Privacy Policy
Effective Date: October 26, 2026 | Last Updated: October 28, 2026
Beta Release Notice & Policy Advisory
This Privacy Policy applies to the internal test and beta evaluation phase of Virica (v0.1.0-test). As an evolving safety architecture engineered by Nirmeva Studio, specifications regarding feature modules, data handling workflows, and third-party integrations reflect current test builds and may be updated, enhanced, or amended prior to official public availability. Material updates will be documented on this page and communicated via the application.
We never sell, rent, monetize, or broker your personal or sensitive safety data to third parties or advertising networks.
All data in transit is encrypted using TLS 1.3 / HTTPS, and cloud records are sealed with cryptographic Row Level Security (RLS).
Structured in strict accordance with the Digital Personal Data Protection Act 2023, including verifiable parental consent for minors.
01Introduction & Scope
Welcome to Virica (“we”, “our”, or “the Platform”), an autonomous personal emergency assistance, SOS dispatch, and digital evidence protection platform developed by Nirmeva Studio.
We take your privacy with the utmost gravity. This Privacy Policy details the exact types of data collected, the statutory and functional grounds for processing, the cryptographic standards protecting your records, and your rights under applicable data protection legislation, including the Digital Personal Data Protection (DPDP) Act, 2023 (India) and international privacy benchmarks.
02Personal & Sensitive Data We Collect and Why
Virica is an emergency response utility. We strictly limit data collection to the minimum information indispensable for personal safety, autonomous guardian alerts, and forensic preservation:
- Android Permissions:
ACCESS_FINE_LOCATION,ACCESS_COARSE_LOCATION,ACCESS_BACKGROUND_LOCATION. - Purpose: Pinpoint exact GPS coordinates during active SOS alerts, transmit live tracking links to emergency contacts even when the app is closed or locked, enable Journey Watch safe transit monitoring, and notify you when within range of Verified Safe Zones (police stations, hospitals).
- Handling: Location coordinates are processed exclusively during active SOS or Journey Watch sessions. We never track your coordinates in the background during normal idle usage.
- Android Permissions:
CAMERA,RECORD_AUDIO. - Purpose: When an emergency SOS is triggered, Virica can automatically capture stealth photo/video snapshots and ambient audio of the immediate vicinity to protect forensic proof in case your phone is grabbed, damaged, or snatched.
- 24-Hour Tamper Lock: Recorded evidence is encrypted and subject to a mandatory 24-hour tamper-proof lock to prevent coerced deletion under duress. Following 24 hours, the user has unhindered right of erasure.
- Android Permissions:
READ_CONTACTS,SEND_SMS,CALL_PHONE. - Purpose: Allows you to pick emergency guardians from your contacts list, transmit SMS distress messages with live GPS tracking links when cellular data fails, and invoke 1-tap direct dialing to National Hotlines (112) or your primary guardian.
- Android Permission:
BIND_NOTIFICATION_LISTENER_SERVICE. - On-Device Processing: Inspects only verified cab notifications (Uber, Ola, Rapido, BluSmart, Namma Yatri) to automatically extract vehicle license plates and driver details into your Journey Watch countdown.
- Strict Isolation: Personal chat messages, banking alerts, SMS, and emails are completely ignored and never accessed or transmitted.
- Parameters: Android ID, Device Model, Manufacturer, and OS Version.
- Purpose: Binds your active account to your specific physical device, preventing fraudulent duplicate account creation, unauthorized disarm attempts, or session hijacking during an active distress event.
03Data Storage, Encryption & Security Architecture
All communications between Virica and our backend infrastructure are secured with TLS 1.3 / HTTPS encryption. Cloud databases enforce cryptographically authenticated Row Level Security (RLS), meaning only your verified login credentials can query your private safe zones, guardian contacts, or forensic evidence.
To prevent coerced deactivation, disarming an active SOS requires biometric authentication (fingerprint/face recognition) or your private Disarm PIN. Virica also features a Duress PIN system, which appears to disarm the alarm on screen while silently dispatching high-priority distress signals to your guardians.
04Third-Party Infrastructure Providers
Virica utilizes a minimal, vetted set of infrastructure partners solely to deliver essential emergency capabilities:
- Supabase: Encrypted PostgreSQL database and object storage for user profiles and Evidence Vault records.
- Google Play Services & Google Maps: Real-time device geolocation, reverse geocoding, and map rendering.
- Firebase Crashlytics: Anonymized application crash logs and diagnostics to ensure maximum uptime and zero-crash reliability during physical emergencies.
We do NOT integrate third-party advertising SDKs, commercial data brokers, or marketing telemetry tools.
05Data Retention & Right to Erasure (Account Deletion)
You retain absolute ownership and control over your personal data:
- Evidence Vault Deletion: After the 24-hour forensic lock, you can permanently delete any media file from your vault.
- In-App Account Erasure: Go to Settings → Account → Delete Account to permanently wipe your profile, contacts, safe zones, and stored evidence.
- Web / Email Erasure Request: If you cannot access your mobile phone or have uninstalled the app, email your registered phone number to virica@nirmeva.com. Data erasure requests are processed within 48 hours.
06Protection of Minors & Verifiable Parental Consent (DPDP Act 2023)
In full compliance with Section 9 of the India Digital Personal Data Protection Act, 2023 and Google Play Families Policies:
- Virica strictly prohibits commercial behavioral profiling, targeted advertising, or data monetization concerning minors.
- Users between the ages of 13 and 17 must provide verifiable parental/guardian consent during registration. The registered parent is bound as the primary emergency contact.
- Parents maintain the unilateral statutory right to review, update, or revoke consent and trigger immediate data deletion at any time.
07Statutory Grievance Redressal & Contact Information
In accordance with the Digital Personal Data Protection Act, 2023 and the Information Technology Rules, 2021, any questions, inquiries, or statutory grievances may be directed to our designated Grievance Officer: