Toran Privacy Policy
Toran makes you a daily branded poster. You can use it as a business, where the poster carries your business name and logo, or as an individual, where it carries your own name and your photo. This page explains exactly what Toran stores about you in each case, why, and how to make it go away.
Who is responsible for your data
Toran is built and published by Ruddhasan Finvest Private Limited, CIN U64990PN2024PTC232270, a company registered in India at Flat No 402, Sr No 147, Runwal Swaranjali, Baner Gaon, Haveli, Pune 411045, Maharashtra, India. It is the data fiduciary for the information described here. Reach us at support@toranapp.com for any question about this policy or any request under it.
What Toran collects
- Your phone number. It is how you sign in and the only way we identify your account. During sign-in we also store a one-time code in hashed form, so nobody - including us - can read the code from our database.
-
Your profile. What this holds depends on which kind of account you chose.
- As an individual: your name, an optional phone number you want printed on your posters, your language choice, and your brand colours.
- As a business: your business name, your category, an optional tagline, an optional phone number you want printed on your posters, your language choice, and your brand colours.
- Your identity image. An individual account can hold a photo of you, which Toran places in the identity circle on your posters. A business account holds a logo - either the image you upload, or a mark Toran generates for you if you do not upload one. Both are optional for an individual: with no photo, your posters fall back to your initials. Whichever you have, Toran stores one image per account and stores it in its own database, not with a third party.
- Usage events. That you signed up, that you finished setting up, that a poster was shown, and that you shared or downloaded one, each with a timestamp. These tell us whether the product is useful. Toran does not track you across other apps or websites, and it has no advertising identifiers.
- A notification token. If you allow notifications, Google issues a device token that lets us send you the one daily poster notice. It identifies a device, not a person.
- App identifiers. Google's Firebase software inside the app gives each installation two identifiers: a Firebase installation id, and an Analytics app instance id. They let Google deliver notifications to your phone, group usage events and crash reports by installation, and tell us how many devices use Toran. They identify an installation of the app, not you by name. While your account exists, crash reports are tagged with your account id so we can follow up on a failure you tell us about; deleting your account removes that tag, deletes the installation id from your device and resets the Analytics id.
- Approximate location. Toran never asks your phone for its location. Google Analytics, which receives the usage events, infers a coarse location - country and city level - from the internet address your phone connects from, on Google's servers. We use it only to see which regions Toran is used in.
- Crash reports. When the app fails, it sends a report so we can fix what broke: the app version, your device model, the operating system version, and the technical stack trace of the failure. A report never carries your name, your phone number, your photo or logo, or anything you typed into the app.
Toran asks your phone for no contacts, no location permission, and no payment information. There is no payment feature in the app at all.
How Toran uses your photo library
Two separate, narrow things, each of which you control:
- Choosing an image. When you set a photo or a logo, your phone's own picker opens and hands Toran the single image you select. Toran does not browse your library or read anything you did not pick.
- Saving a poster. When you download a poster, Toran writes that one image into your photo library, in a Toran album. This is an add-only write: it puts a poster in, and it is not a way to read what is already there. On iOS your phone asks for permission to add to your library the first time; on Android the save goes through the system media store.
Images you choose are uploaded to our server so your posters can be composed with them.
Why Toran uses it
- To sign you in and keep your session valid - your phone number and the one-time code.
- To compose your posters - your profile and your photo or logo. This is the whole point of the app: the data you give us is the data that gets printed. Your account type decides which fields are used, because it decides what the poster says about you.
- To send you the daily poster notification - your notification token, only if you allowed notifications.
- To understand whether Toran is worth building - usage events, in aggregate.
- To keep the service standing up - server logs that record request addresses, used to stop abuse and diagnose faults.
Toran does not sell your data, does not share it for advertising, and does not use it to train models.
Who else touches it
Toran runs on a single server we operate, and your photo or logo is stored on it rather than handed to anyone else. A small number of service providers necessarily see part of your data in order to do their job:
- Meta (WhatsApp Business Platform) - receives your phone number when we deliver your sign-in code over WhatsApp.
- Google (Firebase Cloud Messaging, Analytics and Crashlytics) - receives your notification token, usage events, crash reports, the app identifiers described above, and the internet address those requests come from, from which Analytics derives an approximate location.
- Cloudflare - carries traffic between your phone and our server, and so processes connection metadata such as your IP address.
How long Toran keeps it
- Your profile, your photo or logo, and your notification tokens are kept for as long as your account exists, and erased when you delete it. This is the same for both account types.
- A photo or logo you replace or remove is overwritten or erased at that moment - Toran keeps one image per account, not a history of them. Removing your photo as an individual returns your posters to your initials.
- Sign-in codes expire within minutes and the records are purged nightly.
- App identifiers, usage events and crash reports held by Google are kept for the retention period set on our Firebase project and then deleted automatically. Deleting your account deletes the installation id from your device, resets the Analytics id and removes your account id from crash reports.
- Usage events are kept after account deletion, but only in a form that no longer points at a phone number or a profile - they become counts, not a person.
- Server logs are capped in size and rotate automatically - once the cap is reached the oldest entries are discarded to make room for new ones. They are never archived.
Deleting your account
In the app, open your profile and choose Delete account. Deletion is immediate and needs no email to us. When you confirm it, Toran erases your phone number, your profile - whichever kind you hold, including your name or business name and the phone number you chose to print - your photo or logo, your notification tokens, and any pending sign-in codes. Your posters stop being generated and the daily notification stops.
One record survives: an anonymous marker that an account once existed, with the phone number removed. It carries no name, no number, no photo, and no profile - it exists so that historical counts stay correct. Signing up again with the same number creates a genuinely new, empty account.
Posters you already saved to your photo library are yours and stay on your phone. Deleting your account does not reach into your library, and you can delete them there yourself.
Your rights
You can see and correct everything in your profile from inside the app, and you can erase it at any time by deleting your account. If you would rather have a copy of your data, or you want to raise a concern about how it has been handled, write to support@toranapp.com and we will respond.
Security
Traffic between the app and our server is encrypted in transit. Sign-in codes are stored hashed in our database, never in the clear. Your photo or logo is served only back to you, over an authenticated request - there is no public link to it. Access to the server is limited to the company named above.
Children
Toran is a tool for promoting a business or yourself and is not directed at children. We do not knowingly create accounts for anyone under 18.
Changes to this policy
If this policy changes in a way that affects you, we will update the effective date at the top of this page, and, where the change is significant, tell you in the app before it takes effect.