manzil is a group-travel companion app for friend groups, operated by Forty Two Services ("we", "us"), a company based in India. This policy explains what we collect, what we don't, and how the few things we do collect get used. It's written to be readable in one sitting.
The app is available in every country the App Store and Google Play serve. We are based in India and this policy is written around India's Digital Personal Data Protection Act 2023, which is the framework we operate under. Wherever you live, the rights described below are the ones we will honour, through the same route and on the same timelines, and you can reach us at support@saathmanzil.com.
What We Collect
- Your email address and password. manzil uses email and password as your sign-in credential. Your password is stored as a salted hash, we never see or store it in plain text.
- A display name. Whatever you set so trip-mates can recognise you. Change it anytime.
- Your phone number, only if you choose to add one. It's an optional profile field, contact information, not a credential, and only you can see it on your own profile.
- Trip data you put in. Trip names, expenses, settle-ups, photos, and notes you create or share.
- Location, only when you turn it on. Location sharing is strictly opt-in and time-bounded, you pick a duration (e.g. 4 hours) and the share ends automatically. Pings are visible only to other members of the same trip.
- A notification token, only if you turn notifications on. When you allow notifications, your phone gives manzil a delivery address for that device. We store it against your account so we know where to send a nudge. It is not an advertising id and it identifies a device, not you personally. Turn notifications off in your phone's settings and it stops being used.
What We Don't Collect
- No social-network identity. We don't offer Google, Facebook, or any other social login.
- No location data outside of explicit, time-bounded shares. We never track you in the background.
- No GPS coordinates in your photos. EXIF location metadata is stripped both on your device and on our servers before storage.
- No GPS coordinates are ever sent to any analytics provider. The location you share on a trip stays inside that trip, it never leaves for any third-party tool. Google Analytics on this website infers a city from your network address, which is not GPS and has nothing to do with trip location.
How Your Data Is Used
- To run the app. Your email and password authenticate you. Your trip data syncs to other members of trips you join.
- To send you trip notifications. When someone in one of your trips adds a plan, a photo, an expense you are part of, or starts sharing their location, we can send you a notification. A notification carries the trip's name, the name of the member who did the thing, and a short line about what they did. It can include a count, a rupee amount, or a few words of something already visible to everyone on that trip, like a poll question. It never carries anyone's location, email, phone number, or UPI id. Notifications are off until you turn them on, you can mute any single trip from that trip's home screen, and turning them off in your phone's settings stops them everywhere.
- To send verification and password-reset codes. We email a six-digit code to confirm your address when you sign up, and again if you ever reset your password. No SMS is sent as part of this.
- To improve the product. We use PostHog to record product-usage events tied to your account (for example, that you created a trip or added an expense) so we can see which parts of manzil people actually use. Every event carries only enum, number, or boolean properties, plus a trip id where relevant. We never send free text (expense descriptions, board posts, checklist items), coordinates, your email, or your phone number to PostHog, and we don't record session replays or turn on autocapture. You can switch product analytics off entirely in the app, under Me, and nothing further is sent from that device.
- To see which campaigns bring people here. This website (saathmanzil.com) uses Google Analytics 4 to count visits and to record which link, ad, or post brought you to a page. Google Analytics sets cookies in your browser, notes the page you viewed, a rough location derived from your network address, and your browser and device type. Google does not store your full network address. We have turned off Google Signals and ad personalisation, so nothing here feeds advertising profiles, and we do not run ads. Google Analytics runs on the website only. It is not in the manzil app.
- To connect a campaign to a sign-up. When you create an account we record, once, which campaign the install came from: the three campaign tags from the link you tapped, which platform you installed on, and whether the tags travelled through the Play Store or you entered your code by hand. That is the whole record. It never includes your invite code, your location, or anything you typed. If you delete your account, this record is deleted with it.
Cookies on This Website
The website sets two kinds of cookie, both for measurement, neither for advertising. Google Analytics sets its own cookies on every page to tell a repeat visit from a new one. The invite page at /i also loads PostHog, which sets a cookie so that opening an invite link and installing the app can be counted as one journey rather than two. The manzil app itself sets no cookies. There is no advertising cookie, no cross-site tracking pixel, and no data broker anywhere on this site.
If you are visiting from the EEA or the UK, neither cookie is set. Rather than ask you to dismiss a consent banner, we simply do not load the measurement tags there, so there is nothing to consent to and nothing stored on your device. Your browser tells us its time zone, which is enough to decide this without looking anything up about you or sending your address anywhere. The whole site works exactly the same either way; you are just not counted.
Everywhere else, your browser's own controls (blocking cookies, private browsing, or a tracker blocker) switch both off, and the website works normally without them.
How Long We Keep It
- Active trips: kept as long as the trip exists.
- Archived trips: location pings are purged within 24 hours of archival. Expenses and photos are kept indefinitely, they're the memory keepsake of the trip and trip-mates may still need them.
- Notification tokens: kept until you turn notifications off, sign out on that device, or delete your account.
- Deleted accounts: see the next section.
Your Rights, Account Deletion (DPDP Act 2023)
Forty Two Services is the Data Fiduciary for your manzil account under India's Digital Personal Data Protection Act 2023. The Act gives you a right to delete your account, free of cost. Here's how:
- How to ask: in-app, from Me → Delete Account. If you can't get into the app, email support@saathmanzil.com from the email address on your account with the subject line "Delete my manzil account".
- 7-day cooling window. Your account enters a "deletion-pending" state for 7 days. You can cancel anytime in that window, in-app or by replying to the same email.
- What gets erased: your email, password, phone number (if you added one), display name, avatar, UPI VPA, and any notification tokens for your devices. After erasure, you cannot be looked up by that email or phone again.
- What stays (anonymised): expenses you paid for or were split on, and photos you uploaded to shared trips. Your name on these is replaced with "(deleted user)" so that your trip-mates' settle-up math and shared memories stay intact. This is allowed under the DPDP Act's "legitimate purpose" carve-out for shared-context data.
- How fast: we'll confirm initiation within 48 hours and complete the erasure within 7 days of the cooling window ending.
Third Parties We Use
- Amazon SES, sends the verification and password-reset emails.
- PostHog Cloud, product analytics tied to your account id (never location).
- Google Analytics, website visit and campaign measurement. Website only, never the app, and never for advertising.
- Google Cloud, hosting (servers, database, photo storage in the Mumbai region) and this website.
- Expo Push Service, delivers notifications to your phone. It receives the notification token for your device and the text of the notification (a trip name, a member's display name, and what they did), and passes it to Apple or Google. It never receives location.
We don't sell your data. We don't share it with advertisers. We don't have advertisers.
Children
manzil is for users aged 18 and over. We do not knowingly create accounts for minors. If you believe a minor has signed up, email support@saathmanzil.com and we'll remove the account.
Contact
Questions, requests, or anything that feels off, email support@saathmanzil.com. A real person at Forty Two Services reads every message.