Privacy Policy

1. Overview

Groupora is independently developed and operated by Abdul Latif, an individual developer based in Pakistan. It is not operated under a registered company or separate legal entity. The official website is groupora.app. The app supports groups, direct and group messages, Channels, Stories, Shop listings, and purchase requests. This policy applies to the app, its supporting API, and this public website.

2. Information Groupora processes

Account and authentication

Groupora uses Firebase Authentication for account identity. Depending on the sign-in method you choose, this includes an email address and password-based account, Google sign-in, or Facebook sign-in. Email verification and account recovery use short-lived verification challenges delivered through the connected Resend email service. Firebase and the selected identity provider may process the identity information needed to authenticate you. Groupora does not receive your provider password.

Profile information

Your profile may include your user ID, email, first and last name, username, bio, profile link, profile photo or avatar, gender, country, account timestamps, verification state, account status, follow/friend counts, and settings such as profile-image visibility and who may start a new message. Country may be inferred from the device timezone during signup; that process is not GPS tracking.

Contacts and friend discovery

If you grant device Contacts permission and use contact matching, the app reads contact names, email addresses, phone numbers, and available contact images on your device. The authenticated API receives up to 250 normalized email candidates to match against Groupora profiles and returns public presentation details for matches. Contact names, phone numbers, and images are not sent to that matching endpoint or stored there as a contact book. Contact permission and feature settings are stored locally on your device.

Groups, followers, and Channels

Groupora processes user follows and derives a Friend relationship when two users follow each other. Channel follows are separate. Group records can include owners, administrators, members, join requests, invite activity, approval settings, sharing and posting settings, restrictions, and membership timestamps. Channel records can include owners, posts, followers, views, reactions, and Discover metadata. This information is used to show the right feeds and features and enforce permissions.

3. Messages, media, and Stories

Direct-message and group-chat records can contain message text, sender and conversation identifiers, timestamps, replies and quoted text, reactions, delivery and read state, previews, and sticker metadata. Depending on the composer, messages and Channel posts can include images, videos, voice messages, location links, and stickers. Selected images, videos, audio files, and other user media are uploaded to Firebase Storage and linked from Firestore records. Current chat image/video uploads are bounded by the app, including a 50 MB limit for supported chat media.

When you choose location sharing, Groupora converts the current location into a Google Maps URL containing coordinates and sends that URL as message text to the selected conversation. Recipients or group members may see it. Groupora does not use that feature as background location tracking.

Custom stickers can include image or video files, title, price, dimensions, duration or trim information, creator and owner identifiers, and storage URLs. Stories can include text, emoji, images, or videos, plus creation and expiry timestamps, media metadata, views, and likes. Stories are shown to eligible mutual Friends under the app’s rules and are intended to expire after their stated period, normally within 24 hours; cleanup can take time.

4. Shops, purchase requests, Coins, and Diamonds

Shop listings may include seller and product identifiers, descriptions, images, stated prices, and availability. Your cart is stored locally on your device. When you send a Buy Request, the service rechecks the seller, product, permissions, current availability, and price, then sends a structured request in the selected conversation. The current app does not provide in-app checkout or payment processing.

Coins and Diamonds are separate in-app records. The service processes Coin rewards and approved group-promotion activity. Diamonds support in-app transfers and Channel Gifts; the server keeps balance and transaction records. The app does not provide an in-app cash purchase or withdrawal flow for Diamonds. User-facing Diamond history expires after one UTC calendar year, while separate balance, operation, and ledger records do not have a general automatic expiry and may remain after account deletion.

5. How information is used

• Create and secure accounts, verify email addresses, support sign-in, recovery, and password changes.
• Show profiles, follows, Friends, groups, Channels, posts, Discover results, and Shop listings.
• Deliver messages, media, stickers, reactions, receipts, Stories, and notifications.
• Operate group roles, approvals, restrictions, Channel ownership and follows; process Buy Requests, Coin rewards, Diamond transfers, and Channel Gifts.
• Calculate views and engagement and maintain check-in, referral, and approved group-promotion records.
• Respond to reports, prevent abuse and unauthorized access, troubleshoot, enforce the Terms, and meet legal obligations.

We do not sell personal information. The current mobile app code contains no general analytics or in-app advertising SDK; whether ads are served through other website or publisher configuration has not been verified. For referral-abuse prevention, the server may retain bounded keyed hashes of app-instance, coarse network, user-agent, and device-model signals. The raw values are not stored in those risk records; the signals are used with referral records to evaluate potential abuse.

6. Notifications and device information

If you grant notification permission, the app and server process a device push token, platform information, and update time so notifications can be delivered. Notification records can contain a sender name, short message preview, conversation or message identifiers, reply suggestions, read state, and timestamps. A small local retry queue may retain notification identifiers until delivery succeeds or the entry is removed. You can decline operating-system notification permission and use the notification controls provided by the app.

7. Firebase, API processing, and local storage

Firebase Authentication, Firestore, Firebase Storage, and Firebase Cloud Messaging provide core account, database, media, and notification infrastructure. The authenticated Groupora API performs server-side checks and operations such as contact matching, moderation, account deletion scheduling, Channel and group management, purchase requests, and notification fan-out. Local device storage is also used for authentication persistence, theme and language choices, archived or hidden conversations, favorites, wallpapers, translations, sticker IDs, locally hidden Stories, public-profile snapshots, cached media, the Shop cart, authorized conversation snapshots, and a text-message outbox with retry state.

Authorized cached conversations can include message text, sender and reply data, stickers, and media references. Local caches are for convenience only: Firebase, the API, and server-side rules are authoritative. Logout does not currently erase every local chat, outbox, media, wallpaper, translation, sticker, or preference record. Device or operating-system controls can clear local data; otherwise cached files may remain until replaced, cleared, or removed by the device.

8. Reports, blocking, and moderation

Reports may contain the reporter’s user ID and name, the reported user, group, Channel, or post identifier and metadata, a selected reason, details, status, and timestamps. Users can report eligible content or accounts where a report control is shown. The operator can review reports and use available tools to moderate content, manage restrictions, block accounts, and delete Channels. Reports do not have a general automatic expiry and may remain for moderation, safety, abuse-prevention, or legal purposes.

Blocking and group restrictions can limit follows, reads, posts, messages, membership actions, or other interactions. Local hiding, blocking, and “Clear Chat for Me” do not delete shared server content or copies already retained by another person.

9. Sharing and service providers

Groupora currently uses the following providers or services for the roles described:

• Google Firebase: Authentication, Firestore database, Firebase Storage, and Firebase Cloud Messaging. See Firebase privacy and security and Google Privacy Policy.
• Google: Google sign-in and Google Maps links selected by a user. Google’s processing is governed by its own policies.
• Meta/Facebook: Facebook sign-in, when selected by the user. See Meta Privacy Policy.
• Resend: delivery of Groupora email verification and account-security codes. See Resend Privacy Policy.
• Expo notification services: the app’s push-notification integration. See Expo Privacy Policy.
• Replit deployment infrastructure: hosting for the project’s website and API, which may process request and operational information needed to provide and secure the service.

These providers may process information on servers outside Pakistan under their own terms and privacy policies. Exact production routing, data-region settings, and provider log-retention configurations have not been established from the app code, so this policy does not promise a particular storage country.

10. Retention and account deletion

Server data is retained while needed to provide features, maintain security, process moderation, prevent abuse, resolve disputes, or comply with law. Direct and group conversation auto-delete settings offer 24 hours, 7 days, 30 days, 90 days, 6 months, 1 year, or Off; the default is 90 days. Separately, eligible Group messages and posts have a fixed 20-day server retention limit. For Group messages, the earlier limit applies, so Off does not extend retention beyond 20 days. Group media is deleted only when a content record contains a safely validated storage path; this does not guarantee removal of every upload. Direct-message timeline cleanup removes eligible message and reaction records but does not guarantee removal of Firebase Storage media. Cleanup runs periodically. Clear Chat for Me only hides shared messages from the requesting user.

Stories are intended to expire after their stated period, normally within 24 hours. Coins, ordinary referral records, promotion records, reports, receipts, and engagement records have no general automatic expiry. User-facing Diamond history expires after one UTC calendar year, but separate Diamond balances, operations, and ledgers have no general automatic expiry.

In-app account deletion requires recent password verification for the current email/password flow and schedules permanent deletion 30 days later; you can cancel during that recovery period by signing in and verifying your password. Cleanup removes the Firebase Auth account, user profile tree, many follow, membership, block, request, report, and message references, owned Group trees, and user-owned Story, custom-sticker, and shared-media files. The current deletion process does not remove every related record or file. Channel follows, Channel posts and media, Channel moderation reports, referral-abuse risk and audit records, separate Diamond account/operation/ledger records, and some Group files outside user-specific media paths may remain; several of these categories have no general automatic expiry. Other users’ downloads, device caches, and backups may also remain.

You can submit an external request at groupora.app/delete-account or email support@groupora.app. The operator may ask you to verify account ownership before acting. Server cleanup runs periodically and may complete after the scheduled time.

11. Security

Groupora uses Firebase Authentication, Firestore rules, Firebase Storage authorization, authenticated API checks, scoped reads, and administrative controls intended to limit access to authorized users. Secrets and service credentials are kept outside the public app and policy website. No online service can guarantee absolute security, and cached roles, local data, or client-side values are not proof of authorization.

12. Your choices and rights

You can edit available profile fields, hide your profile image, control new-message permissions where offered, follow or unfollow users and Channels, leave groups, manage contact and notification permissions, block users, choose what to send, delete your own Stories or custom stickers, clear conversations for yourself, choose chat auto-delete settings where permitted, and request account deletion in Account settings or at the public deletion page. You may contact support@groupora.app to ask about access, correction, or deletion of personal information. Some controls are local-device preferences and do not change shared server data.

13. Children’s privacy and safety

Groupora is not directed to children under 13, and the current implementation does not provide a child-directed mode or age-assurance system. Do not use Groupora if you are under 13. Groupora prohibits child sexual abuse or exploitation, grooming, sexual solicitation of minors, and child sexual abuse material (CSAM). Abdul Latif, Groupora’s individual developer and operator in Pakistan, is the child-safety contact at support@groupora.app. Use an in-app report control where available or email this address to report suspected child sexual exploitation or abuse; do not attach or forward suspected CSAM. The operator will review child-safety reports, take appropriate action on confirmed violations, and make reports to appropriate authorities where required by applicable law. Contact the same address if you believe a child has provided personal information.

14. Changes to this policy

We may update this policy when the app, its features, or applicable requirements change. The current version and effective date will be posted here and in the app. Where applicable law requires consent, Groupora will seek it through the available app flow.

Read the Terms of Service.