Legit · Policies

Privacy Policy

Last updated: 23 September 2026

This Privacy Policy explains how Plugtech Technologies Private Limited ("Legit", "we", "us") collects, uses, shares, and protects your personal data when you use the Legit app, website, and services (the "Platform"). Read it with our Terms of Use and Community Guidelines. We handle personal data under applicable Indian law, including the Digital Personal Data Protection Act, 2023 (the "DPDP Act").

Legit is for adults aged 18 or older. We do not knowingly collect personal data from anyone under 18. If we learn that we have done so, we will delete it.

1. Data we collect

Data you give us

Data collected from your device

2. Artificial intelligence processing

Legit uses third-party artificial intelligence services. When you use the features below, your content may be sent to one or more of OpenAI, Anthropic, Google Gemini, and TypeSafe AI:

Langfuse, our AI monitoring service, can receive AI prompts, outputs, operational identifiers, provider names, model names, and timing data. We do not add your account phone number to an AI request. Text or media that you submit can contain personal data that you chose to include. AI output can be incomplete or incorrect and does not replace your own judgement.

3. Why we use your data

We process personal data to provide services that you request and under other grounds allowed by the DPDP Act, including consent where the law requires it and processing needed to comply with law.

4. Who receives data

We disclose data only as needed for the purposes in this policy:

We do not sell personal data. We do not share your account phone number with other members. We do not use personal data for third-party advertising or track you across other companies' apps or websites.

5. International processing

Our main application hosting and media storage use the Amazon Web Services Mumbai region. Some providers process data outside India. Current examples include Sentry in Europe, and Langfuse and TypeSafe AI in the United States. AI, analytics, messaging, identity, notification, and font providers can also use systems in other countries under their service terms. We use contractual, access-control, and security measures for these transfers as required by applicable law.

6. Retention and account deletion

We keep account data while your account is active and keep other data only while needed for the feature, safety, fraud prevention, disputes, enforcement, accounting, or legal compliance. OTP records are short-lived. Session credentials expire or are replaced. Provider copies follow the provider's contract, service settings, and lawful retention duties. We delete or anonymise data when its purpose ends.

You can delete your account in the app at Profile > Delete Account. After you confirm, we disable the account and sign it out on all devices. We remove the phone number, name, email, profile-photo reference, LinkedIn connection, push tokens, reactions, shelves, and private drafts. We schedule the stored profile photo and private draft media for deletion.

We close published listings and Seeks and remove your identity from them. We retain those closed posts and their evidence when other members' chats, saved items, reports, or safety records depend on them. Past chats remain readable to the other participant under the name "Deleted member." We can also retain reports, moderation records, and data needed for safety, disputes, or law. A non-reversible deletion record remains without your name, email, or photo. You can later register as a new member with the same phone number or LinkedIn account, but the new account does not recover the old account's data.

7. Your rights

Subject to applicable law, you can:

Use the in-app deletion control or contact the Grievance Officer below. We can ask for information needed to confirm your identity before we act.

8. Security

We use technical and organisational controls designed to protect personal data, including access restrictions, encrypted connections, scoped storage access, and monitoring. No method of transmission or storage is completely secure. We respond to reportable personal-data breaches as required by law.

9. Analytics, diagnostics, and tracking

Mixpanel analytics and Sentry diagnostics start when the app launches, before sign-in. They can use cookies, local storage, or similar identifiers. We do not use the advertising identifier, show targeted advertising, or track members across other companies' apps or websites. We do not send OTP codes, raw chat messages, listing text, search text, phone numbers, or names to Mixpanel.

10. Changes to this policy

We can update this Privacy Policy as the Platform or law changes. We will change the "Last updated" date and give reasonable notice of a material change.

11. Grievance Officer and contact

For a privacy question, request, or complaint, contact our Grievance Officer, who is also our point of contact under the DPDP Act:

We acknowledge grievances within 24 hours and ordinarily resolve them within 15 days. Send general questions to hello@legitapp.shop.