Privacy Policy

Clanpair ("we", "us", or "our") operates the Clanpair mobile application and the website at clanpair.io (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the Service you agree to the collection and use of information in accordance with this policy.

1. Who we are

Clanpair is a roommate-matching service for adult students and young professionals in Pakistan. We help verified users find compatible roommates by matching lifestyles, locations, and budgets. We are operated from Karachi, Pakistan.

Contact for privacy concerns: admin@clanpair.io

2. What we collect

2.1 Information you give us directly

• Phone number — to create your account and verify it via SMS one-time-password (OTP).
• Profile information — your name, age, gender, city, university, budget range, preferred neighbourhoods, lifestyle quiz answers, a profile photo, and an optional bio.
• CNIC (Computerized National Identity Card) — front and back photos of your CNIC, used solely to verify you are an adult Pakistani citizen. We store a one-way hash of your CNIC number to prevent duplicate accounts; we do not use it for advertising, share it with third-party marketers, or sell it.
• Payment receipts — when you subscribe, you upload a screenshot of your EasyPaisa transaction. Our reviewers use it only to confirm payment.
• Messages — the content of in-app messages you send to other users.
• Reports and support requests — when you report a user or contact us for help.

2.2 Information collected automatically

• Device info — operating system version, device model, app version, language, time zone.
• Usage data — which screens you visit, what actions you take, and approximate time spent. We use this to improve the product, not to build advertising profiles.
• Crash logs — if the app crashes, we record the stack trace, the screen you were on, and a redacted snapshot of your session.
• Push-notification token — a Firebase-issued token we use to send you push notifications about your matches, CNIC review status, and subscription updates.
• IP address (web only) — when you visit clanpair.io we record a hashed version of your IP for spam prevention on the waitlist + contact forms.

3. Why we collect it

4. Who we share data with

We share data only with the service providers that operate the Clanpairplatform on our behalf. Each provider has signed a data-processing agreement and may only use the data for the limited purpose listed.

• Supabase (US/EU regions) — backend database, authentication, and file storage.
• Firebase / Google — phone-number verification (SMS OTP delivery) and push notification delivery (FCM).
• Sentry — crash reporting; receives redacted stack traces only, no message bodies.
• PostHog (US region) — product analytics; receives event names and screen names, not message content.
• Vercel — hosts our website clanpair.io.
• Resend — sends transactional emails (e.g., magic-link sign-in to your /unlock page).
• Cloudflare — DNS + email routing for our domain.

We do not sell your personal data, share it with advertisers, or use it to train AI models.

5. How long we keep it

• Profile + matches + messages: until you delete your account, then deleted within 30 days.
• CNIC photos: kept while your account is active for re-verification or fraud-investigation purposes; deleted within 90 days of account deletion.
• Hashed CNIC number: kept indefinitely to prevent re-creation of fraudulent accounts. The hash is one-way; we cannot recover the original number.
• Payment receipts: kept for 7 years per Pakistani tax-record requirements.
• Crash logs: 90 days.
• Analytics events: 1 year (aggregated, not tied to you after that).

6. Your rights

You may, at any time and free of charge:

• Access your data — view it in the app under Settings, or email us for a machine-readable export.
• Correct your data — edit your profile in the app.
• Delete your account — Settings → Delete Account, or email us. We will delete within 30 days, subject to the retention rules above.
• Object to certain processing — e.g., turn off push notifications, opt out of crash reporting.
• Withdraw consent for any consent-based processing.

To exercise any of these rights, email admin@clanpair.io from the address linked to your account (or with a screenshot of your in-app profile so we can verify identity).

7. Security

We protect your data with industry-standard measures: TLS 1.3 in transit, encryption at rest, row-level security on the database, role-based admin access with audit logs, hashed storage for sensitive identifiers, and bucket-level access controls on uploaded files. No system is perfectly secure; we will notify affected users and the relevant authorities of any breach in line with Pakistani law.

8. Children

Clanpair is restricted to users 18 years of age or older. The CNIC verification step prevents minors from completing signup. If we learn we have inadvertently collected information from a minor, we will delete it immediately.

9. International transfers

Our backend providers (Supabase, Sentry, PostHog) may store data on servers outside Pakistan, including in the United States and the European Union. By using Clanpair you consent to those transfers, which are governed by each provider's standard contractual clauses.

10. Changes to this policy

We may update this policy from time to time. When we do, we'll update the "Last updated" date at the top and notify active users in the app for material changes. Continued use of the Service after a change indicates acceptance.

11. Contact

Questions, complaints, or right-of-access requests: admin@clanpair.io

For complaints unresolved through Clanpair, you may contact the Pakistan Telecommunication Authority or the relevant data-protection regulator in your jurisdiction.