Privacy Policy

Last Updated: June 6, 2026

1. Introduction

Welcome to Great Wave ("the App"), a frequency therapy application developed and operated by SSSD Tech Solutions Pvt Ltd ("we", "our", "us"). Great Wave is available on Android and iOS and is supported by an API backend hosted at greatenergy.in.

This Privacy Policy explains what personal data we collect when you use Great Wave, why we collect it, how we protect it, and your rights over it. It applies to:

• The Great Wave mobile application (Flutter — Android & iOS).
• The Great Wave backend API (greatenergy.in — ASP.NET Core / .NET).
• The Great Wave admin web panel (internal use only, not accessible to end users).

By creating an account or using the App, you agree to this Privacy Policy. If you do not agree, please discontinue use of the App.

2. Information We Collect

We collect the following categories of personal data, all of which are directly supported by the codebase:

Category	Data Points	Source
Account & Identity	Full name, email address, Google account ID (sub), profile picture URL, email verification status	Google Sign-In OAuth flow; stored in users table
Contact Details	Mobile phone number (including country code), mobile verification status	OTP registration step; stored in users table
Device Information	Firebase Cloud Messaging (FCM) token, device platform (Android / iOS)	userdevices table; updated via PUT /api/user/device-token
Subscription & Plan	Plan tier (free / standard / pro), subscription start/end dates, subscription platform, external subscription ID, pro expiry date	subscriptions table; users.Plan, users.IsPro
Payment Records	Razorpay order ID, Razorpay payment ID, HMAC signature (for verification only), Apple App Store receipt data reference, transaction amount, currency (INR), transaction status	paymentorders and paymenttransactions tables; Razorpay and Apple in-app purchase integrations
In-App Activity	Action label (e.g., "play_program", "pause"), originating screen name, content type (program / playlist / seqchakra), content ID, playback duration in seconds, JSON metadata, timestamp	useractivities table; logged via POST /api/activity
App Preferences	Notification preference, daily reminder setting and time, default timer duration, background play preference, preferred content categories	usersettings table
Custom Content	User-created custom frequencies, user-created playlists and their items	customfreqs, playlists, playlistitems tables
Feedback	Feedback message text, feedback type (bug / suggestion / general), star rating (1–5)	feedbacks table; submitted via POST /api/feedback
Analytics Events	Screen views, button clicks, form submissions, search queries, API calls, errors, login/logout events, frequency play/stop events, subscription funnel steps, session start/end, time on screen, scroll depth, user ID, user type, login method, country, device type, app version, session ID	Firebase Analytics (GfAnalyticsService); enabled in release builds only
Crash & Diagnostic Reports	Crash stack traces, non-fatal exceptions, breadcrumb log messages, current screen name, user ID, custom diagnostic keys	Firebase Crashlytics (GfCrashlyticsService); enabled in release builds only
Performance Data	Network request latency, app startup time, UI rendering performance	Firebase Performance Monitoring (firebase_performance package)
Push Notification Records	Notification title, body, image URL, target type (user / broadcast), sent/failed device count, error message, timestamp	notificationlogs table; admin-initiated via FCM
Server Request Logs	HTTP method, URL path, response status code, response time (milliseconds). No request body content is logged.	Serilog rolling log files (logs/greatenergy-*.log, daily rotation); RequestLoggingMiddleware
Local Device Storage (App Only)	JWT Bearer token (in system keychain / Keystore via flutter_secure_storage), serialised user profile JSON (in system keychain / Keystore), received push notification records (SQLite database ge_local.db)	GESessionService, GELocalService

What we do NOT collect: We do not collect passwords (authentication is Google OAuth or OTP only). We do not access your camera, microphone, contacts, precise or approximate location, or photos/media library. No advertising SDK is present.

3. How We Use Your Information

• Account management: Creating and maintaining your account, authenticating your identity, and providing access to your personalised content and subscription tier.
• Core app functionality: Saving your playlists, custom frequencies, app settings, and daily reminder preferences so they persist across devices.
• Activity history: Displaying your playback history (programs, playlists, chakra sequences you have played).
• Subscription and billing: Processing payments through Razorpay (Android) or Apple App Store in-app purchases (iOS), granting Pro access, and managing renewal or cancellation.
• Push notifications: Delivering app notifications such as daily reminders and admin-broadcast announcements to your registered device(s).
• Analytics: Understanding how users interact with app features to improve content, navigation, and performance.
• Crash reporting: Detecting and fixing application crashes and errors to improve stability.
• Performance monitoring: Measuring network and rendering performance to optimise the user experience.
• Feedback handling: Reviewing bug reports and suggestions submitted by users.
• Security and rate limiting: Preventing abuse, unauthorised access, and excessive requests.

4. Authentication and Account Data

Great Wave uses Google Sign-In as its primary authentication method. When you sign in with Google, we receive a Google ID token which we verify against Google's tokeninfo endpoint (https://oauth2.googleapis.com/tokeninfo). We store your Google account ID (sub), name, email address, and profile picture URL in our database. AuthService.cs – GoogleSignInAsync GEUser.cs – GoogleId, Email, ProfilePicUrl

For phone number registration, we send a one-time password (OTP) to your mobile number via WhatsApp or SMS. We store your phone number and verification status once confirmed. AuthController.cs – SendOtp / Register GEUser.cs – MobileNumber, MobileVerified

Upon successful authentication, the backend issues a signed JWT Bearer token (HS256, 24-hour expiry). The Flutter app stores this token securely in the operating system's encrypted credential store (Android Keystore / iOS Keychain) using flutter_secure_storage. The token is never stored in plain text. GESessionService.dart – saveSession Program.cs – JWT configuration

You can permanently delete your account and all associated personal data at any time using the in-app account deletion feature, which calls DELETE /api/user/account. This removes your user record, activity logs, devices, feedbacks, subscriptions, and payment records from our database within a single database transaction. UserController.cs – DeleteAccount UserService.cs – DeleteAccountAsync

5. Device Information

We collect and store your device's Firebase Cloud Messaging (FCM) token and platform identifier (Android or iOS) in the userdevices table. This information is used solely to deliver push notifications to your device. Each user may have multiple registered devices. Tokens are deactivated on logout. GEUserDevice.cs UserService.cs – UpdateDeviceTokenAsync

The device_info_plus package is used to determine the device type (phone, tablet) for analytics grouping purposes only. This information is sent to Firebase Analytics as a user property and is not stored in our database. GfAnalyticsService.dart – _resolveDeviceType

6. Permissions Used

Permission	Platform	Purpose
INTERNET	Android	Required for all API calls to the backend, Firebase services, and Razorpay.
FOREGROUND_SERVICE & FOREGROUND_SERVICE_MEDIA_PLAYBACK	Android	Enables the audio playback service to run as a foreground service (visible notification while playing).
WAKE_LOCK	Android	Prevents the CPU from sleeping during active audio playback sessions.
RECEIVE_BOOT_COMPLETED	Android	Allows the app to reschedule local notification alarms after device restart.
POST_NOTIFICATIONS	Android 13+	Prompts the user for permission to display push notifications (Android 13 and above).
READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE	Android < 10	Declared for legacy Android versions; required by the underlying flutter_sound and audio_service packages for audio buffer management on older devices. Note: These permissions are not used to access user files, photos, or media library content. These declarations apply only to Android 9 (API 28) and below.
Background Audio (UIBackgroundModes: audio)	iOS	Allows audio playback to continue when the app is in the background.
Background Fetch (UIBackgroundModes: fetch)	iOS	Allows the app to fetch updated content periodically in the background.
Remote Notifications (UIBackgroundModes: remote-notification)	iOS	Allows the app to receive and process FCM push notifications in the background.

Permissions NOT requested: Camera, microphone, precise location, approximate location, contacts, photo/media library access. None of these are declared in AndroidManifest.xml or Info.plist.

7. Data Storage and Security

Your data is stored in a MySQL database managed by SSSD Tech Solutions Pvt Ltd. The following security measures are in place based on the codebase:

• JWT authentication: All API endpoints (except public registration/login) require a valid signed JWT. Tokens expire after 24 hours. Program.cs – JWT Bearer configuration
• HTTPS enforcement: The application enforces HTTPS redirects and HSTS headers in production. Program.cs – UseHttpsRedirection / UseHsts
• Secure token storage on device: JWT tokens are stored in the OS encrypted credential store (Android Keystore / iOS Keychain). GESessionService.dart – flutter_secure_storage
• Admin cookie security: Admin session cookies are HttpOnly, Secure, and SameSite=Strict. Program.cs – Cookie configuration
• Payment signature verification: Razorpay payment callbacks are verified using HMAC-SHA256 signature validation before any subscription is activated. SubscriptionService.cs – VerifyRazorpayPaymentAsync
• Rate limiting: The API enforces a global rate limit of 60 requests/minute and a stricter limit of 10 requests/minute on authentication endpoints to prevent brute-force attacks. Program.cs – Rate limiter configuration
• Server-side logging: Request logs contain HTTP method, URL path, status code, and response time only — no request body content is logged. Log files are stored on the server with daily rotation. RequestLoggingMiddleware.cs

8. Third-Party Services

Great Wave integrates the following third-party services that may receive your personal data:

Service	Provider	Data Shared	Privacy Policy
Google Sign-In & Firebase Authentication	Google LLC	Google ID token (for verification), user identity (name, email, Google ID)	policies.google.com/privacy
Firebase Analytics	Google LLC	Anonymised usage events, user properties (user type, country, login method, device type, app version), session ID. Analytics collection is disabled in debug builds.	policies.google.com/privacy
Firebase Crashlytics	Google LLC	Crash stack traces, non-fatal error reports, breadcrumb logs, user ID, current screen name. Collection is disabled in debug builds.	policies.google.com/privacy
Firebase Cloud Messaging (FCM)	Google LLC	FCM device token (to route push notifications to your device)	policies.google.com/privacy
Firebase Performance Monitoring	Google LLC	Network request latency, app startup time, trace performance data	policies.google.com/privacy
Razorpay	Razorpay Software Pvt Ltd	Payment order details (amount, currency), payment ID (for verification). Full payment card data is handled by Razorpay and never transmitted to or stored by Great Wave.	razorpay.com/privacy
Apple App Store In-App Purchases	Apple Inc.	Apple receipt data reference (stored for subscription verification). Full payment data is handled by Apple and never transmitted to or stored by Great Wave.	apple.com/legal/privacy
Google Play In-App Billing	Google LLC	Purchase token and subscription status. Full payment data is handled by Google.	policies.google.com/privacy
WhatsApp / SMS OTP	Configurable third-party OTP provider	Mobile phone number (to deliver the OTP). The specific provider is configured at the infrastructure level.	Varies by provider

We do not use advertising networks, ad SDKs, data brokers, or social media tracking pixels. No advertising identifier (GAID / IDFA) is collected or transmitted.

9. Cookies and Tracking Technologies

The Great Wave mobile app does not use browser cookies. Authentication state is maintained via a JWT Bearer token stored in the device's secure credential store.

The Great Wave admin web panel (accessible only to SSSD Tech Solutions administrators) uses a single HttpOnly, Secure, SameSite=Strict session cookie for admin authentication. This cookie is not accessible to end users of the mobile app. Program.cs – Cookie authentication configuration

Firebase Analytics and Crashlytics use persistent identifiers (Firebase Installation ID) on the device to correlate sessions and crash reports. These identifiers are managed by the Firebase SDK and are subject to Google's Privacy Policy. Analytics collection is disabled in debug/development builds. GfAnalyticsService.dart – setAnalyticsCollectionEnabled GfCrashlyticsService.dart – setCrashlyticsCollectionEnabled

10. Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following circumstances:

• With third-party service providers listed in Section 8 above, strictly for the purposes described (authentication, analytics, crash reporting, push notifications, payment processing).
• Legal compliance: We may disclose your data when required by law, court order, or governmental authority, or to protect the rights, property, or safety of SSSD Tech Solutions, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the successor entity subject to equivalent privacy protections.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right to access: You can view your profile information within the app (via the Profile screen, which calls GET /api/user/profile).
• Right to rectification: You can update your app settings at any time via the Settings screen (PUT /api/user/settings).
• Right to erasure (Right to be Forgotten): You may permanently delete your account and all associated personal data by using the account deletion feature in the app (DELETE /api/user/account). This deletion is irreversible and covers: account record, activity logs, device tokens, feedbacks, subscriptions, and payment records. UserService.cs – DeleteAccountAsync
• Right to withdraw consent / opt out of notifications: You can disable push notifications in the app Settings or through your device's notification settings. GEUserSettings – NotificationsEnabled
• Right to portability: To request an export of your data, please contact us at the address in Section 14.
• CCPA right to opt out of sale: We do not sell personal information. No opt-out mechanism is therefore required, but you may contact us to confirm this.

To exercise any right, please contact us using the details in Section 14. We will respond within 30 days.

12. Data Retention

We retain personal data for as long as your account remains active or as needed to provide the service:

• Account data (name, email, mobile number, Google ID): retained for the lifetime of your account. Deleted immediately upon account deletion request.
• Activity logs (useractivities): retained for up to 12 months for the purpose of displaying your history and improving recommendations, then purged. Deleted immediately upon account deletion.
• Device tokens: deactivated on logout; deleted upon account deletion.
• Payment & subscription records: retained for a minimum of 7 years for financial compliance purposes, even after account deletion, in line with applicable tax and accounting regulations. Only transaction identifiers, amounts, and status are retained; no payment card data is stored by us.
• Feedback: retained until reviewed and resolved, or until account deletion.
• Server logs: daily rolling log files are retained for up to 30 days, after which they are automatically overwritten by the rolling file configuration. Program.cs – Serilog RollingInterval.Day
• Firebase Analytics / Crashlytics data: retained according to Google's Firebase data retention settings (default: 60 days for event data; 90 days for user-level data). Refer to firebase.google.com/support/privacy for details.
• Local on-device data (JWT token, notification cache): cleared when you log out or delete the app from your device.

13. Children's Privacy

Great Wave is not directed at children under the age of 13 (or under 16 in the European Economic Area). We do not knowingly collect personal data from children. Registration requires a Google account or a verified mobile phone number, which implicitly requires users to meet the minimum age requirements of those services.

If you believe a child under the applicable age has provided personal data to us, please contact us immediately and we will delete that data.

14. International Data Transfers

SSSD Tech Solutions Pvt Ltd is incorporated in India. Your personal data is processed and stored on servers located in India or in cloud regions operated by our infrastructure providers.

Data transmitted to Google Firebase services (Analytics, Crashlytics, FCM, Performance) may be processed in the United States and other countries where Google operates its infrastructure. Google processes this data in accordance with its Privacy Policy and applicable data transfer mechanisms.

Data transmitted to Razorpay is processed in India (Razorpay Software Pvt Ltd is incorporated in India).

By using Great Wave, you consent to the transfer of your data as described above. If you are a resident of the EEA and have concerns about international transfers, please contact us.

15. Contact Information

For data deletion requests, you may also use the in-app account deletion feature (Settings → Delete Account) which immediately and permanently removes all your personal data from our systems.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, third-party services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify you through the app or by email.

We encourage you to review this Privacy Policy periodically. Continued use of Great Wave after any changes constitutes your acceptance of the revised policy.