ShuffleIn is published by TINYANGLESTUDIO (OPC) PRIVATE LIMITED ("TinyAngle Studio", "we", "us"), a company registered in India (CIN U62010PN2026OPC255673). This policy explains what ShuffleIn collects, why, who it goes to, how long we keep it, and how you can get it deleted.
1. Information we collect
a. Account
- Sign in with Google or Apple - we receive your name and email address from the provider, and a unique identifier. We never see your Google or Apple password. With "Sign in with Apple" you may hide your email, and we then receive Apple's relay address instead.
- Email and password - used only for accounts we create for app-store reviewers and testing. Passwords are never stored in readable form.
b. Profile
Your display name, an optional profile photo, an optional short bio, and the name of your area (for example a neighbourhood) if you add it. Other people see these.
c. Approximate location
To show you items near you, the app asks for your location once, with your permission, and whenever you choose to update it. Before it is stored, the point is rounded to a grid of roughly one kilometre. We never keep your exact position, and nobody - not other users, not us - sees an address. Other users see a distance ("about 2 km away"), never a place. We also store your device's time zone so reminders arrive at sensible hours and monthly limits reset on your own calendar.
d. Items and photos
The photos (one to four per item), name, category, condition, description and "what I would like in return" of each item you list. Photos are stored on our photo host and are visible to anyone who has the photo's address, because other users must be able to see them; the addresses are random and are not listed anywhere.
e. Swipes, matches and chats
Which items you passed or were interested in; your matches; and the messages and photos you send in a chat. Messages are stored so that both people can read the conversation on any of their devices. A message you "delete for me" disappears for you only; the other person keeps their copy, exactly like a letter you have sent.
Automatic word check. Before a text message is delivered, our server runs a word rule over it to spot talk of money (words such as "pay", "UPI", a payment app, or an amount) and stores the result ("soft" or "strong") with the message. The rule shows a reminder to the sender, who decides whether to send, and a safety notice to the other person. It never blocks a message, and no person reads chats for this. Listings are checked the same way for banned items when you post or edit them. No other analysis of your messages takes place.
f. Blocks, reports and standing
Who you have blocked, and any report you make (the reason, your note, and the item, person or chat it is about). When a chat is reported, or the word check has marked messages in it, a member of our team may read the last lines of that chat to decide what to do.
Ratings. After both people mark a Shuffle as done, each may rate the other once (1 to 5 stars, quick tags, an optional note of up to 200 characters). Your rating of someone is shown to them and to other users as part of their average once they have rated you too, or after 7 days.
Automatic flags. If three different people block or report an account within 30 days, or an account sends three "strong" money messages in that time, the account is marked for review: its items are hidden from new people and a member of our team looks at it. At five different people the account is paused until that review is done. The person sees the reason in the app and can appeal (section 6a). We keep a record of every such step: what was done, by whom (or that it was automatic), why and when.
g. Notifications
If you turn notifications on, we store a push token for your phone so we can tell you about a new match, a new message, or a match waiting for a hello. The token is removed when you sign out or delete your account.
h. Subscription status
If you buy Premium, Google Play or the App Store handles the payment, and our subscription provider (RevenueCat) tells us only which plan you have, when it renews or ends, and a store receipt reference. We never receive your card number, bank details or billing address.
i. What we do NOT collect
- No precise location, and no location in the background
- No contacts, calendar, SMS, call logs, files or other apps on your device
- No advertising identifiers, device fingerprints or cross-app tracking
- No payment card details
- No analytics or crash-reporting software inside the app
This website counts page visits with Vercel Web Analytics, which uses no cookies and does not identify you.
2. Why we use it
| What | Why | Legal basis (DPDP / GDPR) |
|---|---|---|
| Sign-in details | Create and secure your account, sign you in | Performance of a contract |
| Profile, items, photos | Show your items to people nearby - the whole purpose of the app | Performance of a contract |
| Approximate location | Show you items within your chosen distance, and show others roughly how far away you are | Your consent (the location permission), which you can withdraw in your phone's settings |
| Swipes, matches, chats | Make matches, open chats, keep the conversation available on your devices | Performance of a contract |
| Blocks and reports | Keep the service safe; act on abuse; keep a record of what was done and why | Legitimate interest in a safe service; legal obligations |
| Ratings | Show other users how Shuffles with you went, so people can decide whom to meet | Performance of a contract; legitimate interest in a trustworthy service |
| Automatic word check and flags | Warn about money in chats, hold banned-item listings, and bring accounts that several people have blocked or reported to a person's attention | Legitimate interest in a safe service; legal obligations as a platform (India IT Rules, EU Digital Services Act) |
| Push token | Send the notifications you turned on | Your consent (the notification permission) |
| Subscription status | Unlock Premium and keep it unlocked on every device you sign in on | Performance of a contract |
We do not use your data for advertising, for profiling for marketing, or for automated decisions that have a legal effect on you. The automatic flags described in section 1f only hide items or pause an account until a person has looked; a person makes every decision that lasts, and you can ask for a human review at any time (section 6a).
3. Who sees what
Other users see your display name, profile photo, bio, area name, your approximate distance from them, how many Shuffles you have done, your average rating and how many ratings it is made of, the month you joined, a "Highly rated" or "New" mark where it applies, and your active items. People you match with also see the chat between you. Nobody sees your email address, your sign-in provider, or your location beyond a rounded distance.
We do not sell your personal data, and we do not share it with advertisers, data brokers or social networks. We use a small number of service providers who process data strictly on our instructions, under contract:
| Provider | What it handles |
|---|---|
| Supabase (database and sign-in; hosted in Mumbai, India) | Your account, profile, items, swipes, matches, messages, blocks and reports are stored here on our behalf. |
| Cloudflare (photo storage and delivery) | Item, profile and chat photos, served from Cloudflare's network near the viewer. |
| Expo, Google (Firebase Cloud Messaging) and Apple (APNs) | Deliver push notifications to your phone. They receive the push token and the short text of the notification. |
| Google and Apple (sign-in) | Confirm who you are when you sign in with your Google or Apple account. Their own privacy policies apply to that step. |
| RevenueCat (subscriptions) | Receives your subscription status, the store's receipt token and our internal user id. It never receives your email, messages or photos. |
| Resend (account email) | Sends the emails your account needs, such as a sign-in confirmation. It receives your email address and the message we send, nothing else. |
| Google Play / Apple App Store | Distribution, and the payment for Premium. Their own privacy policies apply. |
| Vercel (this website) | Hosts this website and counts visits without cookies. |
We may also disclose information where we are legally required to, to respond to a lawful request from law enforcement, or to establish or defend legal claims. If TinyAngle Studio is ever acquired or merged, data may transfer to the successor entity, which will remain bound by this policy or one no less protective; we will tell you first.
4. International transfers
We are based in India, and your account data is stored in India. Photos are delivered from Cloudflare's worldwide network. Push notifications, sign-in and subscriptions are handled by providers in the United States. Where data leaves the EU or UK we rely on the European Commission's Standard Contractual Clauses with those providers. Whichever country it sits in, the protections in this policy still apply.
5. How long we keep it
- Account, profile, items, photos, matches and messages - for as long as your account exists. An item you remove, and its photos, are deleted straight away. A match that nobody opens for 3 days expires and is closed.
- Chats - a message you delete for yourself is hidden from you at once; clearing a chat hides the older messages for you. The other person's copy stays until they delete theirs or their account.
- Reports and blocks - for as long as the accounts involved exist, so that repeated behaviour can be recognised.
- Ratings - for as long as both accounts exist. A rating you gave is deleted with your account; a rating you received is deleted with the other person's account.
- Moderation record (what was held, removed, flagged, paused or suspended, why and when) - for as long as the account exists and for one year after it ends, in a form that no longer carries your name or email, so that appeals and lawful requests can be answered.
- Notification log - a short technical record of each notification we sent (who, when, whether it was delivered) for 30 days, to fix delivery problems.
- After you delete your account - everything above is removed from our live systems immediately when you delete in the app, or within 30 days of an email request, and from encrypted backups within 30 days after that. We keep nothing except what the law requires us to keep (for example a record of a purchase for tax purposes).
6. Your rights, and how to delete your data
You can, at any time:
- See and change your profile, your items and your location from inside the app
- Turn location or notifications off in your phone's settings
- Ask for a copy of your data
- Correct anything that is wrong
- Nominate another person to exercise these rights on your behalf if you die or become unable to (India's DPDP Act, section 14): email us with their name and contact details
- Ask us to delete your account and all data in it
- Complain to your data protection authority - in India, the Data Protection Board; in the EU/UK, your national supervisory authority; elsewhere, the privacy regulator for where you live
These rights are given to you under India's Digital Personal Data Protection Act 2023 and, where they apply to you, the EU/UK GDPR, US state privacy laws such as the California Consumer Privacy Act, and the privacy law of the country you live in. We give everyone the same rights regardless of where they live. We do not sell or share personal information for advertising, and we do not discriminate against anyone for exercising a privacy right. We answer any request within 30 days and we do not charge for it.
6a. Automatic flags, and asking a person to look
Some safety steps in ShuffleIn start automatically: the money reminder in chats, the hold on a listing that mentions a banned item, and the flag or pause that follows blocks and reports from several different people (section 1f). None of these is a final decision. A member of our team reviews every flagged account, held listing and report, and only a person can suspend an account. If your items were hidden, your account was paused or suspended, or an item was removed, you see the reason in the app. To contest it, email support@tinyanglestudio.com with the display name on your account; we acknowledge within 24 hours and answer, with reasons, within 15 days. Where the EU/UK GDPR applies to you, this is also how you exercise your right to human review of an automated decision.
7. Adults only
ShuffleIn is for people aged 18 and over. You confirm your age when you set up your account. We do not knowingly create accounts for anyone under 18; if you believe a minor is using ShuffleIn, write to us and we will remove the account. Our child safety standards explain how we handle any report involving a minor.
8. Security
All traffic between the app and our servers is encrypted with HTTPS/TLS. Data is encrypted at rest by our hosting providers. Access to the database is restricted per user by row-level security rules, so one account cannot read another's data, and every change goes through server-side checks. Staff access to production data is limited to the people who run the service. No system is perfectly secure, but if a breach ever affects your personal data we will notify you and the relevant authority as the law requires, including the Data Protection Board of India under the DPDP Act and Rules.
9. Changes to this policy
If we change this policy we will update the date at the top, and for anything significant we will tell you in the app before the change takes effect. Continuing to use ShuffleIn after that means you accept the updated policy.
10. Contact us
TINYANGLESTUDIO (OPC) PRIVATE LIMITED
Pune 411033, Maharashtra, India
CIN: U62010PN2026OPC255673
Privacy and data requests: support@tinyanglestudio.com
Website: www.tinyanglestudio.com
Grievance Officer: the Director, TINYANGLESTUDIO (OPC) PRIVATE LIMITED, at support@tinyanglestudio.com. We acknowledge every complaint within 24 hours and resolve it within 15 days.
We are the data controller (data fiduciary) for the information described here. We have not appointed a Data Protection Officer, as we are not required to; write to the address above for any privacy matter.