Privacy Policy

1. Information We Collect

We collect your mobile phone number for authentication, the display name and avatar you choose, and the password you set (stored only as a salted hash — see §7). We also collect activity data (session duration, ad views, panel responses) to operate the rewards system and detect fraud. At redemption time only, we collect the UPI handle or bank details you supply for that specific payout. We never ask for Aadhaar, PAN, or KYC documents.

The advertising SDKs listed in §3 collect a device advertising identifier(the Android Advertising ID and App Set ID), coarse device and network information, and in-app ad interaction events. This happens on your device and is transmitted directly to those advertising partners. You can reset or delete your advertising ID at any time from Android Settings → Privacy → Ads, and you can opt out of personalised ads there or through the consent prompt shown when you first open the app.

2. How We Use Your Information

• To authenticate your account and issue session tokens
• To calculate and award Spark rewards for ad views and squad activity
• To process reward redemptions (UPI/bank details only at redemption time)
• To detect and prevent ad fraud and reward manipulation
• To serve and measure the reward ads that fund the platform, including selecting which ad to show and limiting how often you see the same one (see §3)
• To send push notifications about squad activity and pot distribution

3. Data Sharing

We do not sell your personal data. We share data only with:

• Firebase (Google) — for phone-number verification at sign-up
• Firebase Analytics (Google) — for aggregate product analytics
• Google AdMob — serves reward ads and runs the ad auction. AdMob mediates the advertising partners below, each of which receives your advertising identifier, coarse device and network information, and ad interaction events when it bids on or fills an ad:
  • Liftoff Monetize (Vungle)
  • Unity Ads
  • InMobi
• Payment partners — only at time of redemption, only with your initiation

These advertising partners use the data they receive to select and measure ads, to cap how often you see the same ad, and to detect invalid traffic. Their own privacy policies govern what they do with it — the links above go to each partner's policy. We do not share your phone number, password, display name, UPI handle, or panel responses with any advertising partner.

4. Cross-Border Data Transfers

Firebase Authentication, Firebase Analytics and Google AdMob are operated by Google, and the advertising partners named in §3 (Liftoff Monetize, Unity Ads, InMobi) are operated by companies headquartered outside India. All of them process data on infrastructure located outside India (primarily the United States and the European Union). By using R.I.S.E you consent to your phone number, advertising identifier and ad-event data being transferred to those processors for the purposes listed in §2 and §3. Application data (your wallet, redemption history, squad membership, panel responses) is stored on servers located in India (Azure South India / Central India regions).

5. Data Retention

Account data is retained for the lifetime of your account plus 30 days after deletion. Activity logs are retained for 90 days for fraud analysis then anonymised. Redemption records are retained for 7 years to satisfy Indian financial-record obligations.

6. Your Rights Under the Digital Personal Data Protection Act, 2023

As a Data Principal under the DPDP Act 2023, you have the right to:

• Access a summary of the personal data we hold about you and how we process it
• Request correction or update of inaccurate or incomplete personal data
• Request erasure of your personal data — initiate this from Settings → Privacy → Delete account in the app; we apply a 7-day grace window before the hard-delete in case you change your mind
• Withdraw consent at any time — withdrawal does not affect the lawfulness of processing carried out before withdrawal
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity
• File a complaint with the Data Protection Board of India if you believe your rights have been infringed

To exercise any of these rights, email support@rise-app.in from the phone number registered to your account. We respond within 30 days.

7. Security

All data is encrypted in transit (TLS 1.3). Your password is never stored in readable form — we keep only a salted BCrypt hash, which cannot be reversed back into your password. Phone-number ownership is additionally verified by a one-time SMS code when you register, when you claim an older account, and when you reset a forgotten password. JWT access tokens expire every 15 minutes, and setting a new password revokes every existing session on all devices.

8. Children

R.I.S.E account creation requires a user to be at least 18 years of age (see Terms of Service §2). We do not knowingly collect personal data from users under 18. If a parent or guardian becomes aware that a child has registered an account, please contact the Grievance Officer below and we will delete the account and associated data.

9. Grievance Officer

In accordance with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, the Grievance Officer for R.I.S.E may be contacted at grievance@rise-app.in. We acknowledge complaints within 24 hours and resolve them within 30 days.

10. Contact

For privacy questions: support@rise-app.in