Privacy Policy

Effective date: 16 October 2026 · Raincrew Labs Private Limited

1. Who we are

This Privacy Policy describes how Raincrew Labs Private Limited (the "Company", "we", "us"), a company incorporated in India, collects, uses, shares, and protects personal data when you use the theexps mobile applications for iOS and Android, the website theexps.com, and every related feature and service (together, the "Service"). For the purposes of the (Indian) Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Company is the data fiduciary for the personal data described here. This Policy should be read together with our Terms & Conditions; capitalised terms not defined here have the meaning given there.

By using the Service, and by giving consent where the app asks for it, you agree to the practices described in this Policy. If you do not agree, do not use the Service.

2. What we collect

We collect the following categories of personal data:

• Account data. Your mobile number, used to identify your account and verified by a one-time code, and the account details you set in the app (such as your name).
• Your Content. The Exps you create — photos, voice recordings, and words — the choices you attach to them, such as who they are shared with, and details connected to an Exps, such as when it was captured and — only where you have granted the relevant device permission — approximate place. These details are used solely to provide the Service's features to you and the people you share with.
• Contacts. If you allow contact access, we use it only to help you find and name your people. The names you keep for people are visible only to you; discovery is designed to minimise the contact data we handle, we do not use your address book for any other purpose, and we never message your contacts on your behalf.
• Device and technical data. Device model, operating system and version, app version, language, push-notification tokens, network information, and identifiers needed to deliver the Service to your device.
• Usage and log data. Records of how the Service is used and how it performs — such as feature activity, diagnostic events, error reports, and security logs.
• Communications. Messages you send us, for example to support or the Grievance Officer.

We do not knowingly collect more than the Service needs. There is no advertising identifier collection, no third-party ad tracking, and no sale of personal data.

3. Why we collect it

We process personal data for the following purposes, and only these:

• To provide the Service — creating and operating your account, storing your Exps, and delivering them to you and the specific people you choose.
• To process Your Content so features work. This includes routine automated processing (for example converting, transcoding, transcribing, indexing, or otherwise analysing it), including with the help of AI service providers (see Section 6), solely to operate, provide, secure, and improve the Service — never to build advertising profiles and never to sell.
• To keep the Service safe — verifying accounts, preventing fraud, abuse, and unauthorised access, enforcing our Terms, and protecting users (including our zero-tolerance handling of child sexual abuse material, which we report to authorities).
• To communicate with you — verification messages, essential service notices, and replies to your requests. We do not send marketing messages without your consent.
• To improve the Service — understanding aggregate performance and reliability so the product works better. Improvement work does not involve publishing your Exps or selling your data.
• To comply with law — meeting legal obligations, responding to lawful requests, and establishing or defending legal claims.

4. Consent, and the choices you control

• Consent is the basis for our processing of your personal data under the DPDP Act, alongside legitimate uses the law permits (such as complying with legal obligations). Where the app asks for a permission or a consent, it will tell you what the permission is for before you grant it.
• Device permissions — camera, microphone, photos, contacts, location, notifications — are each optional and controlled by you in your device settings. The Service works without them; the features that need them simply wait until you grant them.
• Optional features involving sensitive data. Some optional features may involve the processing of sensitive or biometric-type data. Any such feature is off unless you turn it on, is enabled only with your separate, explicit consent given in the app at the time, is used solely to provide that feature to you and the people you share with, and can be turned off — with the associated data deleted — at any time.
• Face matching (optional). When you sign in, you can tick "I agree to let my friends' photos recognize my face if I have uploaded my photo." It starts unticked, and everything else in Exps works without it. If you turn it on and add a profile photo:
  • What we create. A face template — a set of numbers that describes your face — made only from your own profile photos. We never make one from anything else, and never for anyone who has not turned this on.
  • How it is used. When someone you already share a space with in Exps takes a photo, the faces in it are compared only with that person and the people they already share a space with. If your face matches, their app can offer to send you the photo you are in. Nobody outside that circle is ever matched, and no one can search Exps by face.
  • Other people's photos. Faces in photos are compared when the photo is taken; we do not keep templates of them.
  • Where it stays. Templates are made and compared on our own servers. They are never sold, never used for advertising, and never shared with AI service providers or anyone else.
  • Turning it off. You can turn it off at any time from your profile photo in My Space. That deletes your templates straight away, and with them the record of which photos matched you. Deleting a profile photo deletes its template; deleting your account deletes them all when the account is erased.
• Withdrawing consent is as easy as giving it: turn the feature off in the app, revoke the device permission, or write to [email protected]. Withdrawal does not affect the lawfulness of processing already carried out, and some processing required by law may continue where the law permits.

5. Who can see your Exps

Your Exps are shown only to you and the people you choose to share them with. There is no public feed, no public profile, and no advertising placement of your content. We do not publish Your Content to any public surface, and our personnel access it only where strictly necessary — for example to investigate abuse reports, fix a fault, or meet a legal obligation — under confidentiality obligations.

6. When we share personal data

We share personal data only in these circumstances:

• With people you choose. Sharing an Exps gives the recipient access to it within the app. Content you have shared with others remains visible to those people even after you delete your own copy or your account — treat sharing as real.
• With service providers who process data on our behalf and under our instructions — categories include cloud hosting and storage, phone-verification and message-delivery providers, push-notification services, and AI service providers (for example, leading AI labs such as OpenAI, Anthropic, and Google) that help us provide the Service's features. They are bound by contract to use the data only to provide their service to us, and our agreements with AI service providers do not allow them to use your content to train their models.
• With app stores (Apple and Google) to the extent involved in distributing the app and processing any future purchases, under their own terms.
• For legal reasons — where required by law, legal process, or a lawful request from authorities, or where necessary to protect the rights, safety, or property of users, the public, or the Company; we may preserve and disclose information where the law requires it.
• In a business transfer — if the Company is involved in a merger, acquisition, or sale of assets, personal data may transfer as part of it, with notice to you and under protections at least as strong as this Policy.

We never sell personal data, and we never share it for advertising. We have not sold or shared personal data (as those terms are defined in US state privacy laws) and have no plans to.

7. Where your data is processed

The Service is offered in India and the United States, and personal data may be stored and processed on infrastructure in either country or where our service providers operate. Wherever it is processed, it is protected by this Policy, our contracts with providers, and applicable law. By using the Service you consent to this transfer and processing, to the extent your consent is the applicable basis.

8. How long we keep it

• Your account and Your Content are kept while your account is active, so your Exps stay where you put them.
• Deletion is real. When you delete an Exps or your account, it is removed from the Service, subject to a short period needed to purge backups, and except for content you have shared with others, which remains visible to those people you shared it with.
• Optional-feature data (Section 4) is deleted when you turn the feature off.
• Technical, security, and legal records are kept only as long as needed for the purposes in Section 3 or as the law requires — for example, records we must retain under Indian law after account deletion — and are then deleted or anonymised.

9. How we protect it

We use technical and organisational safeguards appropriate to the sensitivity of the data — including encryption in transit, encryption at rest for sensitive data, access controls, and monitoring — and we design features to minimise the personal data they handle in the first place. No service can promise perfect security; keep your device secure, and tell us at [email protected] immediately if you believe your account has been compromised. The Service is not a backup product — keep your own copies of anything irreplaceable.

10. Your rights

10.1 If you are in India

Under the DPDP Act you have the right to:

• access a summary of the personal data we process about you and the processing activities;
• correction and erasure — have inaccurate or incomplete data corrected, and data that is no longer necessary erased;
• withdraw consent at any time, as described in Section 4;
• grievance redressal — raise a complaint with our Grievance Officer (Section 12);
• nominate another individual to exercise your rights in the event of death or incapacity.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10.2 If you are in the United States

Depending on your state, you may have the right to know what personal data we collect and how we use it (this Policy is that disclosure), to access it, to correct it, to delete it, and to receive a portable copy. Because we do not sell or share personal data for advertising, and do not use sensitive data beyond what you explicitly enable, there is nothing to opt out of — but you may still exercise the rights above. We will not discriminate against you for exercising any right. You may use an authorised agent where your state's law provides for one; we will verify the request.

10.3 How to exercise them

Most of it you can do yourself in the app — edit account details, turn features off, delete Exps, or delete your account. For anything else, write to [email protected] from a way we can verify (we may ask you to confirm control of your account's mobile number). We respond within the timelines applicable law sets.

11. Children

The Service is not for children under 13, and we do not knowingly collect personal data from them. If you are under the age of majority where you live (18 in India), you may use the Service only with the consent and supervision of a parent or legal guardian. We do not use children's data for tracking, behavioural monitoring, or targeted advertising of any kind. If you believe a child has provided us personal data, contact [email protected] and we will delete it.

12. Grievance Officer (India)

In accordance with the Information Technology Act, 2000 and rules thereunder and the DPDP Act, complaints and privacy grievances may be raised with our Grievance Officer, Selvakumar R, at [email protected]. We will acknowledge complaints within 24 hours and aim to resolve them within 15 days. Updated contact details will be maintained on this page.

13. Changes to this Policy

We may update this Policy as the Service and the law evolve. Material changes will be notified in the app or on this page with a new effective date; where law requires fresh consent for a new purpose, the app will ask for it before the processing begins.

14. Contact