Privacy Policy

Last updated: October 19, 2026

1. What we collect

If you join the waitlist on this site before the app launches, we collect your name, phone number, how you heard about Smuggl, and whether you're on iOS or Android, so we can text or WhatsApp you when Smuggl is live in your city. We don't use it for anything else, and it isn't linked to an account until you sign up in the app.

If you use the "tell us which airport" or "tell us which store" form on the site, we collect your first and last name, email address, mobile number, the airport or store you're asking about, and an optional note. We use it only to reply to you and to decide what to add next. To limit spam, we also keep a one-way scramble (a hash) of your IP address, not the address itself.

When you create an account via Apple, Google, Facebook, or phone number, we collect your name, email (where provided), and phone number. If you sign in with Apple, we're only given your name on your very first sign-in, so we store it then and it isn't lost on later logins. Even if you sign in with a method that doesn't require one up front, you must add and verify a phone number by OTP before you can place an order as a shopper.

If you enable contacts sync or connect Facebook to grow your "crew" (the trust graph used to find Smugglbears), we access your contacts and/or Facebook friends list to find mutual connections already using Smuggl. From your contacts we use only phone numbers and email addresses, turned into one-way codes on your phone before they're sent. Your own sign-in email is stored the same way, so friends who have your email can find you. If you sign up through someone's invite link, you and that person can see each other on Smuggl. We do not store your full contacts list or friends list beyond what's needed to compute those matches.

To verify your identity and help keep in-person handoffs safe, we use a third-party identity-verification provider, Didit. This applies only if you become a Smugglbear: it's required before you can publish a trip, and shoppers are never asked to verify their identity through Didit. Verifying your identity involves submitting a photo of a government-issued ID and a live selfie/liveness check; Didit processes this on our behalf and returns the verification result and the identity details extracted from your ID (such as your name, date of birth, ID number, and nationality) to us.

If you become a Smugglbear, we collect your flight/trip details (route, dates, airline) and bag capacity, so shoppers can find you.

To save you typing in your flight, you can choose to import it from your email. If you connect Outlook, we ask for read-only access to your mailbox and use it only when you tap to import a trip. We search for a handful of recent flight-booking emails, read those messages and any PDF ticket attached to them, and pull out the flight details (airline, flight number, departure airport and date). The message text is processed by Google Gemini to read those details. We keep only the extracted flight details for your trip.

We don't store your emails or attachments, we don't read anything else in your mailbox, and the access token is used for that one import and not saved. You can also forward a booking email to us instead of connecting a mailbox, and it's handled the same way. You can revoke mailbox access at any time from your Microsoft account settings.

During a request, we collect photos you upload as delivery/purchase/customs evidence, chat messages between you and the other party, and your approximate location (used to detect your local currency, applicable customs rules, to suggest nearby meetup spots, and to record where an order was handed over).

Payment details (card, bank account) are collected and processed directly by our payment partners, which are payment aggregators authorised by the Reserve Bank of India. Smuggl does not receive or store your full card or bank account number.

We also use Firebase (Google) for analytics and crash reporting, to understand how the app is used (which screens and actions, across both the shopper and Smugglbear journeys) and to catch and fix crashes. Separately, we use AppsFlyer to track referral links and app-install attribution (i.e., which link brought you to install the app); AppsFlyer does not receive your device's advertising identifier, which we've disabled.

2. Why we collect it

• To operate the platform: matching shoppers with Smugglbears, processing requests, and holding payments until delivery is confirmed
• To verify your identity and reduce fraud between users who are meeting up in person
• To show you accurate pricing, currency conversion, and customs-duty estimates for your location
• To resolve disputes, using the photos, chat history, purchase records and handover record for that request, including sharing an order's delivery record with our payment partner and your bank when a payment is disputed
• To send you service-related notifications (request updates, delivery confirmations) and, if you opt in, product updates
• To understand app usage, diagnose crashes, and measure which referral links are working
• To fill in your trip details from a booking email, only when you choose to import one
• To reply to airport and store requests sent through the site forms

3. Who we share it with

We share data with the service providers that make the app work: Supabase (our database and authentication infrastructure), our payment partners (payment processing and holding payments until delivery), Didit (identity verification), Firebase (Google's analytics and crash-reporting), AppsFlyer (referral and install attribution), Twilio (OTP and order text messages and calls), Slack (our internal team messaging, where airport and store requests from the site forms are posted for our team), Google Gemini (reading flight details from booking emails you choose to import, and answering help-chat and support-email questions), ICICI Bank (international payouts to Smugglbears with a foreign bank account), and Apple/Google/Facebook/Microsoft (for sign-in and email import, limited to what those providers return to us).

We do not sell your personal data to third parties or data brokers. Phone numbers collected for transactional purposes (waitlist notifications, OTP verification, and order/service updates) are never shared with third parties or affiliates for marketing purposes.

Google user data. Smuggl's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The other party in a request (your shopper or Smugglbear) can see the information needed to complete that transaction: your first name, photo, city, rating, and the chat/photos exchanged during that request.

Offers and news. We only send marketing messages (deals and Smuggl news) by email, push notification or WhatsApp if you turn that channel on in Settings → Notifications. Each channel is off until you choose it, and you can turn it off there at any time, or by using the unsubscribe link in an email or replying STOP. We keep a record of when you gave or withdrew consent.

4. How we protect your information

We protect your information with encryption in transit (HTTPS) for the app and website, encrypted storage at our database provider, and access limited to the people and services that need it to run Smuggl. Your contacts are turned into one-way codes on your phone before they're sent. Card and bank details are handled only by our payment partners, and ID documents only by Didit. We process personal data in line with the Information Technology Act, 2000 and its rules, and the Digital Personal Data Protection Act, 2023. If a breach affects your data, we will tell you and the authorities as the law requires.

5. Cookies

Our website uses Google Analytics, which sets cookies to count visits and show us which pages are used. It doesn't identify you by name, and we don't use advertising cookies or sell this data. If you visit from Europe, these cookies stay off unless you choose Accept in the strip at the bottom of the page. You can block or delete cookies in your browser settings, and the website still works without them. The app doesn't use cookies; the analytics it uses are described in Section 1.

6. Data retention

We retain account and transaction data for as long as your account is active and as needed to resolve disputes, meet legal/tax obligations, and maintain a reliable rating history. You can request deletion of your account at any time (Section 8); some transaction records may be retained where required by law (e.g. financial recordkeeping).

7. Your rights

Under India's Digital Personal Data Protection Act, 2023, you can ask to see a summary of the personal data we hold about you, to correct, complete or erase it, to withdraw consent you have given, and to nominate someone to exercise these rights for you if you can't. Depending on where you live, you may also have the right to export your data or to object to or restrict certain processing. If you live in the European Union or the United Kingdom, the GDPR (or UK GDPR) also applies.

We use your data to provide the service you signed up for, to meet legal duties such as tax records, to keep Smuggl safe from fraud and abuse, and with your consent where we ask for it (ID checks with a selfie, marketing messages, website analytics cookies). You can also complain to your country's data protection authority. Contact us (Section 9) to exercise any of these rights. If you're not satisfied with our Grievance Officer's response, you can complain to the Data Protection Board of India.

8. Account deletion

You can delete your account in the app (You → Delete account) or by emailing byebye@smuggl.in. We'll delete or anonymize your personal data, except where we're required to retain it (e.g. completed-transaction records for tax/legal purposes) or where it's needed to resolve an open dispute.

9. Contact

Questions about this policy or your data: help@smuggl.in.

Privacy-related grievances go to our Grievance Officer, Rahul Gulrajani, at grievances@smuggl.in. We acknowledge within 24 hours and aim to resolve within 15 days.

10. Changes to this policy

We may update this policy as the app evolves. Material changes will be notified in-app or by email before they take effect.