LEGAL

Privacy Policy

Last updated 10 October 2026 (version 2026-10-10)

This policy explains what personal data Dtour collects, why, who it's shared with and the choices you have. Dtour is operated by Dtour, India ("we"). Contact: [email protected].

What we collect

• Account: your email address and a securely hashed password, or the account ID Google or Apple gives us if you sign in with them (with Sign in with Apple you can hide your email).
• Profile: name, username, optional photo and bio, home city, cities you know, and interests you pick.
• What you post: recommendations (place, your take, tips, tags), photos, reviews, comments and reports.
• Activity in the app: places you save, upvote or skip, people you follow or block, which recommendations were shown to you and which you looked at. We use this to rank your feed and the leaderboard.
• Location: only if you allow it, your phone's location is sent with Discover and Leaderboard requests so we can show the city you're in. We use it for that request only: we don't store it with your account or keep a location history, and it is removed from our logs.
• Device and notifications: a push-notification token for your phone (if you allow notifications) and its platform (iOS or Android).
• Technical data: IP address (for security and rate limiting), app version and anonymous crash reports. Our logs record requests without your location, email or passwords and are deleted after 30 days.
• Product analytics: anonymous events such as "opened a place" or "shared a link", without your name, email or what you wrote.

How we use it

• To run Dtour: your account, posting, saving, following, notifications and share links.
• To personalise and rank what you see, and to decide which city to show.
• To keep Dtour safe: moderation, spam and abuse prevention, rate limits and login protection.
• To send you service emails, such as verification and password-reset codes. We don't send marketing email without your consent.
• To understand what works and fix problems.

Our legal basis is your consent (which you give when you sign up and can withdraw by deleting your account) and the legitimate uses permitted under the Digital Personal Data Protection Act, 2023.

What other people can see

Your name, username, photo, bio, home city, the recommendations and notes you post, and your upvote and follower counts are public in the app, and a recommendation you or others share can be opened by anyone with the link. Your email address, saved places, location and blocks are never shown to others.

Who we share data with

We don't sell personal data and we don't share it for advertising. We use these service providers, only to run Dtour and only with the data they need:

• Amazon Web Services (hosting, database and photo storage, Mumbai region)
• Cloudflare (network security and delivery)
• Google (Sign in with Google; Google Maps place search and details)
• Apple (Sign in with Apple; push notifications on iOS)
• Expo (delivering push notifications)
• Resend (sending verification and password-reset emails)
• Groq (reads the text of recommendations to suggest tags; it receives the text only, not who wrote it)
• PostHog (anonymous product analytics) and Sentry (crash reports, without personal data)

Some of these providers process data outside India, under contracts that protect it. We may also disclose data when the law requires it, or to protect people's safety.

How long we keep it

• Account and profile data: until you delete your account.
• When you delete your account we remove your email, sign-in, profile details, saves, follows, blocks, interests, activity history and notifications straight away. Recommendations and notes you published stay up as "Former local", with no name or photo.
• Database backups are kept for up to 14 days, and logs for up to 30 days, then deleted.

Your rights and choices

• Access and correction: see and edit your profile in the app (Me → Edit profile), or ask us for a copy of your data.
• Deletion: Me → Delete account, or see dtour.co.in/account-deletion.
• Location and notifications: turn them off any time in your phone's settings or in the app.
• Grievances and nomination: you can raise a complaint with our Grievance Officer, nominate someone to exercise your rights, and complain to the Data Protection Board of India.

Write to [email protected] from the email on your account; we reply within 15 days.

Children

Dtour is for people aged 18 and over. We don't knowingly collect data from children; if you believe a child has an account, tell us and we'll delete it.

Security

Data is encrypted in transit and at rest, passwords are hashed with Argon2, and access to production systems is restricted and logged. No system is perfectly secure; we'll notify you and the authorities of a breach as the law requires.

Changes

We'll update this page when the policy changes and tell you in the app about significant changes.

Contact and Grievance Officer

Dtour, India. Email [email protected]. Grievance Officer: [NAME], [email protected].