1. Who we are

Kamarrr Group Technology FZE LLC is the operator of Brrro and the controller of personal data described in this Policy, unless stated otherwise.

Address: 26th Floor, Amber Gem Tower, Ajman, UAE

Privacy requests: privacy@brrro.com

Product support: support@brrro.com

2. Scope of this Policy

This Policy applies to Brrro mobile apps, brrro.com, account and authentication services, encrypted chats and calls, posts and stories, safety tools, games and competitions, subscriptions, waitlists, support, feedback, and related services that link to it (together, the "Services").

It does not govern a third-party service that operates under its own privacy policy, even when Brrro links to or integrates with that service.

3. Information we process

The information we process depends on the features you use, the permissions you grant, and how you access Brrro.

3.1 Account, profile, and social information

Account identifiers and sign-in information, such as a phone number, email address, device identifier, and identifiers or verification results received from supported sign-in providers.
Your username, display name, profile photo, bio, status, website, and other profile details you choose to add.
Your privacy and discovery settings, notification choices, blocked accounts, approved bros, requests, groups, and other relationship or audience settings.
Account type, creation and last-active times, country or region signals, and subscription or entitlement status.

3.2 Contacts and account discovery

If you grant address-book permission, Brrro can read available or selected contacts to show familiar names, find people you know, and help you send invitations.
For contact matching, normalized phone numbers may be sent to Brrro in batches and compared with discoverable accounts. Contact names and other local address-book details may be used on your device to present matching results.
You can revoke contact access in device settings. Previously established Brrro relationships are not removed merely because permission is revoked.

3.3 Encrypted content

Encrypted direct and group message payloads, reactions, attachments, files, photos, videos, stickers, and voice notes.
Encrypted story and profile-post content and media, including encrypted content keys prepared for the intended audience.
Encrypted call signaling and encrypted emergency packages or location content where supported.
Private cryptographic keys are not collected by Brrro. They are generated and kept on the user's device and are not uploaded, backed up, escrowed, or made available for support recovery.

3.4 Service and communication metadata

Account and device identifiers for senders, recipients, callers, group members, authors, and eligible audiences.
Conversation, group, message, call, story, post, and media identifiers; envelope or content type; timestamps; expiry information; and delivery, read, view, reaction, or call status.
Social-graph and moderation information needed to enforce approvals, blocks, visibility, reports, group membership, and abuse limits.
Brrro needs this metadata to authenticate users, route encrypted data, operate social features, prevent abuse, and keep the Services reliable. End-to-end encryption protects content, not all metadata.

3.5 Device, network, security, and diagnostic information

IP address, coarse country or region derived from a request, user agent, device name or model, operating system, app version and build, language, and platform capabilities.
Device and session identifiers, public cryptographic material, push and VoIP notification tokens, sign-in and last-seen information, and security or device-change events.
Crash, error, performance, reliability, and feature-operation telemetry, including event names, counts, timings, bounded technical details, and anti-abuse signals. This telemetry is designed not to include private keys or plaintext encrypted communication content.
Server request logs may include request identifiers, route, status, duration, IP address, user agent, app version, and authenticated account or device identifiers.

3.6 Location, camera, microphone, photos, and sensors

With permission, Brrro processes precise or last-known location when you choose to send a location, share live location, use the Emergency Button, or configure an Emergency Switch package. Background location may be used while a feature that requires it is active.
Location shared as encrypted content is intended for the bros or groups you select. Brrro still processes routing metadata and may process a coarse location derived from your network connection.
Camera, microphone, photo-library, Bluetooth, and related permissions are used when you choose features such as media, QR scanning, voice notes, calls, or saving content.
Motion data may be used locally for supported game controls. Device permissions can be changed in system settings, but disabling one can prevent the related feature from working.

3.7 Subscriptions and payments

Plan, entitlement, purchase, renewal, cancellation, store environment, and transaction or receipt identifiers needed to verify and manage a subscription.
Apple, Google, or another checkout provider processes payment credentials under its own policy. Brrro does not receive or store your full payment-card number from an app-store purchase.

3.8 Support, feedback, waitlists, and communications

A support or feedback submission can include your Brrro username, category, message, page URL, browser or request information, submission timing, and anti-abuse fields. Do not include private keys, passwords, PINs, or content you do not want support staff to read.
Website support and feedback forms also require an email address so we can reply to your submission.
An account-deletion request submitted on the website includes your Brrro username, the verified email address or phone number you provide for ownership verification, request status, page URL, browser or request information, submission timing, and anti-abuse fields.
If you join a launch waitlist, we process your email address, language, source page, consent time, and limited technical or anti-abuse information to send the requested notice.
Beta applications include your full name, email address, chosen platform, reason for joining, language, consent record, and limited anti-abuse information. We use them to review applications, manage testing participation, and send beta-related emails. You can ask us to withdraw your application or stop these emails.
We process messages you send to our privacy, legal, security, or support addresses and records of our response.

3.9 Games, leaderboards, and competitions

For games, we may process game identifiers, scores, rank, attempt identifiers, start and completion times, ruleset or challenge data, and signals used to validate a result or prevent cheating.
Leaderboard entries may display a username or a masked form of it, score, and rank. A separate competition can request additional eligibility, identity, contact, or prize-delivery information under its published rules.

3.10 Website, cookies, invitations, and referrals

The website uses essential storage to remember choices such as language, theme, and cookie consent. These controls are necessary for the requested site experience.
Google Analytics is loaded only when you allow analytics cookies. It can measure visits, page use, device category, traffic source, and campaign performance. We do not use advertising cookies on brrro.com.
Invitation and referral links can include a code or identifier. We may process link, referrer, landing-page, device-family, coarse-country, and fraud-prevention data, including hashed network or browser signals, to preserve an invitation and attribute eligible referrals.

4. Where information comes from and how we use it

We receive information from you, your device and app, other users who interact with you, app stores and sign-in providers, service providers, and our own service logs.

We use it only as reasonably necessary to:

Create, authenticate, secure, maintain, and delete accounts and devices.
Deliver encrypted chats, media, calls, posts, stories, notifications, safety features, games, invitations, and other requested functions.
Apply your audience, privacy, block, notification, retention, and subscription choices.
Detect abuse, fraud, security incidents, prohibited automation, and violations of our Terms; investigate reports; and enforce rate or safety limits.
Verify purchases, provide paid entitlements, and maintain transaction records.
Answer support, privacy, legal, and security requests and diagnose problems.
Operate, measure, debug, protect, and improve the Services, including consented website analytics.
Send a waitlist, service, security, legal, or account notice when requested or necessary.
Comply with law, enforce agreements, establish or defend legal claims, and protect users, Brrro, and others.

5. End-to-end encryption and its limits

Supported private messages, group messages, attachments, stories, profile posts, and call signaling are encrypted on the user's device before Brrro infrastructure receives them. Private keys are created and stored only on the user's device. Brrro does not upload, sync, back up, escrow, log, or retain a server-side copy of those private keys.

Brrro infrastructure stores or routes encrypted payloads and the metadata needed to deliver and operate them. It is not designed to read the plaintext of supported encrypted content, but it can process account, device, participant, audience, timing, delivery, engagement, and abuse-prevention metadata.

If your private keys are lost because a device is erased, reset, replaced, compromised, or the app is removed, Brrro cannot recover them or decrypt old content for you. Content can also become visible through an unlocked or compromised device, notification previews, a recipient, or a camera outside Brrro.

The current technical description is available at /end-to-end-encryption/. If this Policy and that page differ, this Policy governs data practices and the encryption page provides the more detailed current technical explanation.

6. Legal bases

Where a legal basis is required, we rely on:

Contract, to provide, secure, and support the Services you request.
Legitimate interests, to prevent abuse and fraud, protect systems and users, diagnose faults, improve the Services, and establish or defend legal claims, balanced against your rights.
Consent, for optional permissions, waitlist communications, and non-essential website analytics where consent is required. You can withdraw consent without affecting earlier lawful processing.
Legal obligation or public interest, when processing is required by applicable law or a valid legal process.
Vital interests, in the limited circumstances where processing is necessary to protect a person's life or physical safety and the law permits it.

8. International processing

Brrro is operated from the UAE and uses providers and infrastructure that may process data in other countries. Those countries may have different data-protection laws.

Where required, we use a lawful transfer mechanism and appropriate contractual, technical, or organizational safeguards. You may contact privacy@brrro.com for information about safeguards relevant to your data.

9. Retention and account deletion

We retain each category only for as long as reasonably needed for the purposes above. The period depends on the feature, whether the account remains active, delivery or expiry rules, safety and dispute needs, and legal recordkeeping duties.

Account, relationship, preference, and entitlement records are generally kept while the account is active.
Encrypted queues, media, stories, posts, emergency packages, and related metadata follow delivery, feature-expiry, user-deletion, and operational cleanup rules. Disappearing or deleted content can remain on a recipient's device or in material they captured outside Brrro.
After we verify ownership, we complete account-deletion requests within 30 days.
Routine server logs and protected database backups may remain for up to 30 days after account deletion.
We delete or anonymize deletion-request and verification records within 30 days after the request is closed.
We retain records longer only where required by law or for a specific ongoing fraud investigation, dispute, or legal hold, and only until that requirement or matter ends.
Waitlist data is kept until the requested notice is sent, you unsubscribe or ask for deletion, or the list is no longer needed.
Deleting your account starts deletion of active account data and server-side content associated with it.
Content already delivered to another user or saved outside Brrro is not under Brrro's control.
Because Brrro does not keep private-key backups, removing the app, resetting a device, deleting local keys, or deleting an account can make encrypted content permanently unrecoverable.

10. Your choices and rights

You can change many profile, discoverability, permission, notification, audience, and privacy choices in Brrro or device settings. The website cookie control lets you allow or reject optional analytics and change that choice later.

Depending on where you live, you may have the right to:

Know whether and how we process your personal data and obtain access to it.
Correct inaccurate or incomplete personal data.
Delete personal data or your account, subject to lawful exceptions.
Restrict or object to certain processing and withdraw consent.
Receive eligible data in a portable format.
Opt out of a sale or qualifying advertising disclosure. Brrro does not sell personal data or use it for cross-context behavioral advertising.
Complain to the data-protection authority where you live or work.

11. Making a privacy request

Use available in-app controls, submit the form at /delete-account/, or email privacy@brrro.com. Tell us the request and the Brrro account it concerns. We may need to verify that you control the account or device before acting. We will not discriminate against you for exercising a privacy right.

Some information cannot be provided in readable form because Brrro does not hold the private keys needed to decrypt it. A request can also be limited by another person's rights, legal obligations, security needs, or a lawful exception. An authorized agent must provide evidence of authority where required.

12. Security

We use safeguards appropriate to the nature of the information, including end-to-end encryption for supported content, transport encryption, access controls, device and session verification, restricted administrative access, monitoring, rate limits, and incident-response procedures.

No service can eliminate every risk. Protect your device, account credentials, PINs, and operating-system account; install updates; review notification previews; and treat unexpected device-change warnings seriously. Do not send private keys, verification codes, passwords, or PINs to support.

13. Children's privacy

Brrro is not directed to children under 13 and must not be used below the minimum age required in the user's country. If local law requires parental authorization for a minor to use an online service, the parent or guardian must provide it.

If you believe a child is using Brrro contrary to this section, contact privacy@brrro.com so we can investigate and take appropriate action.

14. Third-party services and recipient actions

App stores, sign-in providers, maps, communications providers, operating systems, external links, and other third parties process information under their own terms and policies.

People you communicate with can save, export, photograph, repeat, or otherwise disclose information they receive. Screenshot and recording controls reduce certain in-app capture risks but cannot prevent every device, operating-system, accessibility, camera, or recipient action.

15. Changes to this Policy

We may update this Policy when the Services, law, or our practices change. The updated date identifies the latest version. If a change is material, we will provide notice in the app, on the website, or by another appropriate method before it takes effect where required.

The English version controls to the extent permitted by law. Any translation is provided for convenience and does not change the English meaning.

16. Contact us

For privacy questions, requests, or complaints:

Kamarrr Group Technology FZE LLC

Email: privacy@brrro.com