Privacy Notice

Last updated: 11 October 2026

The short version

MeetBites is a web app in an invite-only beta in India. It is for people aged 18 and over.
We collect what you give us (profile, photos, plans, chats), a rough location if you allow it, and technical data such as your IP address.
Three things are sensitive and each needs its own consent, unticked by default: who you want to meet (it can reveal sexual orientation), the selfie face match (biometric) and your approximate location. You can withdraw each one in Settings.
If you allow push or give an email, we may message you outside the app about your own plans, and remind you after a few days away. You can switch each kind off in Settings, under Outside the app. We never message between 10 pm and 8 am for these, and never more than 5 a day.
We never sell your data and we run no advertising and no tracking cookies.
We never store selfie images or face data. We keep only pass or fail, the method and the date.
Your data is stored on Google Cloud in the United States. Some of our processors are in the United States too. A copy of security logs is kept in India.
You can download your data, delete your account and withdraw consent in the app. Deleting leaves a small, locked record for a fixed time, listed in the retention table.
Questions or complaints: our Grievance Officer, [email protected].

1. Who is responsible for your data

MeetBites Private Limited (“MeetBites”, “we”) decides why and how your personal data is used. Under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we are the Data Fiduciary and you are the Data Principal. This page covers the meetbites.com website and the MeetBites web app. Our contact for anything about your data is the Grievance Officer: [email protected].

MeetBites is a web app. There is no separate app to download from a store, so everything here applies to the web app only.

2. This is your notice

This page is our notice under section 5 of the DPDP Act and rule 3 of the DPDP Rules, 2025. It lists the personal data we process and the specific purpose of each use. It also tells you how to withdraw consent, how to exercise your rights and how to complain to the Data Protection Board of India. We follow it now, ahead of the date those rules start to apply. Hindi and Telugu translations are available through the language switcher at the top of this page. If they differ, the English version prevails.

3. What we collect, and why

Items marked Sensitive need your separate consent before we use them.

Data	What it is	Why we use it
Account	Your email address or Google account ID, and how you sign in.	To create and secure your account.
Registration record	Your IP address and the country it points to, your browser and device type, the time you signed up, the invite code you used and who invited you.	To keep the service secure, stop abuse and meet our legal duty to keep registration details (IT Rules 2021, rule 3(1)(h)).
Profile	First name, date of birth (we show an age, never the date), gender, photos, bio, occupation, education, height, languages, answers to prompts, activity interests and city.	To show your profile to the people you plan with, to check that you are 18 or older, and to match eligibility for plans.
Country of residence	The country you tell us you live in.	To decide whether MeetBites is available to you.
Sensitive Who you want to meet	Your “interested in” choice, for example men, women or everyone. This can reveal your sexual orientation.	Only to choose which plans we show you. We never show it to other people. We ask for your separate consent first.
Sensitive Approximate location	A rough point from your device if you allow it (never your exact spot), or the city you type.	To show plans near you. We ask for your separate consent before using your device location. Typing a city needs no consent.
Sensitive Selfie check (face match)	A live selfie that is compared with your profile photos. This creates a scan of your face geometry (a biometric identifier), processed for us by Amazon Web Services. We keep only the result: pass or fail, the method and the date.	To confirm that you are a real person who matches your profile photos, and to prevent impersonation and fraud. We ask for your separate consent first. See the Biometric Policy.
Verification without a face scan	If you choose it: a photo or short video of you holding a code word, which a person reviews. We keep only the result and the method.	The same purpose as the selfie check, without biometric processing.
Optional ID verification	Optional, and only once it is switched on. A licensed ID-verification vendor (to be named when enabled) checks a government ID, an Aadhaar or DigiLocker-style check, in its own flow, where you give your consent to it. We receive only the result: that you passed, that you are 18 or older, the method, the time and the vendor’s reference. We never receive or keep your ID number, ID images or date of birth.	To let you show an “ID verified” badge to the people you plan with. It is separate from the selfie check and it does not check your background. The result is deleted with your account.
Plans, comments and likes	Plan titles, descriptions, times, venues, the plan type, who pays, an optional vibe and expectations line, the comments people write on plans (public ones are visible to everyone who can see the plan; private ones only to the host and the commenter), and which plans and public comments you like. The public listing shows the venue name and a location rounded to about 1 km. The exact address is shared only with the person the host picks.	To run the plans you post or join.
Chat messages	Messages in the chat for a plan. Only the two people in it can read it. We screen messages for abuse.	To let the two of you arrange the date.
After-plan check-ins	Your private answers to the check-in that follows a plan. They are not shown to anyone.	To spot safety problems and to count good dates for the newcomer rules.
Safety records	Reports you make, reports that involve you, blocks you set (private), warnings, hides, suspensions, the decisions we record about your account and your appeals.	To keep people safe, to tell you what we did and why, and to let you appeal.
Share my date links	If you create one: the two first names, the other person's photo and verified status, the venue address and the times. Anyone with the link can see this until it expires or you cancel it. We do not collect your friend's phone number or email.	To let you show a friend where you will be.
Consent records	For each consent: what it was for, the version of the wording, whether you gave or withdrew it, the time and your browser type.	To prove what you agreed to, and to honour withdrawals.
Product events	Which setup step you reached, a few counts the screen showed (such as how many plans were coming up), milestones such as finishing your profile, your first plan or comment, a pick, a check-in after a date, a verification step or a share link, and one mark for each day you open the app. Each carries your account ID, a random id made for each visit where the screen sends one, and the time we received it. A public page view (the landing page or a static page) is recorded without any account ID. No IP address, no browser details, no free text.	To see where people get stuck and which parts of MeetBites people use, so we can improve them. It is not used for advertising and is never shared.
How you found us	When you first visit, your browser keeps in its own storage the labels on the link you came from (the five utm_ values, if present), the website that sent you (its domain only), the page you landed on (its path only, never a code or token) and whether you arrived with an invite. We attach this to your sign-up record once, when you sign up or join the waitlist, and we never read it again. Your invite code itself is not stored with it.	To learn which links and campaigns bring people to MeetBites. It is deleted with your account (the waitlist copy only holds the source label). We use no third-party tracker for this.
Daily totals	Counts and percentages built from product events: how many people signed up, finished setup, returned after 1, 7 and 30 days, or redeemed invites, by source. They hold no account ID, name or contact detail.	To measure how MeetBites is doing without looking at any one person.
Activity	When you last used MeetBites.	To delete accounts that have been unused for a long time (see the retention table), and to time a come-back reminder (section 3b).
Notifications and settings	Your notification and privacy switches, and a web push token if you turn push on.	To send only the notices you chose.
Messages outside the app	Which notification was sent to you, by push or by email, and when; your count for the day; any push held for the morning; and your switches with the time you last changed each. To word the come-back reminder we use your approximate area (activity, area and day of nearby plans, never an exact venue or time). See 3b.	To tell you about your own plans and remind you of plans near you, only as you have allowed, and to keep to the daily limit.
Complaints	Your name, email and what you tell us when you use the grievance form or write to the Grievance Officer.	To answer you and to keep a record of how we answered.
Waitlist	Your email, country, city and where you heard about us.	To invite people city by city. We do not send marketing email, and invites are sent by hand.
Removal and ban list	If we remove you for abuse or fraud: a one-way scrambled code (a hash) of your email address and of your phone number if we have one, the invite you joined with and who issued it. We do not keep the address or the number in this list. If two or more people one member invited are removed, that member's invites are paused and our team reviews them.	To stop a removed person from joining again with the same Google account or the same phone number, and from using another member's invite. See the retention table for how long.
Technical and security logs	Sign-up, access, admin and moderation events with IP address, country, browser and time. Our hosting providers also keep standard server logs.	To detect and investigate abuse and unauthorised access, and to meet legal log-keeping duties.

3a. Payments

This applies only if you buy MeetBites Plus or a Boost. See the Refund policy for prices and refunds.

What we collect. Your orders, the payment ledger, GST invoices and credit notes, your subscription and auto-renewal (mandate) record, and the gateway’s reference ids. We never receive or store your card or UPI numbers. They stay with the payment gateway.
Why. To take your payment, renew or cancel your subscription, give refunds, issue GST invoices, remind you before a renewal and keep the accounts the law requires.
Legal basis. It is needed to perform the purchase you asked for, and to meet our tax and accounting duties. It is not based on consent, so you cannot withdraw it for records we must keep.
Who processes it. An RBI-regulated payment gateway: Cashfree, PayU or Razorpay, whichever is active. It is shown in the sub-processors list.
How long. 96 months (8 years) from the payment, even after you delete your account. When you delete your account, your name is removed from invoices.
Deleting your account. It cancels any subscription, so you are not charged again.
Your data export. It includes your payment records.

3b. Messages outside the app

This covers the push notifications and emails we send when the app is closed about your plans and about coming back. Safety, moderation, check-in, verification, billing and legal notices are separate service messages and these switches do not hold them back.

What we send. (a) Plan moments about your own plans: someone comments on your plan, you are picked, a plan of yours is on today, or a friend joins with your invite (we do not name the friend). They go as a push first, and as an email only if the push could not reach you. (b) Come-back reminders: a short note if you have not opened MeetBites for 3, 7 and 14 days, at most one at each stage and none once you are back. It goes as a push, and by email only if you switch that on. It can say how many plans are near you.
What data we use. The time you last used MeetBites, your web push token, your email address, what happened on your plan, your approximate area (to count nearby plans, by activity, area and day, never an exact venue or time) and your notification switches.
Why. To tell you about things on your own plans and to remind you of plans near you if you have been away. It is not advertising, and we never share it.
Legal basis. Plan moments are about your own plans and are a use you ask for by using plans and allowing notifications. The come-back push and email rest on your consent: you allowed push in your browser, or you switched the email on yourself. You can withdraw either at any time. Every change you make is saved with its time as the record of your consent.
Quiet hours and limit. No push between 10 pm and 8 am India time: a held push goes out at about 8 am, unless you have read it or come back. Emails are not held. At most 5 plan-moment or come-back messages a day, by push or email together.
How to switch them off. Settings, Outside the app: Plan moments, Email me if push can’t reach me, Come-back reminders and Email me come-back reminders. Every such email also has an unsubscribe link that turns off only that kind of email, so push and the other kind stay as you set them. You can also block notifications in your browser.
How long. The delivery records are deleted 35 days after they are written, and a held push 2 days after it was due (see the retention table). Your switches stay until you delete your account. They are in your data export.

4. The legal basis for each use

Purpose	India (DPDP Act 2023)	For later countries
Run your account, profile, plans and chat	Your consent when you create an account and use the features, and uses you voluntarily ask for	Contract (GDPR-style Art. 6(1)(b))
Safety, reports, moderation, fraud prevention	Legitimate uses and legal obligations	Legitimate interests (Art. 6(1)(f)) and legal obligation
Who you want to meet, the selfie face match, approximate location	Your specific, separate, unticked consent. You can withdraw it at any time	Explicit consent (Art. 9(2)(a)) for orientation and biometric data
The removal and ban list (a one-way hash of your email and phone, the invite you used and who issued it)	Legitimate uses: preventing fraud and abuse	Legitimate interests (Art. 6(1)(f))
Plan moments (a comment on your plan, being picked, a plan today, a friend joined) by push, or by email if push did not reach you	A use you voluntarily ask for: you use plans and have allowed push or given your email, and you can switch it off at any time	Contract (Art. 6(1)(b))
Come-back reminders by push (on until you switch it off) and by email (off until you switch it on)	Your consent. For push, you allowed notifications in your browser; for email, you switch it on yourself. You can withdraw either at any time	Consent (Art. 6(1)(a))
Registration records, logs, lawful orders	Obligations under Indian law (IT Rules 2021, CERT-In directions, DPDP Rules 2025)	Legal obligation (Art. 6(1)(c))
Answer rights requests and complaints	Legal obligation	Legal obligation

If you withdraw a consent, we stop that use. Withdrawing does not undo what we did lawfully before you withdrew.

5. Your three consents

We ask for each of these on its own, with an unticked box, at the moment it is needed. Reading the Terms is separate from any consent, and we never bundle a consent into them.

Who you want to meet. Until you tick the box the choice shows “Everyone”. If you withdraw, your choice is reset to “Everyone”.
Approximate location. If you withdraw, we delete your stored location. You can still type a city.
Selfie face match. If you withdraw, we remove your photo-verified badge and delete your verification record. You can verify with a person instead.

Withdraw any of them in Settings, under Privacy and consents. It is as easy as giving them.

Other members see your public profile (first name, age unless you hide it, gender, city, photos, bio and the other profile fields you fill in), your plans, and a verified badge (photo or ID) if you have one. They never see your date of birth, email, exact location or “interested in” choice. The person a host picks also sees the exact venue address.

Our processors handle data for us under written terms: Google (Firebase and Google Cloud, Google Maps Platform, Cloud Vision), Amazon Web Services (selfie check), a licensed ID-verification vendor (optional ID check; it will be named on that page when the check is switched on) and a few others. The full list, with what each receives and where, is on the Subprocessors page. The payment gateway (Cashfree, PayU or Razorpay, whichever is active) is listed there too. See Payments below.

Authorities. We disclose data when a court or an authority lawfully requires it, for example under rule 3(1)(j) of the IT Rules 2021.

We do not sell your personal data, we do not share it for advertising, and MeetBites shows no advertising.

7. Where your data goes

Your account data is stored on Google Cloud in the United States (Firestore multi-region in the US, functions in us-central1). Amazon Web Services processes the selfie check in a United States region. Outside the US, a copy of security-relevant logs is kept in a Google Cloud bucket in India (Mumbai) for 180 days. The DPDP Act allows transfers outside India unless the government restricts a country. No restriction has been notified as of the date above. We will update this page if that changes.

8. How long we keep it

We keep data only as long as it is needed. This table is the same schedule our systems apply.

What	How long	Why
Your profile, photos, plans, comments, likes and notifications	Until you delete your account or it is deleted for inactivity	To run the service for you
An account with no activity	Deleted after 24 months without use, with notices 30 and 7 days before	We do not keep data we no longer need
Chat messages	Deleted 12 months after the chat closes	Chats exist for the date; a reported chat is kept while a case is open
Product events: which setup step you reached, first actions such as a first plan or comment, a random id for each visit and your account ID (no IP address, no free text)	Deleted 13 months after they are recorded, or sooner when you delete your account or it is deleted for inactivity	To see where people get stuck and which parts of MeetBites people use, so we can improve them
Daily and weekly totals built from product events (counts and percentages only, no account ID, name or contact detail)	Kept while MeetBites runs	To measure sign-ups, setup, retention and invites without looking at any one person
Records of messages sent to you outside the app: which notification went to you, by push or by email, and when, your count for the day, and any push held until the morning (never the words of the message)	Deleted 35 days after they are written; a push held for the morning is deleted 2 days after it was due; all deleted when you delete your account	So that each message is sent once, to keep to the daily limit and to retry safely
Payment records: orders, the payment ledger, GST invoices, subscription and mandate records and payment-gateway receipts (amounts, dates, what was bought, your account ID; never a card or UPI number)	96 months (8 years) from the payment, even if you delete your account; your name is removed from invoices when you delete your account	Indian tax and company law (CGST Act section 36 and the Companies Act) requires accounts and invoices to be kept
If we remove you for abuse or fraud: a one-way scrambled code (hash) of your email address and phone number, the invite you joined with and who issued it. Never the address or number itself	24 months after the removal, even if you delete your account; deleted at once if the removal is reversed	Our legitimate interest in stopping a removed person from re-joining under another invite (fraud and abuse prevention)
Selfie images and face data	Never stored by MeetBites; not kept by our processor after the check	Only the pass or fail result and the method are kept
A photo or video sent for the manual verification alternative	Deleted as soon as a reviewer decides; an unreviewed upload is deleted within 7 days	Only the pass or fail result and the method are kept
Registration details (email or sign-in ID, name, date of birth, gender, sign-up IP address and time, consent records)	180 days after you delete your account, in a locked store	IT Rules 2021, rule 3(1)(h)
Reports and moderation records involving you	180 days after you delete your account, or 12 months for confirmed serious abuse, in a locked store	IT Rules 2021, rule 3(1)(g)
Security logs	365 days (1 year)	DPDP Rules 2025, rules 6 and 8(3)
India-region copy of security-relevant logs (sign-up, admin and moderation actions)	A rolling 180 days	CERT-In directions of 28 April 2022
Complaints you send us and our answers	36 months; your name and contact details are removed if you delete your account	To answer disputes within the limitation period
Anything under a lawful order	Until the order ends	A court or authority can require us to keep it

The locked store. When you delete your account, or we delete it for inactivity, we purge your live data. We move only a small set into a separate, locked store that no app screen can read: your registration details, reports and moderation records that involve you, and security logs. Named staff can open it only to answer a lawful order, and every opening is logged. It is deleted automatically when its period ends, unless a court or authority requires us to keep it longer. When you delete your account we show you exactly what is kept and until when.

Chats. If you delete your account, your messages stay in chats with other people until the chat is deleted on the schedule above, and you appear as “Deleted user”. A reported chat is kept while the case is open.

9. Your rights, and how to use them

Access. Settings, Download my data. It gives you what we hold about you as a file. You can also ask who has received your data (see Subprocessors).
Correction. Edit your profile in the app. Your first name, date of birth and gender are locked once your profile is complete: write to us to correct them.
Erasure. Settings, Delete account. Some records are kept for a fixed time because the law requires it (section 8).
Withdraw consent. Settings, Privacy and consents.
Grievance redressal. Write to the Grievance Officer or use the complaint form. We acknowledge within 24 hours and resolve within 7 days. Details are on the Grievance page.
Nominate someone. You can nominate a person to exercise your rights if you die or cannot act. Write to [email protected].
Complain to the Data Protection Board of India. If you are not satisfied with our answer, you can complain to the Board.

When MeetBites opens in other countries we will add the rights that local law gives you.

10. Age

MeetBites is for adults. You must be 18 or older. We check your date of birth when you set up your profile, we do not allow under-18 dates of birth, and we delete any account we find belongs to a person under 18. If you think a member is under 18, report them in the app.

11. Automated checks and decisions

Some checks are automated: screening of text and photos, hiding a profile or plan after reports, the venue check on a new plan, and the pass or fail of the selfie check. We never hide or restrict you without telling you. Every restriction comes with a plain statement of what happened, the ground, whether a computer made the decision, and how to appeal. You can appeal in the app, under Settings, Account status, within 30 days, and a person decides. We do not publish the thresholds our checks use, because that would help people avoid them.

12. Security and breaches

Data is encrypted in transit and at rest by our cloud providers. Access to the locked store is limited and logged. If a breach affects your personal data, we will tell you without delay. We report certain incidents to CERT-In within 6 hours of noticing them, and we tell the Data Protection Board of India without delay and then in detail within 72 hours.

13. Cookies and browser storage

We use no advertising or tracking cookies and no third-party analytics. We do record first-party product events on our own servers (section 3, “Product events”): they carry no cookie, no IP address and no free text. The app keeps data in your browser only to work: your sign-in session, security checks, your settings and drafts, files that let the app load faster, and, from your first visit, the short “how you found us” note described in section 3 (it is kept for 30 days or until you sign up, and it is never sent to anyone else). The security check (App Check) uses Google reCAPTCHA Enterprise to tell people from bots, and Google receives technical information such as your IP address when it runs.

14. Availability, invites and your country

MeetBites is an invite-only beta and is open only in countries where we have launched. Today that is India. To apply this, we look at the country of your IP address and at the country you tell us you live in. If MeetBites is not available where you are, you can join a waitlist. We do not offer a waitlist in countries where we cannot offer the service at all.

15. Changes to this notice

If we make a material change we will tell you in the app before it takes effect and show the new date at the top.

16. Contact

Privacy questions, rights requests and complaints: [email protected]. General questions: [email protected].