Privacy Policy — Tribal Hearts

Operator: Gariba IT Services Pvt Ltd ("we", "us", "our"). Product: Tribal Hearts mobile application ("the App") and the related website at https://merming.garibaitservices.com. Effective date: 26 August 2026. Last updated: 4 October 2026.

This document is a plain-language privacy notice. It covers the Android app and the iPhone app. It is also the formal privacy policy required by Google Play, the Apple App Store, India's Digital Personal Data Protection Act 2023 ("DPDP Act"), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011. If anything in this document is unclear, write to admin@garibaitservices.com and we will reply within 7 working days.

1. Who we are

Tribal Hearts is a matrimonial mobile app made for members of India's Scheduled Tribe communities. We are a small team based in India and we operate as Gariba IT Services Pvt Ltd (the "Data Fiduciary" under the DPDP Act). The app is published on Google Play (Android) and on the Apple App Store (iPhone) under the identifier com.garibaitservices.tribalheart.

2. What information we collect

We do NOT collect: card or UPI numbers (Google Play handles checkout on Android — we never see them; purchases are currently available only in the Android app, and the iPhone app collects no payment information), continuous background location, contact lists, SMS contents, browsing history outside the app, or your phone-call logs.

3. Sensitive personal data

Under the DPDP Act and the IT Rules 2011, the following items count as sensitive personal data when stored by us:

• Images of your government ID, caste / tribe certificate, income proof and address proof.
• Photographs and voice / video recordings.
• Caste / tribe / community membership.

We treat these with extra care:

• Verification documents are visible only to our trained reviewers during the manual verification process. They are never shown to other users, never used in matchmaking, and never sold to third parties.
• Documents are stored in private, encrypted cloud storage and open only through links that expire within a minute. Reviewers lose access to them 24 hours after the decision on your case, and they are deleted from storage within 48 hours of that decision. If you delete your account first, they are deleted with it.
• Tribal identity (tribe / sub-tribe / language) is shown in your public profile only because that is the entire purpose of the product. You can choose to mark your tribe as "Prefer not to say" — your account still works, but match quality will be lower.

4. How we use your information

• Match-making: filter, rank, and surface profiles that match each user's stated partner preferences.
• Verification: our team checks your government ID and caste / tribe certificate by hand (and, at the higher levels, your income and address proof) before you can open full profiles or chat. There is no selfie or liveness check.
• Communication: deliver and store chat messages, voice notes, and call signaling between matched users.
• Safety and moderation: process block + report actions; investigate abuse and respond to law-enforcement requests (only with valid legal process). Automated checks screen chat messages, status text, profile text and voice-note transcripts for scams, abuse and shared contact details; anything flagged may be hidden and is reviewed by our team. This is done by an outside AI service (named in Section 5). You agree to these checks on the one-time agreement screen the first time you use the app.
• In-app guide and writing help: when you chat with the in-app guide, or ask for help writing your profile, a first message, an interest message or a reply, what you type is sent to an outside AI service to produce the answer. For a suggested reply, the last few messages of that chat are sent, and only when you ask for a suggestion. The writing helpers ask for your agreement before their first use, and you can say "Not now".
• Push notifications: deliver alerts for new messages, calls, matches, verification status updates. On iPhone these are delivered through Apple's push notification service.
• Diagnostics: receive crash reports from the app (through Google) so we can fix bugs quickly. Crash reports contain device metadata and a stack trace, not your chat content.
• Service operations: on Android, Google Play processes the payment when you buy Premium and we receive the purchase record so we can switch your plan on. Purchases are currently available only in the Android app; the iPhone app is free.
• Ads (free members on Android): if you use the free plan on Android, you may see a small, clearly marked "Ad" banner on the Home screen and in Settings. These ads are non-personalised: they are not chosen from your profile, tribe, community, chats or verification. Premium members and iPhone users see no ads, and no ads are shown in chats, other members' profiles, verification, status, sign-in or payment screens. The ad banner is also switched off if you turn on the app's data saver option.

We do not use your profile data for advertising or profiling for marketing, and we do not sell personal data. Free members on Android may see non-personalised ads served by our ad partner (Section 5). No profile, tribe, caste, chat or verification information is ever shared for ads. Premium members and iPhone users see no ads.

Your ad choices. The advertising ID is a number on your Android phone that you control. To reset it or delete it, open your phone's Settings → Google → Ads (on some phones Settings → Privacy → Ads) and choose "Reset advertising ID" or "Delete advertising ID". You can also upgrade to Premium to see no ads.

5. Whom we share your information with

We are not in the business of selling personal data. If we ever expand this list, we will update this page and notify in-app.

6. Where your data is stored

• Account, profile and chat data: our servers in India.
• Photos, voice notes, videos and documents: Amazon Web Services, in India. Some older files from before we moved our storage to India are still held by Backblaze in the United States until we delete them.
• Email delivery: Resend.
• Sub-processor data flows: enumerated in Section 5.

Some companies listed in Section 5 work outside India: Google and Apple (push notifications, crash reports, sign-in and, for free Android members, ads), Resend (email), Groq (automated safety checks, the in-app guide and the writing helpers), LiveKit (calls) and Backblaze (older files, until deleted). By using Tribal Hearts you consent to the limited cross-border transfer these services need in order to work.

7. How long we keep your data

8. Your rights

You can do all of the following from inside the app at Settings → Security and devices:

• Access: see the data we hold about you via your profile screen.
• Correct: edit any profile field at any time.
• Pause: hide your account from everyone until you sign in again.
• Delete: ask for permanent deletion. Your profile is hidden at once, and the account is deleted 30 days later unless you sign in again before then (see the Data Deletion Policy).
• Portability: write to admin@garibaitservices.com and we will send you a machine-readable export of your data within 30 days.
• Withdraw consent: stop using the app at any time. Specific consents (e.g. location share in chat, notifications, camera) can be revoked from your phone's settings. To withdraw your agreement to the automated safety checks, delete your account or write to us. The optional writing helpers are used only when you ask for them.
• Ads: on Android, reset or delete your advertising ID in your phone's Settings → Google → Ads, or choose Premium to see no ads.

You also have the right to lodge a complaint with the Data Protection Board of India once it is constituted under the DPDP Act.

9. Children

Tribal Hearts is not intended for users under 18. The app rejects account creation if the entered date of birth puts the user under 18. If you believe a minor has created an account, please email admin@garibaitservices.com with the profile ID and we will investigate and remove it within 24 hours.

10. Security

• All API and WebSocket traffic uses HTTPS / WSS.
• Passwords and OTP secrets are never logged.
• Refresh tokens are bound to a server-side session and rotated on use.
• Government-ID documents sit behind 60-second signed URLs and are visible only to authenticated reviewers.
• Photographs use 5-minute signed URLs.
• We run a defence-in-depth program: rate-limited APIs, daily SMS caps, CORS lockdown, structured logs, automated crash alerts.

No system is perfectly secure. If you suspect your account is compromised, change your sign-in mobile number (via support) and use log out of all other devices under Settings → Security and devices.

11. Grievance Officer (mandatory under IT Rules 2021)

In compliance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021:

• Name: Vansh Bahadhur Dhurve
• Email: vansh.d@garibaitservices.com (role mailbox: admin@garibaitservices.com)
• Phone: +91 91711 79201 (Mon–Sat, 10:00–18:00 IST)
• Postal address: Gariba IT Services Private Limited, C/O Shiv Kumar Dhurve, Pindrai Kalan, Barghat, Seoni, Madhya Pradesh, 480667, India
• Acknowledgement window: 24 hours.
• Resolution window: 15 days.

You can reach the Grievance Officer for any complaint about content, account treatment, or this Policy.

12. Changes to this policy

We will update this page when we change how data is handled. Material changes will trigger an in-app notice the next time you open the app. The "Last updated" date at the top of this page is the authoritative version.

13. Contact

• General support: admin@garibaitservices.com
• Privacy questions: admin@garibaitservices.com
• Grievance Officer: admin@garibaitservices.com

You can also write to us inside the app under Settings → Help & Support. We aim to reply within 3 working days.