1. Introduction & Developer Identity
This Privacy Policy describes how VaaStay ("we," "our," or "us"), developed and maintained under the initiative of IITM-Startup, collects, processes, and protects your information when you use our mobile application (Package Name: com.vaastay) and associated web services at vaastay.pages.dev.
By downloading, registering, or using VaaStay, you agree to the collection and use of information in accordance with this policy.
2. Information We Collect
We only collect information necessary to provide seamless housing discovery and direct communication between tenants and property owners:
- Account & Authentication Information: Phone number (used for secure SMS OTP authentication) and optional email address.
- Profile Data: Display name, profile avatar photo (optional), and user role selection (Tenant or Property Owner/Landlord).
- Property Listings (For Landlords/Owners): Property title, description, monthly rent, security deposit, address coordinates, amenities, and uploaded property photographs.
- Communications & In-App Chat: Direct messages exchanged between tenants and owners regarding property availability, visits, and negotiations. Messages are stored securely in our encrypted database.
3. Device Permissions & How They Are Used
To deliver essential features on Android devices, VaaStay may request the following permissions with explicit user consent:
A. Location Permission (ACCESS_FINE_LOCATION & ACCESS_COARSE_LOCATION)
Purpose: Used exclusively in the foreground while you are actively exploring the Map view to center the interactive map on your current location, calculate walking/driving distances to nearby rooms, PGs, and apartments, and suggest relevant listings in your vicinity.
Security Guarantee: We never collect or track your location in the background. Your real-time GPS coordinates are never sold or shared with any advertising networks.
B. Camera Permission (CAMERA)
Purpose: Used strictly when you choose to take live photos of your property to create a listing, or when taking a photo for your profile avatar.
C. Media & Photo Storage (READ_MEDIA_IMAGES)
Purpose: Used only when you choose to select existing photos of rooms, flats, or PGs from your gallery to publish a property listing.
D. Notifications (POST_NOTIFICATIONS)
Purpose: Used to alert you of new incoming direct messages from property owners or prospective tenants, and updates regarding listing verification status.
4. Third-Party Service Providers
We work with trusted infrastructure providers who adhere to strict data security standards:
- Supabase: Provides managed PostgreSQL database, authentication (OTP), and real-time messaging with Row Level Security (RLS) enforcement. Your data is encrypted in transit (TLS 1.3) and at rest (AES-256).
- OpenStreetMap & OsmDroid: Provides open-source, community-driven interactive map tiles and reverse geocoding for privacy-conscious location rendering.
- Coil: Android image loading and caching library to optimize network bandwidth and image rendering.
No Ad Trackers: VaaStay does not include Google AdMob, Meta Audience Network, or any behavioral tracking SDKs. We do not monetize personal data.
5. Data Retention & Account Deletion (Google Play Compliance)
You have full ownership and control over your personal data at all times. If you decide to stop using VaaStay, you can permanently delete your account and all associated data through either of the following mechanisms:
How to Delete Your VaaStay Account & Data
Method 1: Instant In-App Deletion
- Open the VaaStay App on your Android device.
- Navigate to the Profile Tab on the bottom right.
- Tap on Settings & Privacy > Account Security.
- Select Delete Account & All Data and confirm your request.
Method 2: Web / Email Deletion Request
If you have uninstalled the app or cannot access your phone, you can send an account deletion request directly to our team:
- Email: oshielabs.support@gmail.com
- Subject:
VaaStay Account Deletion Request - Include the registered phone number associated with your account.
Upon receiving your request, our automated system purges your profile, property listings, auth credentials, and chat records within 48 hours. A confirmation email/SMS is sent once completed.
6. Security of Your Data
The security of your personal information is of paramount importance to us. We employ state-of-the-art technical protections including:
- Mandatory TLS 1.3 encryption across all network communications.
- Database Row Level Security (RLS) ensuring tenants and owners can only read and write data they are explicitly authorized to access.
- Zero plain-text password storage; all logins utilize secure cryptographic time-based OTPs.
7. Children's Privacy
VaaStay is intended exclusively for college students, working professionals, and property owners aged 18 and older. We do not knowingly collect personal identifiable information from children under the age of 13 (or under 16 in applicable jurisdictions). If we discover that a minor has provided us with personal information, we immediately delete such data from our servers.
8. Changes to This Privacy Policy
We may update our Privacy Policy periodically to reflect new app features or regulatory requirements. We will notify you of any material changes by posting the new policy on this page with an updated "Effective Date" and notifying active app users via in-app banner.
9. Grievance Redressal & Statutory Disclosures
In compliance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023 (DPDP Act), VaaStay has designated a statutory Grievance Officer:
Mauchum Datta Lahkar
Designated Officer under IT Rules 2021 & DPDP Act 2023