1. Who can use the App

Only members of the Rajendra Sinhji Institute who have been admitted per the RSIHYD rules and whose membership numbers are registered on this Application may use member facilities such as Address Change, View My Bill, Ledger & Smart Card, Room / Hall / Event / Sports Booking, Food Order, My Profile. The RSIHYD is responsible for the content displayed in the Application including posts and images.

2. Data the App actively collects

The App collects only the minimum data required for it to function. Consistent with the App''s Data safety declaration in Google Play, the categories of personal and sensitive user data actively collected by the App and its third-party SDKs are:

• Device or Other IDs - a per-install identifier and the Firebase Cloud Messaging (FCM) push-notification token issued by Google to your device. Used only for App functionality: routing push notifications to your device and identifying your App installation to our server so member pages can be loaded. Stored on our server against your membership number for that routing purpose only.
• App activity and diagnostics - standard error and crash diagnostics generated on your device (App version, OS version, device model, timestamps of failures) so we can fix bugs. No personal information is included.

In addition, the following are handled by the App on a purely functional or on-device basis and are not collected in the Google Play Data Safety sense:

• Authentication session - when you log in with the credentials issued to you by the RSIHYD membership office, a session cookie is issued so member pages (ledger, smart card, bookings, orders, payments) can load inside the App''s in-app browser. The cookie is bound to the club''s domain and is cleared on logout.
• Camera (on-device only, when you tap "Scan QR") - the App activates the camera locally to decode a QR code (club entry / food-order table / member QR). No image or video is uploaded, saved or shared off your device.
• Files and downloads - the App may save bills, receipts, PDFs or announcement attachments to your device''s app-specific storage so you can view them offline. Files are stored only on your device.

3. What the App does NOT collect

To be explicit, and consistent with the App''s Data safety declaration:

• The App does not create accounts. Your login user-id and initial password are issued directly to you by the RSIHYD membership office as part of your existing club membership. The App only sends these credentials to our server to authenticate your session; it does not store or share them with any third party.
• The App does not collect your name, email address, mobile number, postal address, date of birth, family details, membership number or membership photograph through the App. All of that already exists in the club''s central member-management system because you enrolled as a member through the club''s offline membership process. The App simply displays this information to you and lets you request updates via the standard club channels.
• The App does not collect precise or approximate location, contacts, call logs, SMS, health or medical data, financial account credentials, or any other special-category personal data.
• The App does not collect payment card, UPI or bank credentials. Online payments (bills, smart-card recharge, food orders, event / hall / room bookings) are made on the payment gateway''s own PCI-DSS-compliant page inside the in-app browser (see section 6). Card numbers, CVV, UPI PIN and bank credentials are entered directly on the payment gateway page and are never seen, stored or logged by the App or the RSIHYD. We receive only the transaction reference and its success / failure / cancellation status.
• The App does not use your data for advertising, does not sell it, and does not share it with data brokers.

4. Android permissions we request

The App requests only the permissions it needs to function. Each permission is used solely for the purpose stated below:

• Internet & Network state - to call the club's servers and detect offline conditions.
• Camera - only when you tap "Scan QR" (entry / table QR / member QR). Not used in the background.
• Flashlight (Torch) - only to improve QR-code scanning in low light; only while the scanner screen is open.
• Storage (Read External Storage) - to view or save bill PDFs, receipts, and downloaded documents.
• Post Notifications / Receive from GCM (Wake lock & C2DM Receive) - to display Firebase Cloud Messaging push notifications from the club.
• Get Accounts - required by legacy Google Play Services libraries for Firebase; the App does not read your Google accounts list for any club purpose.

You can revoke any of these permissions at any time from your device's Settings > Apps. Some App features that depend on the revoked permission will stop working (for example, QR scanning without Camera).

5. How the data we do collect is used

The Device / Other IDs and diagnostics that the App actively collects (see section 2) are used only for the following limited purposes:

• Route push notifications from the club to your device (booking confirmations, bill reminders, event alerts, service messages) via the Firebase Cloud Messaging (FCM) push token.
• Identify your App installation to the club server so that your member pages (ledger, smart card, bookings, orders, payments) can be loaded when you log in.
• Diagnose crashes and errors and improve App stability, security and performance.

Any actions you perform inside the App (viewing bills, viewing ledger, requesting an address change, placing a food order, booking a room / hall / event / sports facility, submitting feedback, initiating a payment) are relayed by the App to the club''s central member-services server. The App is a front-end only; it does not add new personal-information records outside what the club already holds about you as a member.

6. Third-party services we use

We rely on the following third-party services and SDKs to run the App. These processors receive only the personal and sensitive user data needed for their specific function and are contractually bound to protect it. Each processor is declared consistently in the App's Data safety section in Google Play Console:

• Google Firebase Cloud Messaging (push notifications) - receives your FCM device token and the notification payload. See Google Privacy Policy and Firebase Privacy & Security.
• Google Play Services (transitive Firebase dependency) - see the Google Privacy Policy above.
• Payment gateway (PayU / Razorpay and, for NetBanking, your bank) - processes your payment. Payment credentials are collected by the gateway on its own PCI-DSS-compliant page inside the in-app browser and are not visible to the App. See PayU Privacy Policy or Razorpay Privacy Policy.
• ZXing barcode library (open source, on-device only) - decodes QR codes locally on your device; no data leaves the device.
• Syncfusion Maui component library - UI components only; no personal data is collected by Syncfusion.

7. Sharing and disclosure

We do not sell, trade, rent, license or otherwise disclose your personal information to any advertiser or data broker. We share information only:

• with the third-party processors listed in section 6, strictly to deliver the service you requested;
• with the club's own affiliated / reciprocal clubs where a facility you have used specifically requires it (for example, an affiliated-club visit charge posting to your home-club ledger);
• with your explicit consent, in any other case;
• where required by applicable law, court order, or a lawful request by a public authority, or where we in good faith believe disclosure is necessary to protect our rights, prevent fraud, protect the safety of a person, or investigate a suspected violation of the club's rules.

8. Data storage, retention and security

Personal data is stored on the club's servers located in India, on password- and firewall-protected infrastructure. Data in transit to and from the App is encrypted with HTTPS/TLS. Passwords are stored as one-way hashes and are never displayed to any staff member.

We retain member data for as long as your RSIHYD membership is active, and thereafter only for as long as required for legal, tax, audit or bona-fide dispute-resolution purposes. Push tokens, session cookies and device / log data are retained for short operational windows only.

We apply technical and organisational safeguards appropriate to the nature of the data. However, no method of transmission or electronic storage is 100% secure; we cannot guarantee absolute security. You are responsible for keeping your password and user details confidential - we will never ask you for your password.

9. Your rights

Subject to applicable law you have the right to:

• access the personal information we hold about you;
• request correction of inaccurate or out-of-date information;
• request that we restrict or object to certain processing;
• request a copy of your data in a portable format;
• withdraw a consent you previously gave;
• request deletion of your account and personal data (see section 10);
• lodge a complaint with a competent data-protection authority.

To exercise any of these rights, email info@clubman.in. We will respond within 30 days.

10. Account and data deletion

Because the App does not create accounts or collect member personal data (see sections 2 and 3), deletion has two distinct scopes:

Deleting the data the App itself holds about you - you may request this at any time and we will action it within 30 days:

• Email: send a request from your registered email address to info@clubman.in with the subject line "App Data Deletion Request". Please include your membership number so we can verify your identity.

On verification we will disable your App login, delete the Firebase Cloud Messaging (FCM) push token stored against your membership number, and delete cached session data. You can also simply log out of and uninstall the App at any time - doing so removes the session cookie and stops push-token refresh.

Ending your RSIHYD membership (which owns your name, contact details, ledger, bookings and payment history) is a separate club-membership decision and is not handled through the App. To end your membership please contact the RSIHYD membership office directly. Ledger, billing, payment-transaction and booking records that form part of the club''s statutory books of account will be retained for the period mandated by applicable law (typically 8 years under Indian tax rules) and then deleted; these records remain accessible only to authorised club staff and auditors, not through the App.

11. Children's privacy

The App is intended for use by adult members of Rajendra Sinhji Institute. We do not knowingly collect personal information from children under 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided personal information through the App, please contact us at info@clubman.in and we will delete it promptly.

12. Log information

When you use App services or view content in the App, our servers may automatically record standard log information (IP address, request URL, timestamp, response code, user-agent). This is used for security, abuse-prevention and troubleshooting, and is rotated on a short schedule.

13. International transfers

Personal data is processed in India. Where a third-party processor (for example, Google Firebase) operates infrastructure outside India, the transfer is covered by that processor's own privacy programme and by standard contractual protections.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version, with its effective date, is always published in the App under Settings > Privacy Policy and on the club's website. We will not reduce your rights under this Privacy Policy without your explicit consent. If we make material changes we will notify you in-app or by email before they take effect.

15. Contact us

If you have any questions or concerns about this Privacy Policy, or wish to exercise any of your rights, contact:

Club (data controller): Rajendra Sinhji Institute
Club email: info@clubman.in

Google Play publisher / developer of the App: CHS SOLUTIONS PVT. LTD.
Publisher website: https://clubman.in/
Publisher contact: info@clubman.in
General enquiries: https://clubman.in/contact/

What is a Cookie?

Cookies are small text files that are sent by a website to a web browser and stored by the browser. They enable a website to recognise a device on subsequent visits, remember preferences, and support features such as staying logged in.

Cookies in themselves do not identify the individual user, but some cookies (such as our session cookie) contain a value that is linked to your membership account for the duration of that session.

What cookies do we use?

The RSIHYD App and member-services website use only cookies that are strictly necessary to operate the service:

• Session cookie - set after successful login to keep you signed in as you move between member pages, payment gateway callbacks and ledger / bill screens. It expires when you log out or when the session times out.
• Functionality cookies - remember user-interface preferences (for example, your last selected date range or filter) so the App feels consistent between visits.

We do not use advertising cookies, behavioural-tracking cookies, or third-party analytics cookies inside the App's in-app browser for the member area.

Can you block cookies?

Most browsers accept cookies by default. You can change your browser or device settings to limit or refuse cookies. Because our session cookie is essential to log in, refusing cookies will prevent you from using the member area of the App.