Privacy Policy

Privacy Policy

Last updated: 2026-09-01

This policy explains how Zocane uses personal data when you use our website or Android app in India. The Android app is a Zocane-controlled web experience delivered in a native shell, so this policy covers both surfaces.

Data We Collect

• Account and contact data: name, phone number, email address when supplied,
• account identifier, profile preferences, authentication records, and privacy
• or communication choices.
• Order and delivery data: items, carts, order and payment status, recipient
• name and phone number, delivery address, delivery instructions, and address
• coordinates or device location when you choose to use location or the map
• picker.
• Content you provide: greeting messages, thank-you notes and photos,
• support requests, and messages associated with shared carts.
• Payment data: payment references, status, amount, and method details needed
• to process an order. Razorpay collects the payment credentials you enter in
• its checkout. Zocane does not store full card numbers, UPI PINs, or bank
• credentials.
• Contacts you choose: after you tap Sync Contacts and grant permission,
• the Friends feature can read your address book or use a device Contact Picker
• where available. Contact names and your address-book snapshot stay in
• account-scoped storage on that device. Normalized phone numbers are sent over
• an encrypted connection for exact matching. Zocane may retain a server-only
• hashed lookup linked to the matched member; it does not retain unmatched
• contact names or your uploaded address book as a server-side contact list.
• Friend Codes and social relationships: Zocane assigns one public Friend
• Code to an account. We record exact-code searches subject to security limits,
• accepted friendships, creator follows, blocks, referral attribution, and
• referral reward milestones. Friend Code results contain only a limited display
• identity and gifting-readiness state, never a phone number, email address,
• birthday, delivery address, or notification token.
• Creator review data: a registered user applying as a creator provides a
• category, primary platform, verification URL, and approximate audience range.
• The account name is supplied from the Zocane account. These application fields
• are private to the applicant and authorised review team. If approved, Zocane
• controls the public creator name, avatar, category, and verification state.
• Creators cannot publish a public biography, link, post, caption, or comment
• through the creator profile.
• Technical and usage data: device and app identifiers, Firebase Cloud
• Messaging token, session identifiers, IP-derived service and security
• information, pages and features used, search terms, referral-link attribution,
• crash or reliability signals, and consent choices.

Friend And Creator Discovery

Phone discovery is enabled by default for registered accounts and can be turned off at any time under Account > Privacy. A signed-in person must search an exact phone number; Zocane does not provide a browsable phone directory. For an approved creator, phone matching can create a mutual friendship when phone discovery is enabled.

A Friend Code supports exact account lookup without sharing a phone number. A non-creator code can be used to add a mutual friend. An approved creator's code creates only a one-way Follow. Following permits private gifting but does not give the follower access to the creator's phone number or delivery address.

Friend Codes are generated by Zocane. A user cannot select or routinely rotate a code. If a code is exposed, inappropriate, or abused, the account holder may ask Support to review an exceptional replacement. An authorised administrator must use the account holder's support ticket and record a reason. The old code is permanently retired and never reassigned. Existing friends, followers, points, orders, and already-recorded referral attribution remain attached to the account.

Approved creators remain ordinary Zocane users and retain all ordinary account features. Creator gifting and new-follower notifications are enabled at approval and can each be turned off. A creator can leave the creator program without deleting the underlying Zocane account.

Why We Use Data

We use data to create and secure accounts, provide friend and creator discovery, operate private gifting and referrals, process payments and orders, arrange delivery, provide customer support, prevent fraud and abuse, comply with legal obligations, and improve the service.

Analytics is optional. Zocane records product analytics and, when configured, sends analytics to Mixpanel only after you opt in. We use GrowthBook for feature configuration. Promotional SMS, WhatsApp, email, and push preferences are separate from phone discovery and can be changed independently.

When We Share Data

We do not sell personal data or use advertising SDKs. We share only the data needed for the following services:

• Google Firebase and Google Cloud for authentication, database, storage,
• app security, push notifications, and hosting.
• Google Maps Platform when you use map, address search, geocoding, or
• location features.
• Razorpay to process payments and refunds.
• Twilio, MSG91, and Resend when used to send transactional SMS, WhatsApp,
• or email communications.
• Delivery providers, including Porter when selected for an order, to fulfil
• and track delivery.
• Mixpanel and GrowthBook only as described above and subject to the
• applicable controls.

We may also disclose data where required by law, to protect people or the service, or in connection with a business transfer.

Your Choices And Rights

Every registered user, including an approved creator, can use Account > Privacy to:

• correct profile and address information;
• turn phone discovery off or on;
• change analytics and communication choices;
• download an account-data bundle;
• request account deletion; and
• contact Support about a privacy request or grievance.

Account deletion has a 30-day grace period. When deletion becomes due, Zocane removes user-owned profile, address, social, creator, discovery-index, support, notification, wishlist, and subscription records. A retired Friend Code is kept only as an inactive, non-reusable tombstone and its owner link is removed. Order, payment, store-credit, tax, invoice, fraud-prevention, security, and audit records may be retained for their applicable legal or operational purpose. Retained order delivery data is anonymised where required.

Leaving the creator program is separate from account deletion. It removes the creator application, creator profile, and creator-owned follower connections, but does not remove the ordinary account, mutual friendships, orders, addresses, referrals, or loyalty history.

Children And Teens

Zocane is not directed to children under 13. People aged 13 to 17 may use Zocane only with a parent or legal guardian's involvement and subject to any consent verification required under Indian law. Contact us if you believe a child has provided personal data without the required involvement or consent.

Security And Contact

We use access controls, encryption in transit, rate limits, audit records, and other safeguards appropriate to the service. No system is completely secure. For privacy questions, correction, access, deletion, consent withdrawal, or a grievance, use the Contact & Grievance page or Account > Privacy.

This policy is intended for Zocane's India service and reflects the product's data controls under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. It should be read with Zocane's Terms of Service, Cookie Notice, and Contact & Grievance policy.