Privacy Policy — MACHA
Last updated: 29 August 2026 · macha.world
MACHA ("we", "us") operates the MACHA platform — a real-world participation app connecting verified people to real events. This policy explains what we collect and how we use it.
Information we collect
- Account: name, email address, phone number, city, bio, gender, date of birth, interests, profile photo.
- Verification: a photo ID and a live selfie used to confirm you are a real person (stored privately, never shown publicly).
- App-lock PIN: a 6-digit PIN you may set to lock the app on your device. It's stored securely as your account password (Supabase Auth) and, for the on-device lock screen, as a one-way hash on your device — we never store or see your PIN in plain text.
- Activity: events you create, join, or attend; communities you join; messages you send in event/community chats (including edits).
- Location: if you're an event organizer, the GPS coordinates you tag to your event location, so attendees can navigate there. We do not track your location in the background.
- Payments: Premium subscription payments are processed securely by our payment partner (Cashfree); we do not store your card details. For paid or contribution-based events, the organizer's UPI ID and/or uploaded QR code image are stored and shown to approved attendees so they can pay the organizer directly — MACHA does not process or hold these event payments.
- Device & usage: basic technical data and push-notification tokens (if you enable notifications).
How we use it
- To verify identity and keep the community real and safe.
- To run events, communities, chats, invitations and notifications.
- To show event location and enable organizer-to-attendee payment for paid/contribution events.
- To process Premium subscriptions and payments.
- To secure your account with the optional app-lock PIN.
- To prevent fraud, fake accounts and abuse.
Sharing
We share data only as needed: with event organizers/attendees you choose to interact with (including UPI/QR payment details for events you join or host), our payment processor (Cashfree), infrastructure providers (Supabase, Vercel), email/SMS providers, and when required by law. We never sell your personal data.
Data security & retention
Identity documents are encrypted and access-restricted. We retain data while your account is active and as required by law. You can request deletion of your account and data at any time.
Your rights
You can access, correct, or delete your data, and control notification and visibility settings in the app.
Contact
Questions or data requests: info@oppexl.com