afterhours Privacy Policy
Last updated: 30 October 2026 · Version: 2026-10-draft
The short version
- We're built so nobody sees you unless you both choose each other. There's no browsing, no public profile and no feed.
- Your birthday never leaves your phone. We only learn that you're 18 or over.
- Your verification selfie is seen only by our moderators. It's never shown to members, never used to train AI, and deleted when you delete your account.
- We never post to LinkedIn, message your contacts, or contact your employer (unless the law requires it).
- You can download or delete your data at any time. Deletion is finished within 72 hours.
- We don't sell your data and we don't run ads.
1. Who we are
afterhours ("we", "us") is operated by afterhours, Bengaluru, Karnataka, India, India. We are the Data Fiduciary for your personal data under the Digital Personal Data Protection Act, 2023 ("DPDP Act").
Contact: privacy@tryafterhours.app · Grievance Officer: see section 11.
2. Who this applies to
This policy covers anyone who uses the afterhours app or website. The app is only for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn we have, we delete it.
3. What we collect, why, and who sees it
Waitlist (website). If you join the waitlist, we store your email, the tech park or building you chose, your gender, optional company, the time you agreed, and a one-way code (hash) of your network address for spam protection. We use it only to invite you when afterhours opens near you, and to understand where to launch first. Only our team can see it. It's never shared or shown to anyone, and a building name you type yourself is never added to any public list. We delete waitlist entries 12 months after we open, or sooner if you ask (privacy@tryafterhours.app).
| Data | Where it comes from | Why we use it | Who can see it |
|---|---|---|---|
| Name, email, LinkedIn photo, LinkedIn account ID | LinkedIn sign-in (with your permission) | Create your account. One LinkedIn account = one afterhours account | Name and photo: only your mutual matches. Email and ID: only us |
| Your LinkedIn profile link | You paste it | Moderators check your workplace badge | Only moderators |
| "Over 18" yes/no | Calculated on your phone from your birthday. The birthday itself is never sent | Keep minors off the app | Only us |
| Company, tech park or building, designation, team, level | You | Verification and matching | Moderators. Your mutual matches. Company, team and level only, if you buy Partial Reveal on a Spark you sent |
| Gender (and optional self-description) | You | Help the right person find you | Moderators and your mutual matches |
| Live verification selfie and liveness scores | Your camera, during onboarding | Confirm you're a real person, and that gender fits for Man/Woman | Only moderators. Each view is logged |
| Profile photo (one) | You | Shown to someone you've mutually matched with | Moderators and your mutual matches |
| Sparks you send (the target's name, company, gender, optional details, optional note) | You | Find a mutual Spark | Only you and our matching system. The person you Spark never sees your Spark unless they Spark you too |
| Chat messages | You and your match | Deliver your conversation | You and your match. Moderators only if a message is reported |
| Reports and evidence | You, when you report | Keep members safe | Only moderators |
| Purchases (product, price, time) | Google Play | Deliver what you bought, refunds, tax | Only us. We never see your card or UPI details |
| Device and notification token, app version, crash logs | Your device | Send notifications, fix bugs, prevent abuse | Only us |
| Consent and acknowledgement records (time, policy version) | Your actions | Prove consent; POSH acknowledgement | Only us |
We don't collect precise GPS location, your contacts, your LinkedIn connections, or your birthday.
4. How matching and AI work
- Matching: when you send a Spark, our system checks it against verified members at that company. Your Spark is sent to our matching model only if at least one verified member could match. A match is created only when both people have Sparked each other.
- Anonymity, and its limits: we never tell anyone who Sparked them unless it's mutual. Notifications are grouped and delayed, and numbers are shown in ranges, so they can't be used to guess who's on the app. But we can't stop people guessing. In a small team, someone may work it out. Please Spark kindly.
- Notes on Priority Sparks are checked by an automated safety filter before delivery.
- Selfies: an on-device liveness check runs, then a server-side anti-spoofing check. A human moderator makes the final decision. We don't use automatic face matching between your selfie and your photo.
- We do not use your messages, selfie or photos to train AI models.
5. Legal basis
We process your data with your consent (DPDP Act, s. 6), which you give during onboarding. We also rely on legitimate uses (s. 7), such as complying with law, court orders or a medical emergency. You can withdraw consent at any time (section 8). Withdrawing means we can no longer provide the service, so your account will be deleted.
6. Who we share data with
We never sell your data. We share it only with:
| Type of provider | Why | What they receive |
|---|---|---|
| Cloud hosting and storage | To run afterhours and store your data securely | Account and app data. Stored in India |
| To sign you in | Only the sign-in request. We never post or message | |
| App stores | Purchases (if paid features are offered) and app delivery | Purchase records. We never see your card or UPI details |
| Notification services | To deliver push notifications | A device token, plus neutral alert text |
| Verification and safety tools | Liveness checks, name matching, content safety | Only the minimum needed for that check, never used to train their models |
| Email providers | Support replies and service emails | Your email address and our messages |
All providers act only on our instructions, under contracts that require them to keep your data confidential and secure.
We may also disclose data: - to authorities, when the law requires it or there's a valid court order; - to protect someone's life or safety; - to a buyer, if the business is sold. You'll be told first.
We never share your data with your employer, except where the law requires us to.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | Until you delete your account. Accounts inactive for 2 years are deleted after a warning |
| Verification selfie | Until you delete your account. Erased within 72 hours of deletion |
| Unverified Sparks (Held/Sent) | Expire after 6 months |
| Chat messages | Hidden 24 hours after a match, unless extended. Deleted 30 days after the chat locks. Deleted immediately if either person unmatches |
| Reports and evidence | 1 year after the report is closed |
| Banned accounts | Only a one-way code (hash) of the LinkedIn ID, to stop re-signup. No name, photo or other profile data |
| Purchase records | As long as tax law requires (currently up to 8 years) |
| Security and audit logs | 1 year. Anonymised when you delete your account |
| Waitlist entries | Until we invite you, then 12 months, or sooner on request |
8. Your rights (DPDP Act)
You can: - access a summary of your data and download it (Settings → Your data); - correct your details. Workplace changes need re-verification. Your name comes from LinkedIn and can't be edited; - delete your account (Settings → Delete account). It's deactivated at once and erased within 72 hours; - withdraw consent, which is the same as deleting your account; - nominate someone to exercise these rights if you die or become unable to; - complain to our Grievance Officer (section 11), then to the Data Protection Board of India.
Your data export includes your profile, your own Sparks, your purchases and your consents. It never includes other people's data.
9. Security
We protect your data with industry-standard safeguards. That includes encryption in transit and at rest, strict access controls so members can only reach their own data, two-step sign-in for our team, logging of every access to verification selfies, and secure storage of sign-in details on your phone. Your data is stored in India. If a breach affects you, we'll tell you and the Data Protection Board as the law requires.
10. Changes
If we change this policy in a meaningful way, we'll tell you in the app and ask for consent again where the law requires it. The version you agreed to is recorded with your account.
11. Grievance Officer
Grievance Officer, afterhours · grievance@tryafterhours.app · Bengaluru, Karnataka, India
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. That is faster than the legal maximum.