Privacy Policy

Last updated: March 23, 2026

Darwaza (also known as DoorCalling) is a QR code smart doorbell application. This policy describes how we collect, use, and protect your information.

1. Information We Collect

• Account Information: When you sign in with Google, we receive your Google email address and display name. We store your Firebase UID as your account identifier.
• Door Configuration: Door labels, emoji, location coordinates (if you choose to enable geofencing), and device push notification tokens.
• Visitor Data: When a visitor rings your doorbell, we collect: their name (if provided), optional message, optional selfie photo, approximate location (if GPS permission granted), browser fingerprint hash (timezone, screen size — for security), and IP address.
• Usage Data: Visit timestamps, ring counts, and feature interest votes.

2. How We Use Information

• To deliver push notifications when someone rings your doorbell
• To display visitor information (name, photo, message) to the door owner
• To enforce security measures (rate limiting, geofencing, replay attack prevention)
• To restore your data when you change phones (via Google Sign-In)
• To manage token queues and coworking space member directories

3. Data Storage & Security

• All data is stored on Cloudflare's global network using D1 (database) and R2 (media storage)
• API requests are encrypted in transit via HTTPS
• Authentication uses Firebase ID tokens (cryptographically signed JWTs verified against Google's public keys)
• Visitor selfie photos are automatically deleted after 30 days
• Session tokens expire after 3 minutes to prevent QR code replay attacks

4. Data Sharing

We do not sell, rent, or share your personal data with third parties. Data is only shared in these cases:

• Firebase/Google: For authentication and push notifications
• Cloudflare: As our infrastructure provider (data processor)
• Legal requirements: If required by law enforcement with valid legal process

5. Visitor Consent

Visitors who scan a QR code and ring a doorbell are informed that:

• Their name and message will be visible to the door owner
• Selfie photos are optional and stored for 30 days
• GPS location is optional and used only for security verification
• Browser fingerprint is collected for fraud prevention

6. Your Rights

• Access: View all your data through the app
• Deletion: Delete your account and all associated data by signing out and contacting us
• Portability: Request a copy of your data
• Correction: Update your door labels and settings anytime

7. Children's Privacy

Darwaza is not intended for children under 13. We do not knowingly collect data from children.

8. Changes to This Policy

We may update this policy. Significant changes will be communicated through the app.

9. Contact

For privacy questions: [email protected]