Privacy Policy
Welcome to Noghotok — Bangladesh's first privacy-first matrimony platform. This Privacy Policy explains how we collect, use, protect and share your personal information.
By using our service you agree to the terms of this Policy. If you do not agree, please do not use our service.
What we collect
When you create a biodata or use the site, we collect:
- Basic info: Full name, age, gender, religion, marital status
- Contact info: Mobile number (required), email (optional), guardian's phone (optional)
- Profile info: Education, profession, income, family, address, religious practice, expectations
- Financial info: Payment gateway transaction records (we do not store card numbers)
- Usage info: Login times, profiles viewed, proposal history
- Device info: IP address, browser, device type — only to enforce the one-device policy
- Social login data: If you sign in with Google or Facebook, we receive your name, email and basic profile (account ID) — used only to create and secure your account
Why we collect it
Your data is used solely to provide the service:
- To display your biodata to other users
- To suggest profiles that match your preferences
- To manage proposals and communication
- To prevent fake accounts via phone verification
- To process payments and handle refunds
- To comply with legal obligations
- To provide support and customer service
We do not use your data for advertising, profiling, or any other commercial purpose.
Who we share it with
We never sell your data. We share it only to run the service, in these cases:
- Other users: Public biodata (excluding name) is visible. Mobile and full name are shown only after guardian approval.
- Phone verification: An SMS gateway delivers OTPs to Bangladesh (+88) numbers; international numbers are verified through Google Firebase Authentication (your phone number and an anti-abuse reCAPTCHA token are processed by Google — no Google account is accessed).
- Login providers: If you sign in with Google or Facebook — for authentication only
- Notifications: Telegram (when linked) — to deliver verification codes and messages
- Payments: Easy Payment System (EPS), a Bangladesh Bank-licensed payment gateway, to process online card and mobile banking (bKash, Nagad) payments; bKash/Nagad to confirm manual Bangla QR top-up transactions (we do not store card numbers)
- Automated moderation: An AI service helps detect fake or inappropriate biodatas — personal identifiers (name, phone) are stripped before any text is sent
- Legal requirement: Court order or government investigation
- Fraud prevention: Suspicious account data may be shared with law enforcement
How long we keep it
- Active account: As long as your account is active
- Inactive account: Biodata is hidden automatically after a long period of inactivity (currently about 2 years)
- Deleted account: Personal data is permanently erased within 30 days of your request
- Financial records: 7 years under Bangladesh law (tax & audit)
- Legal hold: As long as required by a court order
Data security
- All data transferred with HTTPS/SSL encryption
- Passwords are never stored in plaintext — they are stored hashed
- Sensitive fields (phone, address) are never shown publicly and are protected by strict access controls
- Login-device tracking to help detect unauthorised access
- Regular security audits and backups
- Restricted staff access — only authorised staff can view necessary data
Your rights
- Right to access: View your full profile in the dashboard at any time
- Right to rectification: Correct inaccurate data at any time
- Right to erasure: Delete your account and all associated data
- Data portability: Download a copy of your data
- Right to restrict: Temporarily deactivate your biodata
- Right to object: Object to specific processing via the process below
Cookies & tracking
We use essential and limited cookies:
- Session cookies: To keep you logged in
- Preference cookies: To remember language and display settings
- Google Analytics: To understand aggregate site usage (page views, device, approximate location, referrer) — this sets Google's analytics cookies
- Google reCAPTCHA: Only during international phone verification, to prevent bot abuse — it collects device/browser signals and IP
We do not run advertising or marketing tracking, and we use no Facebook Pixel or ad-network cookies. To load fonts and some scripts we use Google Fonts and CDNs (Cloudflare, jsDelivr), which receive your IP, browser and referrer when those assets load. These Google and third-party services are governed by their own privacy policies.
Third-party services
- Google Sign-In — log in with a Google account (name, email, basic profile)
- Facebook Sign-In — log in with a Facebook account (name, email, basic profile)
- Google Firebase Authentication & reCAPTCHA — to verify international phone numbers by SMS
- SMS gateway — OTPs and notifications to Bangladesh numbers
- Telegram — verification codes and notifications
- Easy Payment System (EPS) — to process online card and mobile banking payments
- bKash / Nagad — to confirm manual Bangla QR top-up payments
- AI moderation service — automated content review (personal identifiers are removed before any text is sent)
- Google Analytics & Google Fonts — usage analytics and font loading
Each service has its own privacy policy. We share only the minimum data necessary with them.
Deleting your account
You can delete your account at any time:
- Settings → Account → Delete account
- Or email: [email protected]
After deletion:
- Your biodata is removed immediately
- All personal data is permanently erased within 30 days
- Financial records are retained for 7 years as required by law
- Any remaining credit balance can be claimed within 30 days
Changes
This policy may change due to legal or service requirements. For significant changes we will:
- Display a clear notification on the site
- Notify you at your registered email
- Give 30 days' notice where applicable
The latest version is always available on this page. Continued use after a change constitutes acceptance of the updated terms.
The Noghotok Mobile App
This policy covers the Noghotok Android app as well as the website. It is the same account and the same data behind both, but the app collects a few things differently, and those differences are set out below.
What the App Collects
The app uses Google Firebase Analytics to tell us how the app is actually used — which screens people open, which buttons get tapped, whether a flow gets abandoned halfway. This works differently from the analytics on our website. There are no cookies in the app. Instead Google assigns a random app instance identifier, and along with it we receive your device model, Android version, app version, language, and an approximate location worked out from your IP address — usually accurate only to the city.
We use this to find what is broken or confusing and to decide what to build next. It is not used for advertising, we do not sell it, and it is not linked to your biodata for other users to see. If you clear the app's data or reinstall it, the identifier is reset.
The app does not ask for your GPS location, your contacts, your photos, your microphone or your camera.
What the App Stores on Your Phone
When you sign in, the app saves a session token and your display name on the device so you do not have to log in every time you open it. The token is what proves to our server that the request is yours. It stays on your phone, it is not shared with anyone, and signing out or uninstalling removes it. Choosing "log out" also revokes the token on our side, so it stops working even if a copy survives.
Push Notifications
If you turn on notifications in the app, we send you a message when something happens to a proposal: someone sends you one, or answers one you sent. To deliver it, Google Firebase Cloud Messaging gives your phone a random registration token, and the app sends that token to our server together with your account and your chosen language. We use the token only to deliver these messages. It is not used for advertising and it is not shown to other users.
Notifications stay off until you allow them: Android asks for your permission, and the app has its own switch in its notification settings. You can turn them off at any time, there or in your phone's settings. Signing out removes the token from our records, and so does Google reporting that it is no longer valid, for example after the app is uninstalled. The text of a notification passes through Google's servers on its way to your phone.
Payments
The app may handle a Google Play purchase flow for Credits. Google processes that payment, and we receive only the purchase information needed to verify it and credit your wallet. Website payments are handled by the website payment provider. We do not see or store a full card number.
How Long We Keep Things
Your account and biodata stay with us while your account is open. Proposals and the Credit transactions attached to them are kept as long as your account exists, because both sides may need to refer back to them. Analytics data is kept by Google for the retention period set on our Firebase project, currently 14 months, and is aggregated after that. Support tickets are kept for two years so we can see the history if you contact us again about the same thing. Payment and Credit records are kept for as long as tax and accounting law requires.
Deleting Your Account
You can ask us to delete your account and the personal information in it. Write to [email protected] from the email address registered on your account, or send the request from your registered mobile number. We ask for that because deletion cannot be reversed and we need to be certain the request came from you.
Every request is reviewed by a person rather than processed automatically, so it takes a few working days. Once verified, your biodata comes off the site and the personal information in your account is deleted.
Some records survive deletion where the law requires it. Payment and Credit records are kept for tax and accounting. Records that a court, regulator or government authority could formally require us to produce are kept for that purpose only. We do not use any of it to contact you, we do not show it to other users, and it plays no part in anything else we do.
Age
Noghotok is for adults and you must be 18 or older to register. We do not knowingly collect information from children. If we learn that an account belongs to someone under 18 we close it and delete the information. If you believe a child has registered, tell us at [email protected].
Deleting Your Data
You can ask us to delete your data at any time. Email [email protected] with the subject "Data deletion request", sent from the email address on your account so that we can identify you, and include your account name. We reply within 72 hours.
This covers the information you gave us when registering, your biodata, and anything we received from Facebook if you signed in through Facebook.
If you have messaged our Facebook Page, we store that conversation so the assistant can reply to you and so that we can review the quality of its answers. To have those messages removed, send your request from the same Facebook account, or tell us inside the Messenger conversation itself so that we can identify the right thread.
We keep records that the law requires us to keep, such as payment and accounting entries.
Crash Reports
When the app stops unexpectedly we receive a report through Firebase Crashlytics describing the technical circumstances: the kind of device, the Android version, the app version, and where in the code the failure happened. We use it to fix faults and for nothing else. It is not used to identify you, is not shown to other users, and is never used for advertising.
Photographs and Avatars
We do not ask for, accept or display a photograph of you. The picture on a biodata is an illustration, not a person: it is chosen automatically from a small fixed set of drawings using details you already gave — whether the biodata is for a groom or a bride, and what was said about beard, clothing and face covering.
Because it comes from a handful of drawings, the same illustration represents many different people. It is not a likeness of anyone, it is not generated from anything you uploaded, and it reveals nothing about you beyond the few details it was picked from — which are already on the biodata.
Questions About Your Data
For anything about this policy, a copy of your data, a correction, or a deletion request, write to [email protected].