Cerco privacy policy · Flowon Labs

Cerco is built to keep as little about you as it can. Chat clears after 24 hours, crash reports use an anonymous ID, and you can delete your account at any time. This policy explains the details.

1. Who we are

Cerco is an Android app made by Flowon Labs Private Limited (CIN U62011OD2026PTC055461), registered office Sakhipara, Bank Colony, Nr. Convent School, Sambalpur – 768001, Odisha, India(“Flowon Labs”, “we”). For the personal data handled in Cerco, we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”).

This policy covers the Cerco app. Our website has its own privacy notice.

2. What we collect and why

We process your personal data on the basis of your consent, which you give when you create an account, and for the uses the DPDP Act allows without consent (for example, to comply with the law). To confirm: lawyer: confirm the consent notice and lawful uses

Data	Why we use it	How long we keep it
Account: sign-in details To confirm: email / phone / Google: confirm, display name To confirm: profile photo?	To create your account, sign you in and show your name to your circles.	Until you delete your account.
Circles: which circles you belong to and your role in them	To show you your circles and let members find each other.	Until you leave the circle or delete your account.
Chat: messages, replies, reactions, forwards To confirm: photos in chat?	To deliver messages to your circle.	Cleared after 24 hours.
Meet: your voice during a call	To carry live voice calls between circle members.	Not recorded or stored To confirm: confirm.
Split: shared costs you enter and who owes whom	To keep the circle's balances.	To confirm: confirm
Stash and Library tools: items you add, your activity To confirm: confirm what is stored	To run these features.	To confirm: confirm
Notification token: an ID for your phone from the push service	To send you notifications.	Until you sign out, turn notifications off or delete your account.
Crash reports: anonymous ID, device model, Android version, app version, error details	To find and fix bugs.	To confirm: Sentry retention, e.g. 90 days
Support messages: what you send to support-cerco@flowonlabs.com	To answer you and handle your requests.	To confirm: e.g. 1 year after the conversation ends

We do not sell your personal data, show ads in Cerco, or use your data for advertising. To confirm: confirm: no ads, no analytics SDK in the app

3. Phone permissions

Microphone: used only for Meet voice calls, while you are in a call. Android asks for permission the first time.
Notifications: to alert you about new messages, reactions to your messages and Meet invites.
To confirm: Camera / photos / storage: list any other permission the app asks for

You can change permissions at any time in your phone's settings.

4. Notifications

Notifications are delivered through Expo's push service and Google's Firebase Cloud Messaging. A notification shows the sender's name and a preview of the message, so that content passes through these services on its way to your phone, and may be visible on your lock screen depending on your phone's settings.

You can turn all Cerco notifications off with one switch in the app, or in your phone's settings.

5. Service providers

We use these providers to run Cerco. They process data only on our instructions (as Data Processors) To confirm: lawyer: confirm each provider's data processing terms.

Provider	What it does for Cerco	Where data is processed
Supabase	Database, sign-in and file storage	To confirm: project region
LiveKit	Live voice for Meet	To confirm: region
Expo	Sending push notifications	To confirm: United States?
Google (Firebase Cloud Messaging)	Delivering notifications to Android phones	Google's global network
Sentry	Crash reports (anonymous ID)	United States
Resend	To confirm: sign-in or account emails? confirm use	To confirm: region

We may also share data if the law requires it, for example on a valid order from a court or government authority.

6. Data outside India

Some providers process data outside India, for example crash reports in the United States. The DPDP Act allows this except to countries the Government of India restricts by notification; we will follow any such restriction.

7. Your rights

Under the DPDP Act you can:

ask for a summary of the personal data we hold about you and how we use it;
ask us to correct, complete or update it;
ask us to erase it, or delete your account;
withdraw your consent at any time (this stops the related features; it doesn't affect what we did before);
nominate a person to exercise these rights if you die or become unable to;
raise a grievance with us, and then with the Data Protection Board of India if you are not satisfied.

Write to support-cerco@flowonlabs.com. We will reply within To confirm: e.g. 30 days; lawyer to confirm the period under the DPDP Rules.

8. Deleting your account

In the app: Settings → Privacy & Safety → Delete account. Or by email. What is deleted, what is kept and for how long: Delete your Cerco account.

9. Age

Cerco is for people aged 18 and over. To confirm: confirm the minimum age. Under the DPDP Act, anyone under 18 is a child and needs verifiable consent from a parent; if Cerco allows under-18s, this section and the sign-up flow must change.

10. Security

Data is encrypted in transit between the app and our servers, and access to it is limited by rules in our database so that you see only your own circles. No system is perfectly secure; if a breach affects your personal data, we will inform you and the Data Protection Board as the DPDP Act requires. To confirm: confirm encryption at rest per provider

11. Changes to this policy

If we change this policy, we'll update the date at the top. For important changes we'll tell you in the app before they take effect.

12. Contact and grievances

Questions or complaints about your data: support-cerco@flowonlabs.com.
Grievance Officer: To confirm: name, Flowon Labs Private Limited, Sakhipara, Bank Colony, Nr. Convent School, Sambalpur – 768001, Odisha, India.