Privacy Policy

HoiHoi privacy policy: what the website and app collect, how it is used, who it is shared with, how long it is kept, your choices and rights, and how to delete your account. HoiHoi does not sell personal data or use it for third-party advertising.

HoiHoi is a guide to West Bengal: Durga Puja pandals and the Panjika, destinations, Kolkata, food, festivals and travel. This policy explains what the HoiHoi website (hoihoi.in) and the HoiHoi mobile app collect, why, how long we keep it, and the choices you have. We ask before collecting device and location data, we do not sell personal data, and we do not use it for third-party advertising.

Who we are

HoiHoi is operated by HoiHoi Digital, based in Kolkata, West Bengal, India. For the purposes of Indian data-protection law, HoiHoi Digital decides how and why the personal data described here is used.

This policy covers the website hoihoi.in and the HoiHoi app for Android and iOS. It does not cover other websites or apps that we link to.

What the website collects

You can read the whole website without an account. It collects very little:

Analytics, only if you allow it. The consent banner asks before Google Analytics is loaded. If you choose “No thanks”, nothing is sent to Google Analytics. Your choice is remembered in your browser’s local storage, and you can switch analytics off at any time by opening any page with ?notrack=1 added to the address.
“Notify me” form. The name and mobile number you enter, and whether you are a visitor or a business, used only to tell you about the app launch.
Account-deletion form. The email address you enter, used only to find and delete your account.
Technical records. Our hosting provider keeps standard server records such as IP address, browser type and the page requested, to deliver the site and keep it secure.

The website does not use advertising cookies. Fonts are loaded from Google Fonts, which means your browser contacts Google to fetch them.

What the app collects

Much of the app works as a guest. When you sign in or use the features below, we collect:

Account. Your name, email address and profile picture from Google Sign-In. We never see your Google password. We email that address only about important things on your own account: a welcome when it is created, a sign-in on a phone it has not been used on before, account deletion, requests you send us, and what happened to photos you sent. We do not send marketing emails.
Sign-in phones. When you sign in, the app sends a random ID made for this install of HoiHoi and the phone’s make and model, so we can email you if your account is signed in on a new phone. We keep only a scrambled (hashed) form of the ID, which cannot be turned back into it, and delete it with your account.
Location. Used while the app is open to show nearby pandals and places, distances, maps and routes. If you choose “Allow” on the data notice, your precise location is also sent to us every few minutes while HoiHoi is open on your screen. We never collect location when the app is closed or in the background.
Device and network. If you choose “Allow” on the data notice, whether or not you sign in: your phone’s make and model, system version, app version, language, time zone and screen size, a random ID created for this install of HoiHoi (not your phone’s hardware or advertising ID), and the IP address you connect from, each time you open the app.
Group location sharing. Only if you switch it on in a group, your last location is shown to the members of that group until you switch it off.
Saved items. Pandals and places you save or mark as visited, trips you plan, and your progress and preferences in the app.
Groups. Groups you create or join, and the posts, photos and shared-expense (bill split) entries you add to them, including the amounts and who paid. These are kept with your account so they come back when you sign in on another phone.
Community posts. Posts, photos, comments and likes you publish, shown with your name and profile picture, and any reports you file about other people’s content.
Place ratings. The stars (1 to 5) you give places, pandals and destinations. Only the average and the number of ratings are shown to others, never who gave them. They are kept with your account and deleted with it.
Festive Challenge. Photos you enter, the likes they receive, and your Pujo Passport check-ins, including your precise location at the moment of each check-in so that it can be verified. Your first name and entry appear on the challenge leaderboards.
SOS. If you open SOS, we record that it was opened and where you were at that moment. HoiHoi does not dispatch emergency services.
Notifications. If you allow notifications, whether or not you sign in: a push token for your phone, stored encrypted, so that we can send you HoiHoi announcements and the notifications you have allowed. To stop them, turn off notifications for HoiHoi in your phone’s settings; the token is then removed the next time you open the app, and tokens from phones that have not opened HoiHoi for 180 days are deleted.
Activity. Screens you open, searches you make and actions your signed-in account performs, with the time, IP address and device type, to keep the service secure and fair and to understand which features are used.
Photos and camera. Only the pictures you choose or take inside the app to post. The app does not read the rest of your gallery and does not use the microphone.
Photos you send for a place. When you offer a photo of a place, we read the details stored inside the photo file (camera or phone model, date taken, the app that saved it, and any author or copyright note) and make a fingerprint of the picture, so that our team can check the photo is your own and has not been copied. These details are stored encrypted, are seen only by HoiHoi staff, and are deleted with your account. If the file holds the place where it was taken, we note only that it did and never keep the location. The copy of the photo we store and show has all of these details removed.

If you enquire about a sponsored listing or advertising, we also keep the business name, contact person, phone number, email address and any GST number you give us, to respond to the enquiry.

If you send a “Plan my journey” request, we keep your name, phone number, any email address, and the trip details you enter (dates, group, interests, budget and message), only to plan your trip with you.

Contact details sent with these requests are stored encrypted and are seen only by HoiHoi staff who follow up the request.

How we use it

To provide the features you use: nearby results, maps, saved lists, groups, community posts and the Festive Challenge.
To send notifications you have allowed.
To verify challenge entries and check-ins and show results.
To keep the service safe: preventing abuse, reviewing reported content and investigating misuse.
To understand, in aggregate, which pages and features are useful, and which phones, app versions and areas use HoiHoi, so that we can improve it and plan crowd and route information.
To meet legal obligations.

We rely on your consent, which you give by choosing “Allow” on the data notice, signing in, switching on a feature or granting a permission, and on the legitimate uses the law allows, such as security and legal compliance.

Who we share it with

We do not sell personal data and we do not share it for third-party advertising. It is shared only with:

Google, for Sign-In, maps, fonts and, on the website with your consent, Analytics.
Expo, to deliver push notifications and app updates.
Hosting and infrastructure providers that run our website, servers and database on our behalf.
Other HoiHoi users, for the things you choose to make visible: community posts, challenge entries and leaderboards, and what you share inside a group.
Authorities, when the law requires it or when it is necessary to protect someone’s safety.

These providers may process data on servers outside India. Each handles data under its own privacy policy.

How long we keep it

Account, saved items, groups and posts: while your account is active, or until you delete them.
Activity records, screens opened and searches: removed after 180 days.
Device details, IP addresses and location history: kept while your account is active and deleted when you delete your account. If you never sign in, they are kept until you ask us to delete them.
SOS records: kept for 365 days as a safety log.
“Notify me” details: until the app has launched and you have been told, or until you ask us to remove them.
Deletion requests: carried out within 30 days; the request itself is kept as a record that it was handled.

We may keep specific data for longer where the law requires it, or where it is needed to resolve a dispute or investigate fraud or abuse.

Your choices and rights

Permissions. You can refuse or withdraw location, camera, photo and notification permissions in your phone settings. The core directory still works; maps, nearby distances, photo upload and notifications will not.
Device and location data in the app. Choose “Not now” on the data notice, or switch off “Share device & location data” in the app’s Settings at any time. Nothing more is collected after that.
Analytics. Choose “No thanks” in the consent banner, or use ?notrack=1.
Access and correction. Ask us for a copy of the personal data we hold about you, or to correct it.
Deletion. Delete your account in the app, ask us using the form below, or delete your phone’s device and location data from the app’s Settings.
Withdrawing consent. You can withdraw consent at any time; it does not affect what was done before you withdrew it.
Nomination and complaints. You may nominate another person to exercise your rights if you are unable to, and you may complain to us and, if you are not satisfied, to the Data Protection Board of India.

Deleting your account

In the app, open Settings → Delete my account. Your account is closed and you are signed out straight away, nothing more is collected, and our team then permanently deletes the account and its data within 30 days. If you cannot open the app, use the form at the bottom of this page with the Google email of your account; we verify ownership before deleting.

Deletion removes your profile, saved places and trips, group memberships, group posts and expenses, community posts with their comments and likes, place ratings, challenge photos and check-ins, comments, likes, follows, notifications, push tokens, activity records, and the device details, IP addresses and location history recorded from your phones. Groups you created are handed over to another member.

Device and location data without an account. In the app, open Settings and switch off “Share device & location data”, then choose to delete it. Collection stops straight away and everything recorded from that phone is permanently deleted within 30 days.

We keep a record that each deletion request was made and handled (the date, and the email address for account requests), as proof that we carried it out. Deleting your HoiHoi account does not delete data held independently by Google or other services.

Security

Data is sent over encrypted connections, sign-in tokens are kept in your phone’s secure storage, and access to the admin console is restricted and protected by two-step verification. No system is perfectly secure; if a breach affects your personal data we will inform you and the authorities as the law requires.

Children

HoiHoi is for people aged 18 and over and is not directed at children. If you are under 18, please do not use HoiHoi or give us any personal data. If you believe someone under 18 has given us personal data, write to us and we will delete it.

Changes to this policy

When we change this policy we update the effective date at the top of the page. If a change materially affects how we use your data, we will also tell you in the app or on the website before it takes effect.