your profile, so they keep working. SOS will then send its alert without your location, and show the emergency number for the event's or your profile's country instead.
• Visibility. "Show Attending Events" and "Show Past Events" are in Privacy Settings — see the caveat above about what they control.
• Your profile. Anything optional can be cleared at any time in Edit Profile, including your profession and your Instagram link.
• Blocking. You can block any user from their profile. Blocked users cannot interact with you.
• Notifications. Manage these in your device settings.

3B. Safety Check-In (SOS) — please read this carefully

Dayzi includes a safety feature ("SOS") to help you reach one trusted person quickly if an event feels unsafe.

• Setting up a safe person is required to use Dayzi. You cannot finish onboarding without saving one name and one phone number. Whether you ever press SOS is entirely your choice.
• Your safe person stays on your device. The name and number are stored only in your phone's local storage. We do not upload, receive, or store them, and we never contact that person ourselves.
• How an alert is sent. Pressing SOS opens WhatsApp on your phone with a pre-filled message and a map link. You send it, from your own WhatsApp account. We are not a party to that message. WhatsApp's own privacy policy applies to it.
• We do record a safety case. Pressing SOS creates a record on our servers containing: your account, the event you were attending (if any), the time, the status (open, safe, or no response), your device platform and app version, and your device's precise location at that moment, together with its accuracy. Unlike every other location in the App, this one is not rounded, because its purpose is to let someone find you. It contains no phone numbers.
• Who sees it. Dayzi's safety team can view open cases, including the location, in order to follow up. The team is alerted by push notification and by email; the email names you and the event but never contains your location, which stays in the App. This is an internal trust-and-safety record. It is not a report to the police or any other authority, and we do not forward it to one as a matter of course. We would disclose it only where Section 4.3 applies.
• Retention. The precise location is erased 30 days after the SOS was triggered. The case record itself is deleted 90 days after it was triggered. Two exceptions to these automatic deletions: while a case is still open, we keep its location for as long as it stays open, up to the 90-day limit, because it is the only thing that makes the case actionable; and if our safety team escalates a case to the authorities or confirms that someone was harmed, we keep the case, including its location, as evidence (Section 4.3). Deleting your account deletes all of your SOS cases, including these.
• Follow-up. After you press SOS we may ask "Are you safe?" in the App and by push notification, and we will ask again before you join or create another event until you answer.
• SOS is not an emergency service. It alerts a person you chose. It does not contact the police, an ambulance, or any emergency service, and nobody from Dayzi is dispatched to you. In an emergency, call your local emergency number first — for example 112 in India and the EU, 911 in the United States, 999 in the United Kingdom, 000 in Australia.
• It can fail. SOS depends on your battery, your signal, your device's location permission, WhatsApp being installed and working, you tapping send, and your contact seeing the message. If you close WhatsApp without tapping send, nobody is alerted, even though a case was logged with us. Do not rely on SOS as your only safety plan. Sections 4.5 and 10 of our Terms set out the legal position.

4. How We Share Information

We do not sell your personal data. Our service providers act under written contracts, data-processing agreements, and confidentiality and security obligations.

4.1 Other Users and the Public

See Section 3A.

4.2 Service Providers (Sub-processors)

Where GDPR or UK GDPR applies, transfers outside the EEA/UK rely on adequacy decisions, Standard Contractual Clauses, and data-processing agreements as appropriate. The specific safeguard for each provider is in the table above.

Where your IP address is exposed, stated plainly. Most of the services above are called from our servers, so they never see your device. Three are exceptions:

• Apple and Deezer — the song-search feature calls their public search APIs directly from your device, so both receive your IP address along with what you typed.
• TMDB — your search text is proxied through our servers, but the poster images in the results are loaded directly from TMDB's image CDN, which therefore sees your IP address.

For these requests those companies act as independent controllers under their own terms, not as our processors. You can avoid all three by not using the "favourite song" and "favourite show" pickers, both of which are optional.

4.3 Legal, Safety, and Government Requests

We may disclose data where required by a valid and legally binding request, or where reasonably necessary to protect the rights, safety, or property of Dayzi, our users, or the public. Where we confirm child sexual abuse material, we report it to the competent authority, including the National Center for Missing & Exploited Children (NCMEC) or the relevant Indian authority.

4.4 Business Transfers

In a merger, acquisition, financing, reorganisation, or sale of assets, your data may transfer as part of the transaction. We will require the recipient to honour this policy or notify you of a material change.

4.5 Professional Advisers

Lawyers, auditors, insurers, and accountants, where necessary and under confidentiality obligations.

4.6 Links to Other Services

If you add an Instagram link, it is shown on your profile and anyone who can see your profile can open it. Tapping it leaves Dayzi and opens Instagram, which is operated by Meta under its own terms and privacy policy. We do not control that service, and we do not receive any information back from it. You can remove the link at any time in Edit Profile.

The same applies to any other external link, including the WhatsApp message the SOS feature opens: once you leave Dayzi, the other service's own terms and privacy policy govern what happens there.

5. International Data Transfers

Your data may be stored and processed in India, the United States, the European Union / EEA, the United Kingdom, and other countries where we or our providers operate. Firebase data is primarily hosted in the United States; Amazon Rekognition processing is performed in India.

Where GDPR / UK GDPR applies we rely on adequacy decisions, Standard Contractual Clauses, data-processing agreements, and transfer impact assessments as required. Where India's DPDP Act applies we will comply with any Government-notified restriction on transfers outside India. Where Singapore's PDPA applies we transfer only where the recipient is bound to a comparable standard of protection.

6. Data Retention

Periods below are indicative and may be extended where retention is required for legal, security, fraud-prevention, dispute-resolution, or safety reasons.

Backups. Deleted data may persist in encrypted backups for up to 90 days before automatic deletion, and will not be restored except for disaster recovery or legal/security purposes.

7. Account Deletion — and What Survives It

You can delete your account in the App at Privacy Settings → Delete Account, or by emailing us (see the Delete Account page on dayzi.live). Deletion enters a 30-day grace period, during which logging back in restores your account. After that it is permanent.

Deleted: your profile and photo, events you created, your group chat messages, notifications, group memberships and attendee entries, FCM tokens, SOS cases, and cached data.

Retained, and you should know this before you delete:

• Safety and moderation records. Reports you filed or that were filed about you, and their aggregates, are kept for the integrity of our safety system and may contain your name.
• Appeals. Ban appeals and event appeals are retained, and may contain your name and email address.
• Bug reports. Retained until resolved, and may contain your email address, device details and a screenshot.
• Voting records from events you attended.
• Shared content. Messages and event participation records that other people also hold may remain visible where necessary for event history, safety, or integrity.
• Anything else we must keep by law, or for security, fraud prevention, or the establishment or defence of legal claims.
• Aggregated, anonymised analytics that no longer identify you.

If you want any retained item removed, contact us and we will assess the request against the exemptions above.

8. Your Rights and Choices

Contact developer@dayzi.live or use the in-App controls. We may verify your identity first, and may decline requests that are manifestly unfounded, excessive, or that would infringe others' rights. We aim to respond within 30 days and will tell you if we need longer.

8.1 Available to most users

• Access and portability: view your data in the App, and export a copy in JSON from Privacy Settings → Download My Data. The export currently covers your profile, events, requests, group memberships, notifications, invitations and SOS cases. It does not yet include your group chat messages, reports, blocks, bug reports, or appeals — ask us and we will provide those separately.
• Correction: update your profile from Edit Profile.
• Deletion: see Section 7.
• Withdraw consent: disable optional features, turn off push notifications in device settings, unsubscribe from promotional messages, or withdraw face-verification consent.
• Manage display settings: in Privacy Settings (see Section 3A for what these do and do not control).

8.2 EU / EEA and UK (GDPR, UK GDPR)

You may also object to processing based on legitimate interests, restrict processing, ask not to be subject to solely automated decisions with legal or similarly significant effect, and lodge a complaint with your supervisory authority or the UK ICO.

EU and UK representatives (Article 27). Solika Ventures Pvt Ltd is appointing representatives in the EU/EEA and the UK. Their names and contact details will be published in this section. Until then, contact us directly at developer@dayzi.live for any GDPR or UK GDPR matter.

8.3 United States

Where the CCPA/CPRA applies, California residents may know, delete, correct, opt out of any sale or sharing, limit use of sensitive personal information, and not be discriminated against. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. Residents of other US states with comparable laws have similar rights, which we honour where they apply.

Biometric information (Illinois BIPA, Texas CUBI, and similar laws). Face verification is optional and requires your separate, explicit consent before any facial image is processed. We do not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. Facial images used for verification are not retained after the check, and any verification record is destroyed when the purpose is satisfied or within three years of your last interaction with Dayzi, whichever occurs first.

8.4 Singapore (PDPA)

You may withdraw consent and access or correct your data. We respond within PDPA timeframes and notify the PDPC of notifiable breaches. Our Data Protection Officer is reachable at developer@dayzi.live.

8.5 India (DPDP Act, 2023)

You have the right to access, correct and erase, seek grievance redressal, and nominate another individual to exercise your rights on death or incapacity. To submit or update a nomination, or to raise a grievance, contact our Grievance Officer (Section 12).

Two different clocks, so that you know which applies. The DPDP Rules set an outer limit of 90 days. We commit to better than that:

• A grievance is acknowledged within 48 hours and we aim to resolve it within 30 days. The 48-hour acknowledgement is our own commitment, not a period the Rules require.
• A rights request — access, correction, or erasure — is one we aim to complete within 30 days. Where a request is complex or we need to verify your identity, it may take longer, up to the 90-day outer limit. We will tell you if we need the extra time and why.

9. Data Security

• Encryption in transit (TLS) and at rest
• Firebase App Check for app integrity, and Firebase Authentication for account access
• Administrative access to production data is limited to a small number of authorised accounts, granted individually and revocable; credentials and API keys are held in a managed secret store, not in application code
• Server-side rules and function-level checks govern what any account can read, rather than relying on what the app chooses to display
• Rate limiting on sensitive and paid operations
• Automated content moderation, and audit logging of security-relevant events
• Encrypted backups with defined retention (see Section 6)
• Every service provider that receives personal data is listed in Section 4.2, and is assessed before we start sending it data
• A written incident-response procedure, which sets out how a suspected breach is contained, assessed, recorded, and notified within the deadlines in Section 10

We are a small team, and we would rather describe our security honestly than impressively. No system is completely secure. Please keep your login credentials confidential, and tell us at developer@dayzi.live if you believe your account has been accessed by someone else.

10. Data Breach Notification

If we become aware of a personal data breach affecting you, we will notify affected users and the relevant authorities where required by law — including under the GDPR, India's DPDP framework, and Singapore's PDPA. The notice will describe, in plain language, what happened, the likely consequences, what we have done, and how to contact us.

11. Children's Privacy

Dayzi is intended only for users aged 18 and above. We do not knowingly collect personal data from anyone under 18.

Being straightforward about how this is checked: at sign-up you select your age, and the App does not permit a value under 18. We do not currently verify age against a document or a third-party age-assurance service, so this is a self-declaration. We also act on reports: if we reasonably believe a user is under 18, we suspend or delete the account. If you believe a minor is using Dayzi, contact developer@dayzi.live and we will act.

We also have a contractual reason to hold this line. Our AI provider's API terms require that the service not be directed to, or likely to be accessed by, individuals under 18. Our 18+ rule is therefore an obligation we owe our vendors as well as a choice we made, and we treat under-18 accounts as a removal matter rather than a warning.

Our child-safety standards, including our prohibition on child sexual abuse and exploitation and how to report it, are published separately in our Child Safety Standards.

12. Grievance Officer and Regional Contacts

Grievance Officer (India — DPDP Act, 2023) / Data Protection Officer

Name: Vishal Mandhane Designation: Founder, Solika Ventures Pvt Ltd Email: vishal.mandhane@dayzi.live

Acknowledgement within 48 hours; resolution targeted within 30 days.

EU/EEA and UK representatives: see Section 8.2.

13. Push Notifications

Transactional notifications (invitations, approvals, cancellations, request updates, SOS follow-ups) are part of the service. Promotional or broadcast notifications are sent only where permitted and can be disabled.

You can disable push notifications in your device settings, and broadcast subscriptions are cleared on logout. FCM tokens are deleted on logout or account deletion.

Note: the App currently offers a single push switch, which turns off both transactional and promotional notifications together. You can also unsubscribe from promotional messages by contacting us.

14. Cookies, Server Logs, and Tracking

The App does not use browser cookies and uses Firebase Analytics for in-app usage measurement, associated with your account identifier. No third-party advertising trackers or ad SDKs are used, though the Android Advertising ID is collected as described in Section 1.2.

The dayzi.live website and our infrastructure providers (Vercel, Cloudflare, Firebase, EmailOctopus) may set strictly necessary cookies and generate server logs — including IP address and request metadata — needed to operate and secure the Site and process waitlist sign-ups.

Where EmailOctopus records email open, click, or unsubscribe status for waitlist campaigns, we use it only to manage those campaigns and to honour unsubscribes. We do not use it to build a profile of you or for advertising.

15. Changes to This Policy

We may update this policy. We will notify you of significant changes by in-app notification, push notification, or on the Site. Where required by law, we will seek fresh consent before applying material changes to consent-based processing. Continued use after other updates take effect constitutes acceptance.

16. Contact Us

Solika Ventures Pvt Ltd B. No. 1, R. No. 403, Sarvodaya Galaxy, Nr. Kopar, Vishnunagar, Kalyan, Thane – 421202, Maharashtra, India Email: developer@dayzi.live

If you are not satisfied with our response you may complain to the data protection authority in your jurisdiction — in India the Data Protection Board of India, in the EU/EEA your national supervisory authority, in the UK the ICO, and in Singapore the PDPC.