Privacy Policy

What we collect, and why

• Email + name — account login, receipts, program emails.
• Instagram handle — your public link, leaderboard, and profile page.
• Hashed IP addresses of link clicks — click fraud prevention. Raw IPs are never stored; hashes use a daily salt and cannot be joined across days.
• UPI ID — paying you. Collected at first withdrawal, not signup.
• PAN — only when tax law (Section 194H TDS) requires it; stored encrypted (AES-256), rendered masked, visible in full to no one through the app.
• Order references attributed to your link — computing commissions.

What we don't do

• No selling or sharing of your data with advertisers.
• No device fingerprinting, no third-party trackers on this site.
• No reading of your Instagram account — the handle is self-reported.

What's public

Your handle, level, founding badge, join date, and bottles sold appear on your public profile and leaderboard. Lifetime earnings appear only while your “show earnings” toggle (in Account) is on. Completed payouts appear on the public payouts wall as handle + amount + date + masked bank reference.

Retention and deletion

Account data is kept while your account is active. Financial records (commissions, payouts, PAN where collected) are retained as required by Indian tax law (currently 8 years), then deleted. Everything else is deleted within 30 days of a deletion request — email privacy@smelloff.in from your registered address.

Where it lives

Data is stored with Supabase (Postgres) and email is sent via Resend. Both act as processors under our instructions.