Privacy, Safety & Your Data

What we collect, in plain terms

Your mobile number, the content you create, who you send it to, and what you buy. We store it in the UAE.

What we don't do: sell your data · show you adverts · use third-party advertising or behavioural analytics · read your encrypted chats.

Encryption — what it actually means

Direct chats, group chats and Tribute content are end-to-end encrypted with forward secrecy. The keys are generated and held on your device — in iOS Keychain or Android Keystore — and are never transmitted to our servers.

We cannot read them. Not because we choose not to; because we have no way to.

The consequence, stated plainly: if you lose every device without setting up key backup, your encrypted history is permanently unrecoverable — by you or by us.

⚠️ Set up key backup now: Settings → Privacy → Encryption → Key Backup. Store the recovery key somewhere you will still have it in ten years.

Channels are the exception. They broadcast publicly, are not end-to-end encrypted, and are proactively moderated.

Contact discovery — optional

If you allow it, we check your address book against our user base so you can see which contacts already use Let's Horaro.

The app works without it — you can type numbers manually. We ask separately, not bundled into sign-up, and you can switch it off any time.

How we handle it: we match using irreversible hashes of phone numbers where technically possible. We do not keep contacts who are not Let's Horaro users — unmatched entries are discarded after matching. We don't message your contacts, and we don't build shadow profiles.

Your responsibility: your address book contains other people's data. By switching this on, you confirm you may share it with us for this purpose.

Your rights

We answer data requests within 30 days, free of charge.

ℹ️ Encrypted chat content can only be exported from a device holding your keys. Export from your phone.

What survives a deletion request

• Tributes that reached "Unlocks Soon" or later — the recipient's copy is theirs
• Financial and tax records — 7 years, required by law
• AML records where applicable — 5 years
• Suppression-list entries — kept indefinitely, because that is what makes an opt-out work
• Anything needed to defend a legal claim

We will always tell you exactly what was kept and why.

How long we keep things

Deletion works in two stages: immediate removal from live systems, then up to 90 days for rolling backups to be overwritten.

We notify you before a retention period expires so you can download your copy. Notifications go to the contact details on your account — keep them current. A message scheduled for 2040 needs an address that still works in 2039.

Reporting and blocking

In the app: long-press a message, or open a profile, Tribute, group or Channel → Report. There is a dedicated child safety category.

Blocking applies everywhere. A blocked person cannot message you, add you to a group, or send you a Tribute or gift. No feature works around a block.

Nobody can contact you against your will. Any recipient — including someone who isn't a user — can reply STOP to a notification or email privacy@letshoraro.com to be added to a permanent suppression list. No sender can override it.

What happens to a report

We acknowledge within 48 hours and aim to decide within 72 hours. Child safety and credible violence reports are actioned immediately, at any hour.

Every report is reviewed by a trained person. Automated systems may prioritise, but never decide alone.

We never reveal who reported you.

What we can and can't see

In encrypted places, moderation depends on reports. When you report a message, your device attaches that message's decrypted content to the report, so our team can actually assess it. That is the only way we learn about abuse in private chats. Please use it.

Child safety — zero tolerance

Any sexual content involving a minor, any grooming, any sexualised depiction of children — no warning, no second chance.

Accounts are terminated immediately and permanently. Content is preserved for law enforcement. Authorities are notified. There is no appeal.

Report it: in-app under the child safety category, or safety@letshoraro.com. Tell us where it is — please don't attach the material itself.

If a child is in immediate danger, call the police first. In the UAE: Ministry of Interior Child Protection on 116111, or the Ministry of Community Development on 800988.

Anonymity protects nobody here. We always know who sent what, and we disclose it to our safety team and to law enforcement.

Full standards: Child Safety Standards.

If your account is restricted

You can appeal. Email support@letshoraro.com with APPEAL in the subject, within 30 days. A different reviewer handles it, and we aim to decide within 14 days. If we got it wrong, we restore your account, your content and any forfeited Credits.

Child safety terminations cannot be appealed.

Security, and what you should do

We use AES-256 at rest, TLS in transit, role-based access with multi-factor authentication for staff, access logging, and tested automated backups.

If a breach affects your personal data and creates a risk to you, we notify you and the UAE Data Office within 72 hours.

Your part: set a PIN or two-step verification · back up your encryption keys · keep your device updated · never share a verification code.

⚠️ We will never ask for your verification code. Anyone who does is attacking your account.

Found a barrier? Email support@letshoraro.com with the screen and what happened. Accessibility reports are prioritised.