Privacy Policy - Wave

1. Application Scope & Access

This application is a private, invite-only platform intended solely for authorized personnel. The application has no sign-up or account-creation feature, and user sign-up is disabled in our authentication system. Access is granted exclusively when an administrator manually adds your email address as a user in Firebase Authentication. You can sign in only with a Google account whose email address matches an address added by an administrator. When you first sign in with Google, Firebase links your Google sign-in to the entry the administrator created for your email address.

2. Information We Collect

When you log in using Sign in with Google, the application requests the standard openid, email and profile scopes, and receives the following details from your Google account:

• Full Name
• Email Address (used to verify access)
• Profile Picture / Avatar URL

Our authentication provider, Firebase Authentication, also automatically maintains the following technical information about your sign-in:

• A unique user ID and the sign-in methods linked to your entry
• A password set by the administrator when creating your entry. Email/password sign-in is disabled, so this credential is not used to sign in; Firebase stores it only in hashed form
• Account creation and last sign-in timestamps
• Authentication tokens and session identifiers, which are stored in the app's private storage on your device so that you remain signed in
• Your IP address, which Google may process in its service logs to operate and secure the authentication service
• Limited device and app information (such as app version, device model, operating system version and installation identifiers) that Google's Firebase and Play services may process to operate and protect the service

We do not collect or track location data, contacts, files, photos, microphone or camera data, or any other sensitive personal information. The application does not use the Android Advertising ID and does not include advertising, analytics, or crash-reporting services.

This policy page: This page stores your light/dark theme preference locally in your browser; this is not sent to us. This page is hosted on Cloudflare Pages, and Cloudflare may process standard technical information about your request, such as IP address and browser type, in its server logs to deliver and secure the page. This page also uses Cloudflare Web Analytics, which collects aggregate visit statistics (such as page views, referrer, browser and device type, and approximate country). According to Cloudflare, it does not use cookies or browser storage and does not track individuals across sites.

3. How We Use Information

Collected account information is used strictly to verify your access against the list of users added by the administrator, authenticate your login session, and render your basic profile within the user interface. We do not use your information for advertising, profiling, or marketing.

4. Consent

By signing in with Google and using the application, you consent to the collection and processing of your information as described in this policy. You may withdraw your consent at any time by requesting removal of your access as described in Section 7. Withdrawing consent means you will no longer be able to use the application.

5. Android App Permissions

The Android application requests only the permissions needed to function:

• Internet access: to communicate with Google Sign-In and Firebase Authentication.
• Network state: to detect whether a network connection is available.
• Google services configuration: a standard permission added by Google Play services libraries so the app can read Google services configuration settings. It does not give the app access to your personal data.

The application does not request access to your contacts, location, storage, camera, microphone, or phone.

Images and fonts: Your profile picture is loaded from the URL provided by your Google account and may be cached on your device. App fonts are downloaded through Google Play services. Neither of these sends any information to us.

6. Data Sharing, Service Providers & International Transfers

We do not sell, rent, trade, or transfer your personal data or profile details to third parties, advertisers, or external marketing services.

The service providers involved are Google LLC, through Google Sign-In and Firebase Authentication, which process your information on our behalf to authenticate you; and Cloudflare, Inc., which hosts this policy page and provides basic visit statistics for it, and does not receive your sign-in data. Each is governed by its own privacy terms. The application does not use any other backend database or third-party service at this time.

Google and Cloudflare operate servers in multiple countries, so your information may be processed or stored outside India. Such processing is carried out under their respective security and data-protection commitments.

We may disclose information if required to do so by law or by a lawful order of a competent authority.

7. Data Retention & Account Deletion

Because access is managed on an invite-only basis and accounts are provisioned by an administrator, the application does not include a self-service account creation or delete account option in the interface.

Retention:

Your account details (name, email address, profile picture URL, and the technical sign-in information described in Section 2) are retained for as long as you are an authorized user of the application. Accounts are not automatically deleted for inactivity. An administrator may remove an account only when access is revoked or when a removal is specifically requested.

Requesting Account Deletion:

If you wish to revoke your access and permanently remove your email address and profile data from our systems, you can request deletion at any time by:

• Contacting the administrator who invited you to join the application.
• Submitting a request through our Support Page or emailing our team directly at support@butterflysport.in.

Upon receiving and verifying your request, your user entry will be deleted from Firebase Authentication, which removes your email address, name, profile picture URL, linked sign-in methods and sign-in records, within 30 days. Residual copies may remain in Google's encrypted backups for a limited period before they are overwritten in the ordinary course.

8. Your Rights

In accordance with applicable data protection law, including India's Digital Personal Data Protection Act, 2023, you have the right to:

• Request access to a summary of the personal data we hold about you and how it is processed.
• Request correction of inaccurate or incomplete personal data.
• Request erasure of your personal data (see Section 7).
• Withdraw your consent at any time (see Section 4).
• Have your grievances addressed by our Grievance Officer (see Section 12).
• Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these rights, contact us using the details in Section 12. If you are not satisfied with our response, you may, after raising it with the Grievance Officer, escalate your complaint to the Data Protection Board of India.

9. Data Security & Breach Notification

We protect your information through technical safeguards, including HTTPS/TLS encryption for all data in transit, encryption at rest provided by Firebase and Google infrastructure, storage of session tokens in the app's private storage on your device, and restricted administrative access to the authentication console.

In the event of a personal data breach affecting your information, we will notify the relevant authorities and affected users in accordance with applicable law.

10. Children's Privacy

This application is intended exclusively for authorized adult users and professionals. We do not knowingly collect or maintain personal information from individuals under the age of 18. If we become aware that such information has been collected, we will remove the associated access and data.

11. Policy Updates

We may update this Privacy Policy from time to time to reflect operational, legal or administrative changes. Revisions will be published on this page along with an updated "Last Updated" date. We do not send individual notifications when this policy changes, so please review this page periodically. Your continued use of the application after an update indicates your acceptance of the revised policy.

12. Contact Us & Grievance Officer

If you have any questions regarding this Privacy Policy, wish to exercise your rights, or wish to request data removal, please contact:

Grievance Officer: