Privacy Policy

01 // Scope & Legal Principles

At Xplofy, our architecture operates on the principle of Data Minimization and Purpose Limitation. We believe that accessing objective factual news intelligence should not come at the cost of personal digital surveillance. We collect only the baseline data strictly necessary to authenticate users, deliver synthesized regional intelligence, configure custom digest alerts, and manage subscription communication.

02 // Comprehensive Data Collection Matrix

Depending on how you interact with the Xplofy platform (via our web landing portal, newsletter subscription, beta registration, or the Xplofy Mobile Application), we process the following categories of digital personal data:

A. Web Portal, Beta Pre-Registration & Newsletter Subscriptions (Brevo Ingestion)

When you subscribe to updates, request research notes, or register for Beta access on xplofy.com, we collect:

• Full Name / First Name: Used solely to personalize administrative correspondence, token delivery, and system invitations.
• Electronic Mail Address (Email): Required for transactional token verification, XP-Pass delivery, beta onboarding instructions, and opted-in editorial research notes.
• List Segmentation Identifiers: Automated categorization into Brevo (Sendinblue) subscriber lists based on explicit user submission and subscription type.

B. Xplofy Mobile Application (Authentication & User Profile)

Within the native mobile client (Android / iOS), users may interact as Guest / Anonymous users or authenticated account holders:

• Authentication Identifiers (Firebase Auth & Google Sign-In): Full Name, Email Address, Profile Avatar URL, and cryptographically salted Firebase Unique User Identifier (UID).
• User Profile Metadata (Optional, self-declared in Settings): First Name, Last Name, Mobile Phone Number, Country Dialing Code (+91), Date of Birth, and Gender/Sex (Male, Female, Other)—used strictly for demographic account personalization and regional dialect routing.

C. Regional, Dialect & Reading Preferences (Edge Vector Routing)

• App & Content Language Selections: Preferred interface and synthesis dialects across 11+ regional Indian languages (English, Hindi, Odia, Bengali, Tamil, Telugu, Marathi, Gujarati, Kannada, Malayalam, Punjabi).
• Regional Feed Filters (Multi-Select): Selected states and regional clusters chosen by the user for hyper-local civic, policy, and state news aggregation.
• Content Category Interests: User-selected focus tracks (such as AI & Robotics, Science & Space, Clean Energy, Geopolitics & Defense, Markets, Biotech, Politics, and Sports).

D. Reading Telemetry & Audio Briefing States

• Reading History & Library Bookmarks: Encrypted local and cloud-synced storage of bookmarked stories, liked briefs, and chronological reading history logs stored for offline access.
• Neural Audio Cast Playback Telemetry: Playback position, streaming cache indexes (Shaka / Track Player), audio speed preferences (1.0x, 1.25x, 1.5x), and native TTS dialect routing.
• Scheduled Digest Preferences: Custom morning, afternoon, and evening notification timestamps and toggle states for automated news broadcasts.

E. Technical, Network & Device Telemetry

• Device Specifications: Device brand, model architecture, OS build version, dynamic screen viewport dimensions, and app build version.
• Coarse Regional Location (IP Level): Coarse city/state approximation derived from edge network routing to automatically populate local weather widgets and regional news feeds without accessing precise GPS sensors.
• Push Notification Tokens: Firebase Cloud Messaging (FCM) / Expo push tokens used exclusively to transmit breaking news alerts and digest notifications when enabled.

03 // Lawful Grounds for Processing (DPDP Act 2023)

In accordance with Section 4 and Section 6 of the Digital Personal Data Protection Act, 2023, KALBHYX Private Limited processes personal data exclusively under the following lawful grounds:

• Explicit Consent (Notice & Affirmative Action): Freely given, specific, informed, and unambiguous affirmative consent obtained when registering for Beta access, subscribing to communications, or logging into the mobile application.
• Performance of Contractual Obligations: Processing authentication tokens, delivering 60-word synthesized smart briefs, and routing neural audio casts to fulfill user-requested application services.
• Statutory & Legal Compliance: Preserving server access records, security audit logs, and fraud prevention telemetry as mandated under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

04 // Brevo Communications & Direct Marketing Protocols

When you subscribe to Xplofy newsletters or pre-register for beta releases, your contact details are processed securely via our dedicated Cloudflare Worker proxy connecting to Brevo (formerly Sendinblue):

• No Cold Marketing: We do not engage in unsolicited third-party promotional marketing or data brokering.
• List Isolation: Beta waitlist registrants and newsletter subscribers receive only communications directly relevant to their selected tier.
• Instant Unsubscribe: Every transactional update and newsletter email includes a one-click automated unsubscribe link. Alternatively, users may email care@xplofy.com to be removed immediately from all broadcast lists.

05 // AI Synthesis & Zero Public Model Training Guarantee

06 // Sub-Processors & Infrastructure Partners

We partner exclusively with tier-1 enterprise infrastructure providers adhering to ISO/IEC 27001, SOC 2 Type II, and DPDP Act data safety requirements:

07 // Local Storage Tokens & Telemetry (No Tracking Cookies)

In accordance with our privacy-first philosophy and DPDP Act 2023 mandates, Xplofy does not utilize intrusive third-party cross-site advertising cookies. Instead, we utilize minimal, privacy-centric storage tokens:

• Functional Local Storage Tokens: Stored locally on your device (e.g. xplofy_consent_accepted, theme preferences, selected regional filters, and local audio speeds) to maintain application state.
• Performance Telemetry: Aggregated, anonymized web vitals tracked via Google Tag Manager and Google Analytics without personal user identifiers or IP tracking.

08 // Data Retention, Account Erasure & 72-Hour SLA

Under Section 12 of the DPDP Act 2023 and Google Play Store User Data Safety policies, you possess the unalienable right to review, update, or permanently delete your digital personal data.

How to Request Permanent Account Deletion:

1. Send an email from your registered address to care@xplofy.com.
2. Set the subject line to: "Account Deletion Request — [Your Email]".
3. Our automated compliance gateway will verify your request and purge all profile entries, Firebase auth credentials, reading logs, and Brevo mailing entries within 72 Hours. A formal confirmation certificate will be transmitted upon completion.

09 // Protection of Children & Age Eligibility

Under Section 9 of the DPDP Act 2023, Xplofy does not engage in behavioral tracking or targeted profiling of minors. The platform is intended for users who are at least 18 years of age, or at least 13 years of age operating under the direct guidance and verifiable consent of a parent or legal guardian. If we discover that personal data of an individual under 13 has been collected without verifiable parental consent, we will promptly execute irreversible erasure.

10 // Information Security & Encryption Standards

KALBHYX Private Limited enforces enterprise-grade physical, technical, and administrative safeguards:

• In-Transit Cryptography: Mandatory Transport Layer Security (TLS 1.3 / HTTPS) across all API endpoints, web sockets, and media streams.
• At-Rest Encryption: AES-256 bit encryption on database volumes, user bookmarks, and cloud storage repositories.
• Access Governance: Zero-trust role-based access control (RBAC) with mandatory multi-factor authentication (MFA) for all administrative operations.

11 // Statutory Grievance Redressal & Legal Governance

Under Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 13 of the Digital Personal Data Protection Act, 2023, the Grievance Officer for KALBHYX Private Limited is:

12 // Policy Modifications & Notifications

KALBHYX Private Limited reserves the right to amend this Privacy Policy periodically to reflect evolving legal frameworks, technological updates, or new application features. Material modifications will be prominently notified via web banner alerts, in-app notification prompts, or direct email correspondence to registered users prior to enactment.