Data
Five Things, Assembled Into One Identity
Individually ordinary. Together they are the package, and no policy describes what happens to it.
No privacy policy, retention period, purpose statement or deletion route appears anywhere on the operator's pages.
What gets collected, in order
- 1
A phone numberAt registration. Also the credential and the recovery channel — which is why it carries so much.
- 2
A payment instrumentAt the first deposit. A bank account or UPI identifier, linked permanently to the rest.
- 3
A photo identity documentAt the first withdrawal — what the request involves.
- 4
An addressUsually via a utility bill or statement, in the same request.
- 5
A photograph of youFrequently holding the document, to link face to name.
The order matters as much as the list. The first two are given casually and early; the last three are given at the point of retrieving money, when declining costs a balance.
Why the assembly is the risk
A phone number on its own is a phone number. A phone number with a verified name, a face, an address and a linked bank identifier is an identity package sufficient to impersonate somebody. What makes it sensitive is not any element but the fact that they sit together and have been verified against each other.
That is exactly what a licensed operator’s data obligations exist to govern: who may see the package, how long it is kept, what else it may be used for. None of that is published here, and no regulator is named that would impose it.
What else an application can see
Beyond what you type, an installed application may access whatever permissions it requests, and a directly downloaded package is reviewed by nobody before installation. A card game needs very little; requests reaching contacts, messages or device-wide files go well past it.
The referral mechanic gives a commercial reason for one of those in particular — an address book is exactly what a referral programme runs on. That is not an accusation; it is a reason to read a permission prompt rather than dismiss it.
What is worth doing
Decide about the identity package before depositing, not at the withdrawal. Use a number that is not shared. Read permission prompts. And treat deletion as unavailable, because there is no published route and no contact to request one through.
If the account is to be ended, closure is undocumented too, which means the data question outlives the account. The overview explains how each claim here was sourced.
Frequently asked
What data does the app collect?
A phone number, a payment instrument, a photo identity document, an address and usually a photograph of the account holder. The first two early, the rest at the first withdrawal.
Is there a privacy policy?
None appears on the operator's pages. No retention period, purpose statement or deletion route is published, and no regulator is named that would impose obligations.
Can I have my data deleted?
There is no published route and no support contact through which to ask, so deletion should be treated as unavailable when deciding whether to hand anything over.