Privacy Policy
Last updated: 7 October 2026
This page explains what we collect when you join the waitlist for The Mysterious App, why, and what you can do about it. We keep it short and we collect as little as we can.
Who we are
The Mysterious App waitlist is run by Aavam Innovation, a partnership firm in India ("we", "us"). We decide how your data is used. Contact: social.saporapp@gmail.com.
What we collect
- Your email address, which you give us when you claim a number.
- Your number, ingredient and invite link, which we create for you.
- Your basket and scratch history: each scratch you get and use, why you got it (joining, a friend, a lucky prize), the ingredient it gave you and any lucky prize you won.
- Your daily box and streak history: when you opened each daily box, the streak day it counted as, the ingredient and any prize it gave you, which clue it showed, the sets you completed and whether you are a Master Collector.
- Who invited you, if you joined through someone's link, and who joined through yours.
- Your approximate city and country, worked out from your internet connection when you join. We don't use GPS and we don't ask for your exact location.
- Technical data: your IP address, browser type and the time you joined. We use these only to stop spam and fake sign-ups.
- A small code on your device (in your browser's local storage) so the page can show your number when you come back. It is not used for advertising.
We don't collect your name, phone number, contacts or payment details. We don't use advertising trackers on this page.
Why we use it
- To give you a number and ingredient, and to count the friends who join with your link.
- To email you your link, and to tell you when the app unlocks.
- To show the public count and the "Just joined" feed.
- To run your scratch cards and daily boxes, keep your basket and streak, and give the rewards and lucky prizes you earn under the Rules.
- To prevent fraud, spam and abuse.
We use your data on the basis of your consent, which you give when you claim a number. You can withdraw it at any time (see below).
What other people can see
The public page shows only your ingredient and number (for example "Onion #0348"), your city or country and when you joined. We never show your email. The person who invited you can see that a friend joined through their link, but not your email.
Who we share it with
We don't sell your data and we don't share it for advertising. We use a few service providers to run the page, who process data only on our instructions:
- Cloudflare, which hosts the website and tells us your approximate location.
- Supabase, which stores the waitlist database.
- An email delivery provider, which sends your link and the unlock email.
These providers may store data outside India, for example in the United States or the European Union. We may also disclose data if the law requires it.
How long we keep it
We keep your waitlist data until the app unlocks and for up to 12 months after that, so we can honour rewards. Then we delete it, unless you've started using the app. IP addresses used for spam checks are deleted within 30 days. If you ask us to delete your data, we do it within 30 days.
Your rights
Wherever you live, you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct it;
- delete it and take you off the list (you lose your number and rewards);
- stop emailing you. Every email also has a link to leave the list.
Email social.saporapp@gmail.com from the address you joined with. We reply within 30 days. In India, you can also nominate someone to act for you, and you can complain to the Data Protection Board of India. In the UK or EU, you can complain to your local data protection authority.
Grievances
For any complaint about how we handle your data, write to our grievance contact at social.saporapp@gmail.com with the subject "Privacy". We'll acknowledge it within 48 hours and resolve it within 30 days.
Age
The waitlist is for people aged 18 and over. If you're under 18, please don't join. If we learn that someone under 18 has joined, we delete their data.
Security
Data is sent over encrypted connections (HTTPS). Access to the database is limited to the people who run the waitlist. No system is perfectly secure, but if a breach affects you, we'll tell you and the authorities as the law requires.
Changes
If we change this policy, we'll update the date at the top. If a change is significant, we'll email you before it takes effect.