Privacy Policy

Effective date: 19 October 2026

This Privacy Policy explains how Howsit (Registered as a Micro Enterprise under Udyam) ("Howsit", "we", "us") collects, uses, shares, protects and deletes your personal data when you use the Howsit app on Android, iPhone and the web, the website https://howsit.in, and related services (together, the "Services").

It is published under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and Rule 3(1) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules"). Howsit is used around the world, so section 14 also explains your rights under other laws, such as the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws. Please read it together with our Terms and Conditions.

1. Who we are

Howsit is the "Data Fiduciary" for the personal data described here: we decide why and how it is processed.

Howsit (Registered as a Micro Enterprise under Udyam)
At/Po-Karanjia
Karanjia, Dist. Mayurbhanj
Odisha 757037, India

For any privacy question or request, write to support@howsit.in or call +91 73377 66156 (Monday to Saturday, 9:00 AM – 7:00 PM IST). Our Grievance Officer's details are in section 13.

2. What Howsit is

Howsit is one app with four parts:

• Personal — one-to-one and group chats, voice and video calls, group calls, broadcasts and Vibes (status updates);
• Reels — short and long videos, live streams, comments, Circles, creator tools and in-app shopping from Reels;
• Students Corner — schools, classes, homework, fees, learning resources and live classes;
• Business — a shop, stock and sales, invoices, a business ledger (ERP), POS for Mall, online orders, and Local Services, where people offer and book services nearby.

3. Personal data we collect

You give us:

• Account: your mobile number (verified with a one-time code), name, date of birth, profile photo, "About" text, language and, if you add it, your email address. For users under 18, the mobile number of the parent or guardian who gave consent, and when they did.
• Who sees your mobile number: only you and the people you allow (Settings → Privacy → Phone number: Everyone, My Contacts — the default — or Nobody), and people who already have your number. Everyone else — on Reels, comments, live chat, Students Corner, the marketplace and in groups — sees a private ID instead, which cannot be turned back into your number. The same settings decide who sees your photo and About and your myVibe, and who can add you to groups. Which groups you're in is never shown to anyone outside them. People you block see none of it. A business you deal with (a shop, school or seller you order from) sees the number it needs to serve you.
• Content you share publicly: Reels, live streams, comments, Vibes, channel and shop pages, product listings and reviews.
• Messages and calls: see section 4 — we cannot read the content of end-to-end encrypted chats.
• Payments and wallet: the amounts, dates and parties of payments, top-ups, transfers, orders, refunds and payouts; your UPI ID or bank details if you ask for payouts; tax identifiers (such as GSTIN) if you give them for invoices. Card, UPI PIN and net-banking credentials are entered on the payment gateway (Razorpay) and never reach us.
• Students Corner: for schools and learners — student and class records, attendance, homework, marks, fee records and receipts. Schools that add students are responsible for having the required consent (see section 9).
• Business: your shop and business details, products, stock, customers, invoices and ledger entries; for POS for Mall, counters, shifts, sales and mall tenants' leases, rent and revenue share.
• Local Services providers: your service, area, prices and photos; for identity checks, the result of the check (through DigiLocker in India where available, or an identity-verification partner abroad), the type of ID and its last four characters only — never the full ID number.
• Payouts: if you withdraw earnings, the bank account or UPI ID in your name and the result of the KYC check.
• Support: what you tell us in tickets, reports and feedback.

We collect automatically:

• Device and app data: device model, operating system, app version, a device identifier, push-notification token (Firebase Cloud Messaging / Apple Push Notification service), app-integrity signals (Firebase App Check) and crash information.
• Network and log data: IP address, time and type of requests, and security logs.
• Usage of Reels: what you watch, for how long, likes, follows and searches — used to show you relevant Reels. You can pause or clear this history in Reels → Your data.

From your phone, only when you allow it:

• Camera and microphone — for photos, videos, voice notes, calls and live streams.
• Photos and media — only the items you pick to send or post.
• Contacts — to show which of your contacts are on Howsit when you search: only the numbers that match what you typed are checked with Howsit. For the ones already on Howsit we keep the fact that they are in your contacts, so they count as "My Contacts" in your privacy settings; numbers of people not on Howsit are not kept. Also when you choose to share or save a contact. We never upload your address book.
• Invitations — if you invite someone, we keep their number with the invitation (valid for 7 days) so the link works and we can tell you when they join. Howsit does not send them any message; your phone's SMS app does.
• Location — approximate location, only if you have already allowed it, to pre-fill your country code and show nearby shops and services. It is used on your phone and not stored by us unless you add an address yourself (for example for a delivery).
• Speech recognition — when you search by voice; the device's speech service turns speech into text.

4. Chats, calls and backups

• End-to-end encryption. One-to-one chats, and group chats of up to 256 members, are end-to-end encrypted: messages, photos, videos, voice notes and files are locked on your phone with keys only the people in the chat have. Howsit stores and delivers the encrypted copy so your chats reach all your devices; we cannot read it. We do see the information needed to deliver it: who sent it to whom, when, its size and whether it was delivered or read.
• Larger groups and communities are protected in transit and on our servers but are not end-to-end encrypted; the app tells you when this is the case.
• Calls are connected through our call partner (LiveKit) and relay servers. We do not record calls. In a group video call, a member can record a short reel of the call; everyone in the call sees that it is being recorded, and the recording is kept in that group.
• How long chat media stays on Howsit. Photos, videos, voice notes and files in chats are kept on Howsit's servers for 90 days, and for as long as the sender has Howsit Pro. Media you have opened stays on your phone, and your Google Drive backup (if you turn it on) keeps everything.
• Secure backup (optional). If you turn it on, your chat keys are locked on your phone with a password only you know (Argon2id and AES-256-GCM) before a copy is stored with Howsit. We cannot open it, and we cannot reset the password.
• Google Drive backup (optional). If you connect your Google account, the app saves a backup of your Howsit data in a hidden app folder of your own Google Drive, locked with the same backup password. Google's privacy policy applies to your Drive.

5. Why we use your personal data

Data businesses keep on Howsit. When a shop, school or mall uses Howsit to keep records of its own customers, students or tenants, that business decides what to keep and why; Howsit processes those records on its behalf and on its instructions.

We do not sell your personal data. We do not use the content of your end-to-end encrypted chats for anything — we cannot read it.

6. AI features and automated safety checks

• Safety checks. Public Reels, live streams, profile photos and reported content are checked automatically, with the help of Google's Gemini AI service, for content that breaks the law or our Community Guidelines. A check can hold, remove or label content; repeated serious violations can suspend an account. You can contest a decision through the Grievance process; a person reviews it.
• Ask the video and captions. When you use "Ask the video" or captions on a Reel, that Reel's video, sound and your question are processed by the AI service to produce the answer or captions.
• AI results can be wrong. Do not rely on them for medical, legal, financial or safety decisions.

7. Who we share personal data with

We share personal data only as strictly necessary to operate the Services, under written agreements requiring our partners ("Data Processors") to maintain confidentiality, process data only on our instructions, and apply robust technical safeguards:

• Cloud Infrastructure & Database Hosting — to securely store your account profile, chats, media, and application records.
• Real-Time Communication & Streaming Providers — to deliver encrypted voice/video calls, group conferences, and live streaming.
• Payment Aggregators & Financial Partners — RBI-authorised payment aggregators to process payments, handle refunds, and settle merchant payouts.
• Telecom & SMS Gateway Partners — DLT-registered telecom aggregators to transmit one-time sign-in passcodes (OTPs).
• AI & Platform Integrity Services — for automated content safety screening, spam prevention, and opted-in AI utility features.
• Logistics & Courier Aggregators — to deliver physical marketplace orders (sharing only recipient name, delivery address, and contact number with the courier).
• Application Diagnostics & Notifications — to deliver push notifications and collect crash diagnostics (device model, operating system, and technical logs — never your private messages or contact book).
• Cloud Backup Services — only if you explicitly choose to connect personal cloud storage for chat backups.

We also share data:

• With other users, as you choose: your name, photo and "About" (as allowed in Settings → Privacy), your public posts, and — for orders — the details a seller or buyer needs to complete the order.
• With schools and businesses you join: the records they need (for example a school sees its students' fee and homework records).
• When the law requires it: with courts, law-enforcement and government agencies under a lawful order, including under section 69 of the IT Act and Rule 3(1)(j) of the IT Rules.
• In a business transfer: if Howsit is merged or sold, under the same protections.

8. Where your data is processed

Some of our partners store or process data outside India. We transfer personal data abroad only as permitted under section 16 of the DPDP Act, and our partners must protect it as described here.

9. Children and students

Under the DPDP Act, anyone under 18 is a child.

• You must be 13 or older to have a Howsit account. We ask for your date of birth when you sign up, and do not knowingly keep personal data of children under 13 (as also required by the US Children's Online Privacy Protection Act); if we learn that we have, we delete it.
• People aged 13 to 17 may use Howsit only with the verifiable consent of a parent or lawful guardian: we send a one-time code to the parent's or guardian's phone, and they confirm. Schools that add students to Students Corner confirm that they hold that consent.
• Accounts of people under 18 are not shown ads.
• We do not knowingly carry out tracking, behavioural monitoring or targeted advertising directed at children (section 9(3) of the DPDP Act).
• Parents can use Settings → Privacy → Parental Control to restrict Reels, Vibes and Business with a PIN.
• If you believe a child has given us personal data without consent, write to support@howsit.in and we will delete it.

10. How long we keep personal data

• Account data: while your account is active. When you delete your account, we delete your profile, posts, chats stored with us and backups within 30 days.
• Chat media: 90 days on Howsit (longer while the sender has Pro), unless deleted earlier.
• Records we must keep by law — for example payment, invoice, tax and accounting records — are kept for the period the law requires (for example under the GST and income-tax laws), even after an account is deleted.
• Security and log records are kept for at least 180 days, as required by the IT Rules and directions of CERT-In.
• Safety records (for example a ban for a serious violation) are kept as long as needed to stop the same person from returning to cause harm.

11. How we protect personal data

• End-to-end encryption of chats (section 4); encryption of all traffic (HTTPS/TLS); locked backups.
• Access to systems only for people who need it, with sign-in checks and logs.
• Regular review of our security practices, consistent with reasonable security practices under section 43A of the IT Act.
• If a personal data breach happens, we will inform the Data Protection Board of India and the affected people as required by the DPDP Act, and report cyber incidents to CERT-In as required.

12. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process about you and how we process it, and the identities of those we have shared it with;
• Correct, complete or update your data — most of it directly in Settings;
• Erase your data — delete your account in Settings → Accounts & Security → Delete my account, or follow these steps;
• Withdraw consent at any time (for example turn off Reels history, backups or notifications); this does not affect what was done before, and some Services may stop working without the data they need;
• Nominate a person to exercise these rights if you die or become unable to;
• Grievance redressal — see section 13.

To use a right, write to support@howsit.in from your registered email, or from the app via Settings → Help & Feedback. We will respond within 30 days. We may need to confirm it is you before acting.

13. Grievance Officer

Under the DPDP Act and Rule 3(2) of the IT Rules, you can contact our Grievance Officer about this policy or about how we process your data:

• Name: Satyabrata Barik
• Address: At/Po-Karanjia, Karanjia, Dist. Mayurbhanj, Odisha 757037, India
• Email: support@howsit.in
• Phone: +91 73377 66156 (Monday to Saturday, 9:00 AM – 7:00 PM IST)

We acknowledge complaints within 24 hours and resolve them within 15 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. Full details: Grievance Redressal.

14. If you live outside India

Howsit is offered worldwide. Wherever you live, you have the rights in section 12. Where your local law gives you more, we honour it:

• European Union, European Economic Area and United Kingdom (GDPR / UK GDPR). We process your data to perform our contract with you (providing the Services), with your consent (which you can withdraw at any time), to meet legal obligations, and for our legitimate interests in keeping Howsit safe and secure. You have the rights of access, rectification, erasure, restriction, data portability and objection, and the right to complain to your local data-protection authority. Transfers of your data outside your region are protected by contractual safeguards such as the European Commission's Standard Contractual Clauses. We do not make decisions with legal or similarly significant effects about you by automated means alone: you can ask for a person to review any automated safety decision.
• United States (including California, CCPA/CPRA). You have the right to know, access, correct and delete your personal information, and not to be treated differently for using these rights. We do not sell your personal information and do not "share" it for cross-context behavioural advertising. We do not knowingly collect information from children under 13.
• Other countries — such as Canada (PIPEDA), Brazil (LGPD), Singapore (PDPA), Australia (Privacy Act 1988), the UAE and others — give you similar rights; write to us and we will help you use them.

To use any of these rights, write to support@howsit.in with the subject "Privacy request". We reply within 30 days (or sooner where your law requires).

15. Changes to this policy

We will post any change here with a new effective date, and tell you in the app before a significant change applies.

16. Contact

Howsit (Registered as a Micro Enterprise under Udyam)
At/Po-Karanjia
Karanjia, Dist. Mayurbhanj
Odisha 757037, India

• Email: support@howsit.in
• Phone: +91 73377 66156
• Hours: Monday to Saturday, 9:00 AM – 7:00 PM IST