Privacy Policy — Mobile App

Last updated: August 24, 2026 · Applies to both Android (Google Play) and iOS (App Store) builds of the Dil Ka Rishta Marriage app.

1. Who we are

Dil Ka Rishta (referred to as "we", "us", "our") owns and operates the website https://www.dilkarishta.com.pk and the mobile app distributed on Google Play as "Dil Ka Rishta Marriage". For privacy questions write to contact@dilkarishta.com.pk.

2. Purpose of the service

The service exists to help adult users and their families find a marriage partner. All interactions are intentionally limited so the app cannot be used for casual dating, hook-ups, or any non-marital purpose:

• Profiles are family-friendly (no swimsuit, party, or revealing photos — all photos are reviewed by our moderators).
• There is no in-app chat, no DM, no group chat, no voice or video call.
• There is no file, media, location, or audio sharing of any kind.
• Users can only express interest with a one-way "Send Interest" tap. They cannot type free-form messages to other users.
• Phone numbers are revealed only after admin verification of both parties, so families can speak directly — the app itself is not a communication channel.

3. Eligibility — 18+ only

The service is strictly for users aged 18 years or older. Sign-up requires a date of birth which is enforced on both the client and the server; accounts that turn out to be under-18 are deleted on report. We do not knowingly collect data from minors. Parents who believe their child has registered should contact contact@dilkarishta.com.pk and the account will be permanently removed within 7 days.

4. What personal data we collect

4.1 Provided by the user at sign-up

• Full name as it would appear on a rishta proposal
• Email address (required for OTP verification)
• Mobile number (required for OTP verification — via SMS or WhatsApp template)
• Date of birth (used solely to enforce 18+)
• Gender, city, and country
• CNIC number (Pakistan national ID; used to derive a verified-name match, not displayed to other users)
• Password (stored as a one-way bcrypt hash; never visible to us or anyone else)
• An optional referral code if the user signed up through someone else's referral link

4.2 Provided by the user after sign-up (optional but expected)

• Profile photo (one image at a time; reviewed and approved by our admins before it goes public)
• Family, education, profession, religion, and rishta preference fields
• CNIC front/back photo and a selfie — used only for one-time verification, kept in a private (non-web-accessible) folder, and never shown to other users or used for any other purpose

4.3 Collected automatically

• IP address and approximate region (for fraud prevention and abuse logging)
• Device model, OS version and a Crashlytics-style crash report when the app crashes
• Anonymous analytics events about which screens are visited (we use Google Analytics 4)
• OneSignal Player / Subscription ID for push notifications — only created if the user explicitly accepts the OS-level notification prompt
• Android Advertising ID (AAID) — two SDKs read the device's Android Advertising ID: (a) the OneSignal SDK, for de-duplication of push notification delivery and basic analytics, and (b) the Google AdMob SDK, to serve and measure the in-app ads described in section 9. We never attach your name, photos, CNIC, mobile or email to the Advertising ID. You can reset it at any time from Device Settings → Google → Ads → Reset advertising ID, or opt out of personalised ads device-wide from the same screen.

4.4 What we never collect

• Precise GPS location, address book / contacts, SMS, call log, microphone, camera roll (beyond the single photo the user picks), Bluetooth, Wi-Fi network list, biometric data, health data, or financial account data.
• Real-time chat content (there is no chat).
• The user's CNIC number is never shown publicly — it lives only in the verification record.

5. How we use the data

• Account verification — email OTP and WhatsApp OTP confirm the user owns the contact details they entered.
• Profile verification — CNIC photo + selfie are checked by a human moderator to award the green "Verified" badge.
• Matchmaking — the user's preferences are used to suggest compatible profiles.
• Trust and safety — IP address is used to enforce IP bans, block fraud, and investigate reports filed against a user.
• Notifications — if the user opted in, we send push notifications for important profile events (new match, interest received, admin response).
• Service improvement — aggregated, anonymous analytics so we can fix bugs and improve flows.

We do not sell personal data to third parties, ever. We do not run profile-matching ads based on personal traits.

6. Safety controls inside the app

To keep the community safe and family-friendly we provide every user with the following built-in controls:

• Block User — one tap on any profile to permanently block a member. Blocked users cannot view or message the blocker.
• Report Profile — one tap to flag a profile (fake, inappropriate, married person, under-18, fraud, etc.). Each report is logged and reviewed by admins. A user cannot report the same profile twice in 7 days, preventing abuse.
• Photo moderation — every photo uploaded by any user is reviewed by an admin before it becomes visible. Inappropriate photos are rejected and never reach other users.
• Verification badges — only verified users have their photos shown without a privacy blur; non-verified profiles show photos blurred to protect both viewer and uploader.
• Self-deletion — any user can delete their own profile from inside the app at any time. The delete flow requires an OTP confirmation; once confirmed, the profile is removed from search and listings immediately.
• No free-text messaging — because there is no chat, harassment, scam links, and grooming attempts have no surface to exist.

7. How contact details become visible

A profile's mobile number is hidden by default. It only becomes visible to another user when:

1. Both parties are admin-verified (CNIC or selfie verification approved), OR
2. The viewing user has a paid package that includes contact viewing. Paid packages (Advance, Premium, VIP Matchmaking) can be purchased inside the app via Google Play Billing or on the website via local payment methods — see section 10.

The app itself does not route phone calls or SMS — the number is shown so families can call directly via the user's own dialler.

8. Push notifications

Push notifications are powered by OneSignal (which uses Firebase Cloud Messaging for Android delivery). They are opt-in only:

• On Android 13+ the standard system prompt is shown the first time after the user logs in (never before).
• If the user dismisses or denies the prompt, no Player ID is created and no notifications are sent.
• The user can revoke permission at any time from their device's Settings → Apps → Dil Ka Rishta → Notifications, and from inside the app's Account screen.
• The OneSignal SDK also reads the device's Android Advertising ID (AAID) to deduplicate notification delivery across reinstalls and to feed OneSignal's basic delivery analytics. OneSignal does not use it for advertising; ads in the app are served separately by Google AdMob (section 9).

9. Advertising

To keep the core service free, the app may display advertising served by Google AdMob:

• Ad formats: a small banner at the bottom of the screen, an occasional full-screen (interstitial) ad between page views, and occasionally an ad when returning to the app. Frequency is deliberately limited, and ads are never shown on sensitive screens (login, registration, OTP verification, photo upload, or payment screens).
• Ad-free for paid members: users on a paid package (Advance, Premium, VIP Matchmaking) enjoy an ad-free experience.
• What AdMob receives: AdMob uses the device's Advertising ID and standard device signals to serve and measure ads. We do not pass any of your personal profile data (name, photos, CNIC, mobile, email, preferences) to AdMob or any other ad network.
• Consent (EEA / UK / Switzerland): users in the European Economic Area, the United Kingdom and Switzerland are shown a Google-certified consent form (CMP) before any personalised ad is served, as required by the GDPR and Google's EU User Consent Policy. Declining consent limits ads to non-personalised or none; the app remains fully usable either way. Consent can be changed at any time.
• Your controls: reset or opt out of the Advertising ID from Device Settings → Google → Ads; personalised-ad settings at adssettings.google.com.

Our public website (www.dilkarishta.com.pk) may separately show Google AdSense ads to browser visitors. AdSense is never loaded inside the mobile app.

10. Payments

Basic use of the service is free. Optional paid packages (Advance, Premium, VIP Matchmaking) unlock additional features such as more profile views and contact details:

• In the app: purchases are processed by Google Play Billing. Google handles the entire payment; we never see or store your card, wallet, or bank details. We receive only the order ID, the purchased product, and a purchase token used to activate your package.
• On the website: packages can be paid via JazzCash, EasyPaisa, or bank transfer. Those payments are verified manually by our team; we store the transaction reference and (if provided) a payment screenshot solely to verify the payment.
• A package purchased on either platform applies to the same account everywhere (app + website).
• Refunds for Google Play purchases follow Google Play's refund policy; for website payments contact contact@dilkarishta.com.pk.

11. Referral program

Every account is automatically assigned a unique 6-character referral code. If a new user signs up using your code, you may earn a commission (currently 30% by default) on any future paid package they buy. To make this work we store:

• The referral link click (IP, user-agent, timestamp)
• The mapping "this new user was referred by that affiliate"
• The amount of each commission that becomes payable

The referrer never sees personally identifiable information about the people they referred — only their masked Profile ID and the package purchased.

12. Third-party services we use

13. Data retention

• Active accounts: data is retained while the account remains active.
• Self-deleted accounts: profile is removed from search instantly. The underlying row is soft-deleted, with the original email, mobile and CNIC preserved (suffixed for uniqueness) for 90 days for fraud and dispute resolution, then permanently scrubbed.
• CNIC / selfie verification files: kept only as long as they are needed to maintain the verified badge. The user can request immediate deletion at contact@dilkarishta.com.pk.
• Server logs (IP, user-agent): rotated every 30 days.

14. Your rights

You can, at any time:

• Access your data — the profile, photos, and history are all visible inside the app.
• Correct any field by editing your profile from the app's Edit Profile screen.
• Delete your account — two ways:
  • From inside the app: Account → Delete My Profile (OTP confirmed, instant removal from search).
  • Without logging in: use the public account deletion form at https://www.dilkarishta.com.pk/delete-request.php. Send a request from the same email that is on your account and we will action it within 7 days. A confirmation copy is emailed to you and to our team.
• Withdraw consent for push notifications from device Settings or from inside the app.
• Reset / opt out of the Advertising ID from Device Settings → Google → Ads.
• Request a copy of all your data — email contact@dilkarishta.com.pk and we will send a ZIP within 30 days.
• Lodge a complaint with the Pakistan Federal Investigation Agency (Cyber Crime Wing) if you believe we have not handled your data correctly.

15. Security

All traffic uses HTTPS / TLS 1.2+. Passwords are stored using bcrypt with a per-row salt. CNIC and selfie images are stored in a private folder that is not directly accessible from the web; they are only retrievable through an authenticated admin page. We follow OWASP-aligned practices for input validation, CSRF tokens, and access control on every administrative endpoint.

16. Children

The service is restricted to adults (18+) and is therefore not a "children's app" under the Google Play Families program or the US COPPA rule.

17. Changes to this policy

We will post any material change to this page and update the "Last updated" date at the top. We will also send a one-time push notification (if the user has opted in) when material changes occur.

18. Contact