Privacy Policy

Last updated: 16 May 2026

Squircle ("we", "our", "us") operates the Squircle mobile app and website (the "Service"). This policy explains what data we collect, why, and what control you have over it. Questions? Email vijaysebastian111@gmail.com.

1. What we collect

When you create an account

• Name, email, and phone number — used to sign you in and recover your account.
• Password — stored only as a one-way salted bcrypt hash. We cannot see your actual password.

When you book a ticket or claim an offer

• Event/offer details, ticket quantity, time of booking, and the booking code we issue.
• Payment status. We do not store card numbers; payments are processed by Stripe / Razorpay directly, and we only receive a payment confirmation token.

When you use the app

• A Firebase Cloud Messaging (FCM) device token — used only to deliver push notifications for events and offers. Tied to your account so we can deliver notifications you've opted into.
• App version, device model, and Android version — collected for diagnostics if you report a problem.

When you visit our website

• Standard server logs (IP address, timestamp, page requested), retained for up to 30 days for security and abuse prevention.

We do not collect location, contacts, photos, files, microphone audio, calendar entries, SMS, or call history.

2. How we use it

• To run your bookings and check you in at events.
• To deliver push notifications about events and offers, when you've opted in.
• To investigate fraud, abuse, and security incidents.
• To send transactional emails (booking confirmation, password reset).

We do not sell your data. We do not share it with advertisers.

3. Who we share data with

Only with service providers required to run the Service:

• Stripe / Razorpay — payment processing. We share name, email, and amount; we never share card details. These providers operate under their own privacy policies.
• Firebase Cloud Messaging (Google) — to deliver push notifications. Only the device token + the message content are shared.
• Render — our cloud hosting provider. Your data is stored at rest in their European region.

We will disclose data if required by law or a valid court order.

4. Retention

• Account data — kept while your account is active; deleted within 30 days of an account-deletion request.
• Booking records — kept for 24 months for accounting and dispute resolution, then anonymised.
• Push notification tokens — deleted on logout or app uninstall (and pruned automatically when FCM marks the token invalid).
• Server logs — 30 days.

5. Your rights

You can:

• Delete your account directly inside the app — open Profile → Delete my account, type DELETE to confirm, then enter your password. Your profile is anonymised immediately and you cannot log back in.
• Request a copy of the data we hold about you.
• Correct any inaccurate data.
• Withdraw consent for push notifications — turn them off inside the app, or via your phone's notification settings.

For data access, correction, or anything not covered by the in-app delete flow, email vijaysebastian111@gmail.com from the address linked to your account. We respond within 30 days.

When you delete your account, your name, email and phone are wiped immediately. Past booking records remain with the relevant organiser for accounting purposes (see §4 Retention) but no longer carry your identifying details.

6. Children

Squircle is for users aged 18 and over because bookings involve payment. We do not knowingly collect data from anyone under 18. If you believe we have, email us and we will delete it.

7. Security

• All traffic between the app/website and our backend uses HTTPS with TLS 1.2 or higher.
• Passwords are hashed with bcrypt.
• Sensitive credentials (payment gateway keys, organisation banking info) are encrypted at rest using AES-256 with keys not stored alongside the data.
• Production database backups are encrypted.

8. Changes to this policy

If we materially change how we handle your data, we'll notify you via the app and email at least 14 days before the change takes effect. Minor wording fixes will be posted here without notice; the "Last updated" date at the top will always reflect the latest version.

9. Contact