Privacy Policy

1. Introduction

This Privacy Policy explains how Danify Tech ("Danify Tech", "we", "us", or "our") collects, uses, stores, shares, protects, and deletes personal data when you use SOCHI through its Windows application, Android application, website, application programming interfaces, support channels, or related services (collectively, the "Service").

SOCHI provides protected file storage and sharing, with supported viewing, editing, messaging, and calling features. It processes data on your device and on infrastructure used by Danify Tech to provide the features you choose.

By using SOCHI, you acknowledge the practices described in this Policy. This Policy should be read together with the SOCHI Terms of Service. Where we rely on consent, we request it separately for the relevant processing.

2. Information we collect

2.1 Account and identity information

We process information such as:

• Username.
• Optional first and last name and profile photo. Names are display labels and do not need to be unique; the username remains the account identifier. Display names are visible to connected friends, people involved in friend requests or file shares, and members of shared groups. You can edit or clear your name in Account settings.
• Email address.
• Password hash and password-security metadata. We do not store your plaintext password.
• Email-verification status.
• Two-factor authentication settings and short-lived verification challenges.
• Account status, creation date, and deletion state.
• Support and privacy-request correspondence.

2.2 Device, session, and security information

We may process:

• Device name and platform.
• Session identifiers, authentication records, expiry times, and access status.
• IP address, user agent, request time, and security events.
• Login, verification, password-reset, device-revocation, and administrative audit events.
• Rate-limit, fraud, abuse, error, and diagnostic information.
• Device-registration information, public security keys, and authorization records used to recognize authorized devices.
• Where supported and enabled, application-version and integrity information and device-security check results. These are security signals, not a guarantee that a device is uncompromised.

Where SOCHI requests Windows Hello or Android biometric authorization, the operating system performs the biometric check. SOCHI does not receive your fingerprint, facial template, or device PIN through these authorization interfaces; it receives the authorization result and, where supported, signed evidence. Availability and enforcement depend on the platform, configuration, and feature.

2.3 File and storage information

To provide SOCHI, we process:

• Original filename, file extension, media type, and file size.
• File identifiers, content fingerprints, and integrity-verification results.
• Storage usage, file availability, and timestamps.
• File contents, stored in encrypted form on service infrastructure, and backups used for recovery.
• Upload/download status, transfer identifiers, integrity checks, and transfer timing.
• Protected files, offline copies, thumbnails, and temporary working data stored by SOCHI on your device.

Content fingerprints may identify matching files and help check integrity or optimize storage. We treat them and other file metadata as protected service data.

2.4 Sharing and safety information

When you use sharing or safety features, we process:

• Sender and recipient usernames.
• File name and identifier, permissions, status, expiry, and acceptance time.
• Block and unblock records.
• Share reports, report reasons, review status, and related audit events.
• Sent, received, declined, revoked, expired, and accepted-share history.

Recipients can see the sender's username. Sender-facing responses may be deliberately generic so they do not reveal whether a recipient already has a particular file or has blocked the sender.

2.5 Communications

We process email-delivery information for account verification, login codes, password recovery, security alerts, support messages, and important service notices. Transactional emails may be delivered through our email provider.

Friends and messaging features process friend requests, contact relationships, presence, message content, attachments, delivery/read state where available, conversation preferences, and deletion or expiry information. Voice and video calling process call participants, signaling, connection state, timestamps, and call history. Camera and microphone access is used for calls you initiate or accept after granting device permission. Media is transmitted to the other participant; network traversal or relay infrastructure may process it to establish or maintain the connection. SOCHI does not provide automatic server-side call recording as a standard calling feature. Another participant or external software may still capture a conversation.

Notifications may process Windows notification-channel information or Android push tokens and delivery metadata. Device notification settings determine what can appear outside the app. Message expiry is optional, not a universal 24-hour deletion promise, and does not erase copies already retained by a recipient, screenshots, or applicable backups.

3. How we use information

We use personal data to:

• Create, verify, authenticate, secure, and administer accounts.
• Provide uploads, protected storage, synchronization, reconstruction, opening, exporting, deletion, and sharing.
• Authorize file transfers and maintain separate user libraries and permissions.
• Manage storage efficiently, including recognizing identical content.
• Restore a user's account library on an authorized replacement or additional device.
• Process accepted, declined, expired, revoked, blocked, and reported shares.
• Detect abuse, malware-related behavior, unauthorized access, fraud, and service disruption.
• Diagnose failures, measure performance, improve reliability, and provide support.
• Maintain backups, disaster recovery, auditability, and legal compliance.
• Enforce the Terms of Service and protect users, Danify Tech, and third parties.

We do not sell personal data. We do not use file content for advertising, and we do not use it to train public artificial-intelligence models.

4. Legal bases

Depending on the circumstances and applicable law, we rely on:

• Contract: processing needed to create your account and provide the Service you request.
• Legitimate interests: securing the Service, preventing abuse, maintaining availability, deduplicating storage, diagnosing faults, and improving performance, where those interests are not overridden by your rights.
• Consent: optional communications or features where consent is required. You may withdraw consent without affecting earlier lawful processing.
• Legal obligation: records or disclosures required by law, court order, regulatory request, taxation, accounting, or lawful investigations.
• Protection of vital interests or legal claims: where necessary to protect a person, establish or defend claims, or respond to serious abuse.

5. Storage, encryption, and access

SOCHI uses encryption in transit and at rest. Files and related information may be stored on your device and on service infrastructure to support access, synchronization, recovery, and sharing. Storage savings and offline availability vary; not every file is available without an internet connection.

Storage may be optimized for identical content while keeping account permissions separate. Deleting a file from your library does not delete legitimate copies held by recipients or other users, or data retained under the periods described below.

Device protection varies by platform, installation, and settings. Authorized viewing and editing require readable content in device memory and, where needed, temporary working files. SOCHI attempts to clean up temporary data when no longer needed, but crashes and copies made outside the app can prevent complete cleanup. Updates do not guarantee that every previously stored copy immediately receives newer protections.

Integrated editors process selected files on your device and save supported outputs to your SOCHI library. Printing, external exports, and recipient copies can create data that SOCHI cannot recall.

Where enabled, security checks use device and application information to help authorize access. They do not guarantee that every device or running process is trustworthy. While offline, a device cannot immediately receive new account or access restrictions.

SOCHI is not represented as zero-knowledge or end-to-end encrypted. Authorized service systems may process file contents as needed to provide and protect storage, synchronization, recovery, sharing, and support. Access is restricted to authorized purposes and personnel or providers who need it for those purposes.

6. When we disclose information

We may disclose limited information to:

• Amazon Web Services: compute, private object storage, database, backups, monitoring, and related infrastructure.
• Cloudflare: DNS, network routing, security, and proxy services where enabled.
• Resend: transactional email delivery.
• Google Firebase Cloud Messaging and Microsoft Windows notification services: push delivery and channel/device identifiers where configured.
• Calling connectivity providers: connection metadata and, when relaying is necessary, call traffic handled by configured traversal/relay infrastructure.
• Professional advisers: lawyers, auditors, insurers, accountants, and security specialists subject to confidentiality obligations.
• Authorities or affected parties: when required by law or reasonably necessary to protect rights, safety, security, investigate abuse, or enforce agreements.
• A successor organization: as part of a merger, financing, reorganization, acquisition, or sale, subject to appropriate safeguards and notice where required.

Service providers may process information only for contracted purposes and under their own applicable legal and security obligations.

7. International data transfers

SOCHI infrastructure may process data outside your state or country, including in AWS regions selected by Danify Tech. Where required, we use contractual, technical, organizational, or other lawful safeguards for international transfers. You may contact us for information about applicable transfer safeguards.

8. Retention

Retention periods may be adjusted for security, legal, and operational needs. Current default operational periods include:

When you delete a file, SOCHI removes your reference and local package as requested. Shared server storage remains only while another user or pending share still references it, or while a backup or legal retention period applies.

When you delete your account, we remove or deactivate the active account, sessions, shares, blocks, reports, and file references. Residual encrypted data may remain temporarily in database backups, object versions, logs, fraud-prevention records, or disaster-recovery systems until scheduled expiry. Accepted files in another user's account are controlled by that recipient's separate reference.

We may preserve limited data when reasonably necessary for legal obligations, dispute resolution, security investigations, prevention of repeated abuse, or enforcement.

9. Security

SOCHI uses safeguards designed for the sensitivity and risk of the data, including:

• HTTPS transport encryption.
• Private object storage and encryption at rest.
• Protected authentication credentials, expiring sessions, email verification, and optional two-factor authentication.
• Authorized file transfers.
• Account-separated client storage and encrypted local packages and caches.
• Abuse prevention, security records, file-integrity checks, and restricted administrative access.
• Platform-dependent device and application protections where available and enabled.

No storage or transmission system is completely secure. Available protections vary by platform and settings and do not guarantee confidentiality against malware, administrators, unauthorized recording, or a compromised device. You remain responsible for protecting your password, email account, devices, exported originals, and files opened outside SOCHI.

10. Your choices and rights

Depending on applicable law, you may have rights to:

• Be informed about processing.
• Access personal data associated with your account.
• Correct inaccurate account information.
• Obtain a portable copy of eligible information.
• Request deletion or restriction.
• Object to certain processing based on legitimate interests.
• Withdraw consent where processing relies on consent.
• Revoke devices and sessions.
• Delete file references and your account.
• Block or unblock users, decline shares, and report abuse.
• Complain to a data-protection authority.

You can perform several actions directly in SOCHI. For other requests, email privacy@danifygroup.com. We may verify your identity before acting. We aim to respond within 30 days, subject to applicable law, request complexity, and permitted extensions.

Users in Nigeria may complain to the Nigeria Data Protection Commission at ndpc.gov.ng. Users elsewhere may contact their local supervisory authority.

11. Account synchronization and local device data

If automatic synchronization is enabled, signing in on a device may download or regenerate the protected local SOCHI packages for files referenced by your account. Disabling automatic synchronization stops this automatic action, but you can request manual synchronization.

SOCHI stores account data in separate application-controlled directories. Files exported or opened through another application may be copied outside SOCHI's protected storage and become subject to the device, operating system, destination application, or recipient's security practices.

SOCHI Manager and watched-folder uploads process the folders you select, their paths, filenames, change information, and eligible file contents to perform the automatic uploads you enable. Adding or changing a watched folder can upload existing or newly changed eligible files. Review your selected folders, synchronization controls, and notification permissions before enabling automation.

12. Cookies, analytics, and automated decisions

The native SOCHI clients use local storage and application preferences for authentication state, account-specific settings, interface preferences, and functionality. The public legal and health pages do not currently require advertising cookies.

SOCHI may calculate automated security and operational signals, such as rate-limit decisions, integrity failures, duplicate-content matches, or suspicious activity. SOCHI does not currently perform advertising profiling or make solely automated decisions that produce legal or similarly significant effects. If this changes, we will update this Policy and provide required choices.

13. Children

SOCHI is intended for people who are at least 18 years old or have reached the age of legal majority in their jurisdiction. We do not knowingly provide accounts to children who cannot legally agree to the Terms. Contact privacy@danifygroup.com if you believe a child has provided personal data without valid authorization.

14. Data incidents

If we identify a personal-data breach, we will investigate, mitigate harm, preserve necessary evidence, notify regulators, and notify affected users when required by applicable law.

15. Changes to this Policy

We may update this Policy as SOCHI, our providers, or legal requirements change. We will update the date above and provide additional notice through the Service, website, or account email when a change is material. Continued use after the effective date of an updated Policy means the updated Policy applies, subject to rights that require separate consent.

16. Contact

Privacy: privacy@danifygroup.com Support: support@danifygroup.com Legal notices: legal@danifygroup.com Provider: Danify Tech, Nigeria