Privacy Policy

1. Summary

• We collect information needed to create and secure your account, operate Travel Plans, matching, Squads, chats, safety features and support.
• Koytr uses progressive disclosure. Before a stranger is accepted into the same Squad, Koytr does not ordinarily show that traveler your name or profile photo.
• Your email address, phone number, surname, self-declared gender and unpublished travel plans are not displayed to other travelers.
• During the current Alpha, Koytr does not perform Face Verification and does not show a Face Verified badge.
• During the current Alpha, Koytr does not ask for or store Aadhaar numbers, Aadhaar cards, Government ID documents, or identity-verification documents for Women-only access.
• Women-only access during Alpha is based on the user’s self-declared gender. This is not independent identity or gender verification.
• We do not sell or rent your personal information and do not use it for targeted advertising.
• Optional analytics runs only after you choose to accept analytics.
• If you choose to contact Koytr through WhatsApp support, Koytr will receive the phone number associated with that WhatsApp conversation and the content you send for the purpose of handling your support request.
• You may delete your Koytr account from the app. We delete or anonymise personal information that is no longer required, subject to limited legal, security, fraud-prevention, shared-history and technical-retention exceptions described below.

2. Information we collect

2.1 Google sign-in

If you choose Continue with Google, Google may provide Koytr, through our authentication provider, with information such as:

• your name;
• your email address and email-verification status;
• your Google account identifier; and
• Google account profile metadata made available through the basic sign-in scope.

We use this information only to:

• create and secure your Koytr account;
• sign you in;
• prefill or suggest your First Name during onboarding where available; and
• communicate important account, security or service information.

Koytr does not ask Google for access to your Gmail, Google Drive, Google Calendar or Google Contacts unless a future feature separately requests such access with an appropriate disclosure and consent.

Koytr does not receive or store your Google password.

If Koytr does not use a particular Google profile field for a product feature, we do not intentionally expose that field to other travelers.

2.2 Email sign-in

If you sign in using email, we collect your email address and use it to authenticate your account and send sign-in codes and important account communications.

Koytr does not display your email address to other travelers.

2.3 Profile and onboarding information

Depending on the features you use, we may collect:

• First Name;
• optional short bio;
• self-declared gender;
• profile photo;
• optional LinkedIn profile URL;
• the date/time of your 18+ acknowledgement; and
• an optional private phone number if that feature is enabled.

Your self-declared gender is used for product eligibility rules such as access to Women-only opportunities. It is not displayed to other travelers and should not be sent to behavioral analytics.

Your phone number, where collected, is private account/security information and is not automatically shared with other travelers.

2.4 Profile photos and selfie capture

Koytr may ask you to add a profile photo. You may be allowed to take a new selfie with your device camera or choose an existing photo. In the current Alpha, a selfie taken in this flow is used only as your profile photo; it is not a Face Verification or identity-verification step.

Koytr uses progressive disclosure. Your profile photo is not ordinarily shown to strangers merely because they browse the same destination or Trip. It may become visible to another traveler after the product relationship reaches a stage where identity disclosure is appropriate, for example after both travelers become accepted members of the same Squad or where another approved Koytr relationship permits profile access.

Your profile photo is intended to help fellow travelers recognise the person they have agreed to travel or coordinate with.

Current Alpha position: Koytr does not currently perform Face Verification and does not display a Face Verified badge. A selfie or profile photo by itself is not proof that Koytr has independently verified the person in that photo.

If Koytr introduces Face Verification in the future, we will update this Policy and provide any required notice or consent before collecting verification-specific images or biometric/identity-verification data. A future Face Verified indicator will describe only the verification Koytr actually performs; it will not be represented as a guarantee of a person’s legal identity, character, intentions, conduct or safety.

Travelers should use reasonable judgment when meeting another traveler in person and should compare the person they meet with the profile information shown in Koytr. Concerns can be reported using Koytr’s safety tools.

2.5 Travel Plans and journey information

When you create a Travel Plan, we may store information such as:

• Starting City;
• Final Destination City;
• departure date;
• approximate departure time;
• travel mode;
• meaningful airports, railway stations, interchanges or Journey Legs;
• rough travel window and duration for flexible plans;
• publication/accepting status; and
• other structured information you choose to provide for matching or coordination.

We also store related product state, such as requests, invitations, Squad membership, Watchlist entries and compatibility outcomes.

Koytr does not collect precise continuous/live location as part of the MVP.

2.6 Women-only opportunities during Alpha

During the current Alpha:

• Gender is a mandatory onboarding field.
• Access to Women-only product features is based on the traveler’s self-declared gender.
• Koytr does not ask for Aadhaar number, Aadhaar card, Government ID, identity document or other documentary proof for Women-only access.
• Koytr does not present Women-only access as independently identity-verified.
• Koytr does not display an Identity Verified badge merely because a user selected a gender.

Accordingly, a Women-only label during Alpha describes the participation rule applied by Koytr based on users’ self-declared gender; it does not mean Koytr has independently verified every participant’s identity or gender.

If Koytr later introduces an independent identity-verification process, Koytr will:

1. implement the process through an approved and legally compliant method/provider;
2. give the traveler a clear notice explaining what information will be collected, why, how it will be processed and how long it will be retained;
3. obtain any consent required by applicable law;
4. minimise the information collected and retained; and
5. display an Identity Verified or similar indicator only after the approved verification process has actually been completed.

Koytr will update this Privacy Policy before such a verification process begins.

2.7 Messages, connections, reports and blocks

Koytr may store:

• Squad chat messages;
• private messages between travelers who have mutually established a Private Connection;
• Squad membership and membership periods;
• Private Connection status;
• My Travel Network entries;
• Block relationships; and
• reports submitted to Koytr, including report category and any text supplied by the reporter.

Reports are private to Koytr and are not disclosed to the reported traveler merely because a report was submitted.

Koytr personnel should not access private message content as a matter of routine. Access may occur where reasonably necessary to investigate a safety or abuse issue, comply with law, maintain or secure the service, or resolve a technical problem, subject to appropriate access controls and internal policy.

2.8 WhatsApp support

Koytr may offer an optional WhatsApp support channel. Koytr currently handles these conversations directly through the WhatsApp Business app and does not currently route them through a separate CRM, helpdesk or third-party support platform.

If you choose to contact Koytr through WhatsApp:

• Koytr will receive the phone number associated with the WhatsApp account used to contact us;
• Koytr will receive the messages, attachments and other information you choose to send in that support conversation;
• WhatsApp may make limited account/profile information visible to the business according to your WhatsApp settings and WhatsApp’s service; and
• WhatsApp/Meta will process the communication under its applicable terms, privacy policy and business-service terms.

Koytr uses information received through WhatsApp support only to respond to your enquiry, provide support, investigate a problem or safety concern where relevant, and keep a reasonable support record where necessary.

Your WhatsApp number:

• is not automatically added to your public Koytr profile;
• is not shown to other Koytr travelers;
• is not treated as consent to marketing or promotional messages; and
• is not used to bypass Koytr’s contact-privacy rules.

Please do not send passwords, one-time sign-in codes, payment-card information, Aadhaar/Government-ID documents, or other information that is not necessary for the support request through WhatsApp.

WhatsApp support is optional. You may instead contact Koytr by email at support@koytr.com.

A request to delete your Koytr account must be sent from the email address associated with your Koytr account to support@koytr.com, as described in Section 9. A WhatsApp message by itself is not the account-deletion request channel.

2.9 Information collected automatically

When you use Koytr, our hosting, security and infrastructure providers may process technical information such as:

• IP address;
• browser/device type;
• request time;
• requested page or API endpoint;
• security and error information; and
• cookies or similar browser storage required for authentication, security and user choices.

Where Koytr stores hashed or pseudonymised network identifiers for rate limiting or abuse prevention, they are used only for those purposes and retained only as long as reasonably necessary.

Optional analytics is described in Section 4.

3. How we use your information

We use personal information to:

1. Provide Koytr — create accounts, authenticate users, create Travel Plans, publish opportunities, determine compatibility, manage Squads, deliver messages and operate product features.
2. Enable appropriate identity disclosure — show profile information only when the product relationship permits it.
3. Operate Women-only participation rules — during Alpha, using self-declared gender only, as described in Section 2.6.
4. Protect users and Koytr — prevent abuse, enforce Blocks, investigate Reports, secure accounts and systems, and enforce applicable Terms and safety rules.
5. Provide support — respond to account, privacy, product and safety requests, including enquiries you choose to send through WhatsApp support.
6. Communicate with you — send authentication, security, safety, product-state and other service messages.
7. Improve Koytr — including optional analytics where you have consented.
8. Comply with law — respond to lawful requests and meet applicable legal obligations.

We do not:

• sell or rent your personal information;
• sell personal data to data brokers;
• use personal information for targeted advertising;
• use Google sign-in information for advertising;
• use your personal information to determine creditworthiness, lending or insurance eligibility;
• use private chats or profile photos to train public or third-party artificial-intelligence models; or
• claim that an unimplemented verification process has verified you.

4. Cookies and optional analytics

4.1 Essential cookies and browser storage

Koytr uses cookies and similar browser storage that are necessary for functions such as:

• secure sign-in and session management;
• remembering where to return you after sign-in;
• saving your analytics choice; and
• preserving unfinished structured product input where appropriate.

Essential authentication/security storage cannot be switched off if it is necessary to provide the service.

4.2 Optional analytics

Koytr currently uses optional analytics tools including:

• Mixpanel for product analytics; and
• Microsoft Clarity for UX/session diagnostics.

These tools run only after you choose Accept in Koytr’s analytics/cookie notice. If you choose No thanks, or have not made a choice, optional analytics should not run.

Koytr’s analytics implementation is designed not to intentionally send sensitive content such as:

• name;
• email address;
• phone number;
• self-declared gender;
• private message text;
• report narratives;
• identity or verification documents;
• booking references; or
• payment information.

Mixpanel uses a pseudonymous analytics identifier rather than the direct Koytr account identifier. Koytr’s current implementation uses Mixpanel’s EU data region.

Clarity is configured to mask page text and is excluded from sensitive routes/surfaces as implemented by Koytr.

You may change your analytics choice through Settings → Privacy & Safety → Analytics.

Analytics is not used to make account, verification, Membership or safety decisions about you.

5. What other travelers can see

Koytr follows progressive disclosure.

Public visitors and pre-acceptance discovery

Depending on the opportunity, users may see privacy-safe travel information such as:

• destination;
• travel date/window;
• broad starting-city or journey context;
• travel modes;
• number of travelers; and
• other non-identifying opportunity information.

Before stranger acceptance, Koytr does not ordinarily display:

• your name;
• your profile photo;
• email address;
• phone number;
• surname;
• self-declared gender;
• unpublished future Travel Plans; or
• private messages.

Accepted Squad members

After travelers become accepted members of the same Squad, they may see information needed for identity and coordination, which may include:

• First Name;
• profile photo;
• short bio;
• LinkedIn link if you have chosen to make it visible to eligible travelers;
• relevant Trip/Journey information; and
• messages sent in the Squad.

Private Connections

Travelers who mutually establish a Private Connection may see the profile information permitted by Koytr and messages exchanged in the private conversation.

Information that remains private

Koytr does not automatically expose your:

• email address;
• private phone number;
• surname;
• self-declared gender;
• unpublished future travel intentions;
• account-security information; or
• any future verification document or verification-specific raw data.

If you voluntarily type personal information into a chat, people entitled to view that chat may see it.

6. Service providers and disclosures

Koytr uses service providers to operate the product. Based on the current implementation, these may include:

These providers may process data in India or in other jurisdictions where their infrastructure or subprocessors operate, subject to their contracts, terms and applicable law.

When you use WhatsApp support, your communication is also processed through WhatsApp/Meta infrastructure. WhatsApp may process customer contact information, message/service data and related technical information according to the WhatsApp terms and privacy documents applicable to the service. WhatsApp operates globally, so processing may occur outside India.

We may also disclose information:

• where required by applicable law, court order or lawful governmental request;
• where reasonably necessary to protect users, Koytr or others from fraud, abuse, security threats or serious safety risks;
• to professional advisers and contractors who need access for legitimate business/legal/security purposes and are subject to appropriate confidentiality/data-protection obligations; or
• as part of a bona fide business transfer, merger, restructuring or sale, subject to applicable law.

We do not sell personal information.

7. Security

Greenree uses reasonable technical and organisational safeguards designed to protect personal information.

Current safeguards may include:

• HTTPS/encrypted network connections;
• server-side access controls and authorization;
• private storage for non-public files;
• restricted administrative access;
• input/file validation;
• rate limiting and abuse controls;
• security logging; and
• separation of public and private application surfaces.

No internet service can guarantee absolute security.

If Koytr becomes aware of a personal-data breach requiring notice under applicable law, we will take the steps required by applicable law.

8. Retention

Koytr retains personal information only for as long as reasonably necessary for the purposes described in this Policy, subject to legal, security, fraud-prevention, dispute-resolution, accounting and technical obligations.

As a general rule:

• active account/profile information is retained while the account exists;
• Travel Plans and relationship records are retained while needed to provide the service and history;
• profile photos are deleted or de-linked from the account when the account is deleted, subject to temporary backup/log retention where applicable;
• authentication/security logs may be retained for the period required for security operations or applicable law;
• reports, abuse-prevention and enforcement records may be retained after account deletion for a limited period where reasonably necessary to protect users, investigate misuse, prevent repeat abuse, resolve disputes or comply with law;
• shared Squad/private-conversation messages may remain available to other conversation participants after one user deletes their account, but the deleted account should be de-identified or displayed neutrally where appropriate; and
• WhatsApp support conversations and the associated phone number under Koytr’s control are normally retained for up to 90 days after the support issue is resolved, unless a longer period is reasonably necessary for safety, fraud/abuse prevention, legal compliance or dispute resolution; and
• optional analytics data is retained according to Koytr’s configured provider retention settings and is not used as Koytr’s operational source of truth.

Koytr will not retain identity-verification documents during Alpha because Koytr does not currently collect them.

9. Account deletion

You may request deletion of your Koytr account by emailing support@koytr.com from the email address associated with your Koytr account.

After Koytr verifies that the request comes from the account holder, Greenree will complete deletion of the Koytr account and personal data under Koytr’s control within 72 hours.

Deletion is intended to include, where applicable:

• profile information;
• self-declared gender;
• profile photo;
• optional LinkedIn information;
• 18+ acknowledgement;
• Travel Plans and unpublished/published opportunities attributable to the account;
• My Travel Network entries;
• requests and invitations;
• Private Connection state;
• Women-only eligibility records, if any exist;
• authentication/account records that can lawfully and technically be deleted; and
• other account-linked personal data that is no longer required.

When the account is deleted, the user is also removed from active Squads, their published opportunities stop accepting new participation, and pending product actions are resolved appropriately.

Limited exceptions

Koytr may retain a minimum amount of information after account deletion only where retention is reasonably necessary for:

• compliance with applicable law or a valid legal obligation;
• security, fraud or abuse prevention;
• investigation or defence of legal claims;
• safety or moderation records;
• integrity of another user’s shared conversation history; or
• temporary infrastructure, security or backup logs that cannot reasonably be deleted immediately.

Where shared messages remain for the benefit of other conversation participants, Koytr should remove or neutralise the deleted user’s active profile identity where appropriate, for example by displaying Deleted traveler.

Any information retained under an exception will not be used for ordinary Koytr participation and will be deleted or anonymised when the retention purpose ends.

Removing Koytr from your Google Account permissions stops future Google sign-in access but does not by itself delete your Koytr account. To delete your Koytr account, email support@koytr.com as described above.

10. Your rights and choices

Subject to applicable law, you may have rights to:

• request information about personal data Koytr processes about you;
• request correction or updating of inaccurate information;
• request erasure/deletion of eligible personal information;
• withdraw consent where processing depends on consent;
• change optional analytics consent;
• control LinkedIn visibility where that feature is available;
• Block or Report travelers;
• leave Squads or stop accepting travelers where product rules permit; and
• submit a grievance or privacy request.

Requests may be sent from your account email address to support@koytr.com.

Koytr may need to verify that a request genuinely comes from the account holder before acting on it.

11. Age

Koytr is intended only for users aged 18 years or older.

Before a user creates their first Trip, Koytr asks them to confirm that they are at least 18.

If Greenree becomes aware that an account belongs to a person who does not meet Koytr’s minimum age requirement, Greenree may suspend or delete the account and associated personal information as appropriate, subject to applicable legal/security retention requirements.

12. Changes to this Policy

We may update this Privacy Policy when Koytr’s product, service providers, verification methods, legal requirements or data practices change.

We will update the Last updated date.

Where a change materially affects how we process personal information, we will provide additional notice or obtain consent where required before applying the new processing.

In particular, Koytr will update this Privacy Policy before introducing:

• Face Verification;
• Identity Verification;
• Aadhaar/offline identity verification;
• Government-ID document collection;
• biometric processing;
• new Google API scopes beyond basic authentication;
• materially different uses of personal data; or
• materially different data-sharing practices.

13. Google API Services disclosure

Koytr’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including applicable Limited Use requirements.

Koytr requests only the Google information required for the Google sign-in functionality currently offered and does not use Google user data for advertising, credit/lending decisions or sale to data brokers.

14. Contact and grievance requests

Koytr is operated by:

• Greenree
• A sole proprietorship in India
• Brand/service: Koytr

Correspondence address:

• No. 22052, Prestige Ferns Residency
• Haralur Road, Tower-22, HSR Layout
• Bangalore – 560102
• Karnataka, India

Privacy, account-deletion and support enquiries: support@koytr.com

The identity/contact details of any legally required Grievance Officer must be published through Koytr’s legal/contact pages before public launch where required by applicable law.