Privacy policy

Last updated 16 October 2026

1. What we collect, and why

We do not keep your phone's address book, read your SMS (the sign-in code fills itself in only after you tap Allow, and only that one message is read), track your location in the background, or use advertising trackers.

2. What others can see

• In groups and in chats started from invite links, your number is hidden. People see only your name and photo.
• Group admins cannot see the list of members or their numbers, and are not told when someone joins through a link.
• Read receipts ("blue ticks") and "online" can be switched off in Settings. Switching them off also hides them from you, so it is fair both ways. People you block see neither.
• Bots never see your number. A bot can only message you after you start it, and you can stop it any time.

3. How your messages are protected

Your chats with people are end-to-end encrypted. Messages, photos, voice notes, videos, documents, locations and contacts you share in 1-to-1 chats, groups and broadcast lists are locked on your phone before they leave it, and can only be unlocked on the phones (and linked computers) of the people in that chat. Ellidiya's servers pass them on and keep them so they reach all your devices, but we cannot read them, and nobody else can either: not our staff, not our hosting providers, not someone who breaks into our servers.

• Check it yourself: in a 1-to-1 chat, open the menu and tap "Encryption · security code". If the 60-digit code on both phones matches, nobody is in between. If someone's code changes (usually because they got a new phone), the chat tells you.
• New phone: with a backup PIN, your keys are saved locked with that PIN, which never leaves your phone. We keep only the locked copy, locked a second time with a key kept on a different server, and we erase it after 10 wrong PINs. Choose a PIN that is hard to guess. If you forget it, your earlier messages can't be recovered; without a backup PIN they stay on your old phone only.
• What is not end-to-end encrypted: chats with bots and businesses (their service has to read your messages to answer them, and the chat says so), votes (so they can be counted), Jhalak, your name and profile photo, and group names and photos. A message to someone who has not yet opened the updated Ellidiya is sent without end-to-end encryption until they do.
• What our servers still see: who you chat with and when, who is in a group, and whether a message is text, a photo, a video or a document, and roughly how large it is. Never what it says or shows.
• Reports: if you report a message or a person, your phone sends us the reported messages, unlocked, so our safety team can act on the report. That is the only way we see message content.
• Requests from the law: we disclose information only when Indian law requires it, for example a valid order from a court or a lawful request from a government agency, and we check every request. We cannot hand over what we cannot read.

4. How long we keep things

• Messages: until you or the other person deletes them, or they disappear if you turned on disappearing messages. "Unsend" removes a message for everyone.
• View-once photos: deleted from our servers once opened (or after 14 days).
• Jhalak: 24 hours.
• Server backups: encrypted copies kept for up to 8 weeks, so we can recover from a failure. Disappeared and view-once content is removed from backups too.
• Deleted accounts: see section 6.

5. Your chat backup

If you use Chat backup, your chats are unlocked on your phone and saved to your own Google Drive, in a hidden folder that only Ellidiya can open. Ellidiya keeps no copy. The backup goes straight from your device to Google. You can protect it with a password; then even Google can't read it. If you forget that password, nobody can open the backup. Google's own privacy policy applies to what is stored in your Google account.

6. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• See and correct your information: your name, photo and settings are in Settings, and you can ask us for a summary of what we hold.
• Delete your account: Settings, then "Delete my account". Your name, number, photo, Jhalak, groups, broadcast lists, bots and reminders are removed. Messages you already sent stay with the people who received them, shown as from "Deleted account". As India's IT Rules require, we keep the number of a deleted account, encrypted, for 180 days for lawful requests only, then remove it.
• Withdraw consent at any time by deleting your account.
• Complain to our Grievance Officer (below), and if you are not satisfied, to the Data Protection Board of India.
• Nominate someone to exercise these rights if you die or become unable to: write to us.

7. Who we share with

Only service providers who help us run Ellidiya, under contracts that limit them to that job: our SMS providers (to send sign-in codes: 2Factor for Indian numbers, Twilio for numbers from other countries), our hosting providers (to run our servers), and Google Firebase (to deliver notifications: alerts say who wrote, never what). We do not sell or rent your information to anyone.

8. If you live outside India

Ellidiya also works with mobile numbers from some countries in Europe, the USA and Australia. This section adds to the rest of this policy for you.

• Where your data is: on our servers in the European Union. Ellidiya is run by a company in India and our team works from India, so your information is also accessed from India. Call relays in France and India carry calls; call audio and video pass through them encrypted.
• Europe and the UK (GDPR): we use your information to provide the service you signed up for (contract), to keep Ellidiya safe and stop abuse (legitimate interests), and, for Contacts and alerts, because you allowed it (consent, which you can withdraw in your phone's settings). You can ask to access, correct, delete or export your data, and object to or restrict how we use it, by writing to the email below. You can also complain to the data protection authority where you live. Transfers outside the EU are protected with the safeguards the law requires, such as the EU Standard Contractual Clauses.
• USA: we do not sell or share your personal information for advertising, and we do not use it for targeted ads. You can ask to know, correct or delete what we hold.
• Australia: we handle your information in line with the Australian Privacy Principles. You can ask to access or correct it, and complain to the Office of the Australian Information Commissioner if you are not satisfied with our reply.

9. Children

Ellidiya is for people aged 18 and over. If you believe a child is using Ellidiya, write to us and we will act.

10. Changes

If we change this policy in a way that matters, we will tell you in the app (in Jhalak, from the official Ellidiya account) before it takes effect.

11. Grievance Officer and contact