Privacy policy

What we collect

• Your phone number, to sign you in with a one-time code.
• Your profile: display name, birthday (to confirm you are 18 or older), pronouns, bio, photos, interests and the neighbourhood you choose.
• What you do in the app: plans you create or join, check-ins, messages, comments, stories, photos in Lore, ratings, reports and squad connections.
• Location: your approximate area to show nearby plans; your precise location only when you check in at a venue or choose to share live location with trusted contacts.
• Contacts, only if you allow it: phone numbers are turned into one-way hashes on your phone before upload and used only to find friends already on the app. We never store your contacts' names or numbers.
• A verification selfie, only if you choose to get verified. It is compared with your profile photos and deleted once reviewed (and within a day if you never submit it).
• Payments for paid plans: Razorpay handles card, UPI and bank details; we keep the amount, status and receipt.
• Device and diagnostics: a push notification token, crash reports and product analytics that carry no names, messages or contact details.

Why we use it

• To run the service: sign-in, showing and joining plans, chat, payments, refunds and host payouts.
• To keep people safe: age checks, verification, moderation of reported or flagged content, blocking, SOS alerts and live location you start.
• To improve the app with aggregated, de-identified analytics.
• We do not sell your data and do not use it for third-party advertising.

Who sees what

• Other members see your public profile. Plans, stories and Lore follow the audience you or the host pick. Exact locations of mystery plans are revealed only to confirmed attendees, close to the start.
• Processors that act on our behalf under contract: Amazon Web Services (hosting, storage, image checks), MSG91 (SMS), Razorpay (payments), Expo (push notifications), Google Maps (places), OpenWeather (weather), PostHog (analytics) and Sentry (crash reports).
• We disclose data to authorities only when Indian law requires it.

How long we keep it

• Stories disappear after 24 hours and their files are deleted shortly after.
• Live location points are deleted within 24 hours.
• Verification selfies are deleted after review.
• When you delete your account it is hidden at once and permanently erased after 14 days, unless you sign in again before then to cancel.
• Payment and tax records are kept for as long as Indian tax law requires. Records of bans and safety actions are kept so a removed person cannot simply return.

Your rights

• Download a copy of your data: Settings, then Account, then Export my data.
• Correct your data: edit your profile at any time.
• Delete your account: Settings, then Account, then Delete account, or follow the steps at /delete-account.
• Withdraw consent for contacts, location or notifications at any time in your phone settings or the app.
• Raise a grievance with our Grievance Officer at the contact page. If you are not satisfied with our response you may complain to the Data Protection Board of India.

Children

TouchGrass is only for people aged 18 and over. We refuse sign-up below that age and remove accounts we learn belong to minors.

Changes

We will tell you in the app before material changes take effect. The date at the top shows the latest version.