Privacy Policy

01Information we collect

1.1 Personal information

When you register and use Avokindo, we collect:

• Account information: name, email address, phone number, date of birth, gender
• Profile information: photos, bio, interests, location, occupation, relationship status
• Verification data: the result of a liveness session run by our verification provider, one standard reference photo from that session, and verification metadata such as confidence scores and timestamps. If you choose the optional Premium ID check, the government ID documents you submit — see Section 3
• Payment information: processed securely through third-party payment processors. Subscriptions are handled by Apple, Google and RevenueCat. Ticket purchases are handled by toyyibPay, our payment gateway in Malaysia. We never see or store your full card number in either case

1.2 Usage information

• Activity data: communities joined, events created and attended, RSVPs and tickets, messages, interests expressed
• Device information: device type, operating system, unique device identifiers
• Advertising identifier: your device's resettable advertising ID (Android Advertising ID, or the iOS Identifier for Advertisers where you have allowed it) and IP address, used by our advertising partner to serve and measure ads — see Section 4.4
• Location data: approximate location (city/region) for event discovery
• Analytics: app usage patterns, features used, performance data

02How we use it

We use your information to:

• Provide services: create and manage your account, run communities and events, enable communication
• Verification: confirm a real person is behind an account before it takes a gated action, using the liveness check described in Section 3
• Discovery: use your preferences, interests, and location to suggest relevant communities, events, artists and venues
• Advertising: show ads to users on the free tier, and measure whether those ads were seen and tapped — see Section 4.4
• Safety and security: detect and prevent fraud, abuse, and illegal activity
• Improve services: analyze usage patterns to enhance features and user experience
• Communications: send notifications about your communities, events, messages, and updates
• Legal compliance: comply with applicable laws and regulations

03Face data & verification

3.1 What face data is collected

During the liveness verification process:

• Facial liveness check: a short video-based liveness challenge is performed by a trusted third-party verification service to confirm you are a real person and not a photo or a mask. The service processes facial geometry data in real time and returns a confidence score and a single reference image. Avokindo does not perform any biometric or facial recognition processing itself.
• Reference photo: one standard JPEG reference image from the liveness session is stored for future profile photo consistency checks.
• Face comparison: when you update your profile photo, the image is sent to our verification service to compare against your stored reference photo. The service performs the comparison and returns a similarity score. Avokindo does not perform facial comparison processing itself.

3.2 How face data is used

Face data is used solely for identity verification purposes:

• Confirming a real person is present (liveness detection)
• Checking that a profile photo you upload is the same person as your liveness reference image
• Preventing impersonation and fraud on the platform

Face data is never used for advertising, marketing, tracking, profiling, or any purpose other than identity verification.

3.3 Third-party processing

All facial analysis and biometric processing is performed by a trusted third-party service provider. Avokindo does not perform any facial recognition or biometric processing itself. Our provider processes face data solely for the purpose of liveness detection and face comparison on our behalf, and does not retain face data after processing is complete. For details on our third-party providers, please contact ask@avokindo.com.

3.4 Storage and retention

• What we store: Avokindo stores only a standard JPEG reference photo and verification metadata (confidence scores, timestamps, session IDs). We do not store biometric templates, faceprints, or facial geometry data.
• Storage location: the reference photo and session metadata are stored in encrypted cloud storage, encrypted at rest.
• Retention period: face data is retained for as long as your account is active. Upon account deletion, all face data — reference photos and session records — is deleted within 30 days.

3.5 Your rights regarding face data

• You can request deletion of all face data at any time by contacting ask@avokindo.com.
• You can re-verify at any time, which replaces previous face data.

04Information sharing

4.1 With other users

• Your profile information, photos, and bio are visible to other users
• Your approximate location (city/region) is shared for event discovery
• Messages are shared only with the people in that conversation — your connections, and the members of a community or event group you belong to

4.2 With third parties

4.3 Legal requirements

We may disclose your information if required by law, court order, or to protect the safety of our users and the public.

4.4 Advertising

The free tier of Avokindo is supported by advertising. Two kinds of ad can appear:

• Google AdMob ads. Banner and interstitial ads supplied by Google's advertising network. To serve and measure these, the AdMob SDK on your device processes your device's resettable advertising identifier, IP address, coarse location derived from it, device and app information, and whether an ad was shown and tapped. This processing is carried out by Google as described in Google's own advertising and privacy policies.
• Ads sold directly by Avokindo. Creative supplied by an advertiser and served by us on browse surfaces. These are not targeted using your profile, and no personal data leaves Avokindo to deliver them.

What we do not do:

• We do not sell your personal data.
• We do not send your name, phone number, email address, date of birth, photos, facial verification data, or the contents of your messages to any advertising partner. Ad requests carry no profile or interest data from your Avokindo account.
• Face data is never used for advertising — Section 3.2.

Your choices:

• Subscribe. Avokindo Premium is ad-free; no ad is requested for a subscriber's device.
• iOS. We ask for App Tracking Transparency permission before your IDFA can be used for advertising. If you decline — or never answer — the IDFA is not available to the ad SDK. You can change this any time in Settings → Privacy & Security → Tracking.
• Android. You can reset your advertising ID, or delete it entirely, in Settings → Google → Ads.

05Data security

We implement industry-standard security measures:

• Encryption: all data is encrypted in transit (TLS/SSL) and at rest
• Access controls: strict access controls limit who can view your data
• Regular audits: security audits and vulnerability assessments
• Server-side protection: integrity-critical fields — your Trust Score, which records how many verification steps you have completed, and your verification status — are calculated and written only by our backend services. Clients cannot write to them

06Your rights & choices

6.1 Access and control

• Access your data: request a copy of your personal data
• Update information: edit your profile and preferences in the app
• Delete your account: delete it yourself from Settings. Deletion runs immediately; a limited set of records is kept where the law requires it — Section 7
• Opt out: disable push notifications and email communications

6.2 Location and permissions

• You can disable location services in your device settings
• Revoke camera, photo library, and notification permissions anytime

07Data retention

We retain your data for as long as your account is active and for a reasonable period thereafter:

08Children's privacy

Avokindo is intended for users aged 18 and older. Your date of birth is collected before your account is created and checked against that threshold on our servers. We do not knowingly collect data from users under 18. If we discover a user is under 18, we will promptly delete their account and data. Our full child safety position is set out in our Child Safety Standards.

09International data transfers

Your data may be transferred and stored in countries other than your own, with servers primarily in the United States. We ensure appropriate safeguards are in place to protect your data in accordance with applicable data protection laws.

10Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via:

• In-app notification
• Email to your registered address
• An updated "Last updated" date at the top of this page

11Contact us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us:

12Legal basis (GDPR / PDPA)

For users in regions with data protection laws (EU GDPR, Malaysia PDPA, and others), our legal basis for processing your data includes:

• Consent: you provide consent when creating an account and using optional features
• Contract performance: processing necessary to provide our services
• Legitimate interests: fraud prevention, security, service improvement
• Legal obligations: compliance with applicable laws