Privacy Notice

1. Data categories and purposes

Depending on features you use, Avelry processes email address and verification status, credentials, device/session identifiers, two-factor authentication settings and security challenges; username, profile and eligibility information; posts, media, messages, reactions, follows and other social activity; reports, appeals and moderation records; support or grievance submissions; optional Contact Shield match digests; and, only when payments are enabled, order and financial records. These data support account access, service delivery, safety and moderation, payment processing, support, legal obligations and optional reliability analytics.

2. Providers and disclosures

Service data may be processed by providers used for a feature: PostgreSQL and Redis for account, content, session and queue storage; Google Identity Services when Google sign-in is configured; Cloudinary for uploaded media and Resend for transactional email when configured; LiveKit for live rooms, Razorpay for payments, and browser push delivery only when those features are enabled; a configured OpenAI or Gemini text-moderation integration, and Gemini media moderation when configured, may receive content submitted for moderation. Google sign-in sends its credential to Avelry for authentication; media uploads go to the configured storage provider; transactional messages go to the configured mail provider; and payment, live, push or moderation data is shared only when the corresponding service is configured or enabled. PostgreSQL and Redis are service infrastructure. The browser Contact Picker, when available and invoked, reads selected contacts locally; Avelry receives normalized match values for IRL Shield. Provider contracts, regions and acceptance are not established by this notice.

3. Your controls and rights requests

Settings let you change profile and privacy controls, manage Contact Shield entries, export account data, and request account deletion after password confirmation. Deletion queues cleanup of account data and owned media; it is not a promise that every backup, recipient copy, safety record or legally retained financial record is immediately erased. You may withdraw optional analytics consent at any time in Settings; doing so removes the local telemetry queue and prevents new optional events from being sent. Terms acceptance and age/eligibility verification are separate from optional analytics and marketing; this build does not ask for marketing consent.

4. Retention

Data is kept while needed for the account or feature, until a configured content expiry or deletion takes effect, or while a documented safety, financial or legal hold applies. Some media, messages and Stories have product expiry behavior, but no approved comprehensive retention schedule is currently published. Backups, logs, moderation evidence and payment records may outlive account deletion while cleanup or an applicable retention obligation is pending. The unresolved periods require owner and legal approval before public release.

5. Security and age/eligibility

Authentication uses short-lived access tokens and a server-set HttpOnly refresh cookie; the cookie is Secure in production and its SameSite setting is deployment-configured. Eligibility uses separate verification flows. A date of birth or self-declared age is not described here as independently verified age, and this notice does not claim certification, perfect security, or complete deletion.

6. Moderation, complaints and contact

Reports and grievance submissions may include account identifiers, URLs, descriptions and evidence and are used to review safety, privacy or copyright complaints and document decisions. Use in-product reporting or the grievance portal at /grievance. Privacy questions: yorayriniwnl@gmail.com. General support: yorayriniwnl@gmail.com. Grievance contact: yorayriniwnl@gmail.com. The operator identity and applicable process must be supplied and reviewed before public release. Do not send passwords, authentication codes or emergency requests.

Avelry is operated by Ayush Roy as an individual, Arrah, Bihar, India.
Effective date: development build