Account Deletion & Data Requests

1. Right to Erasure & Deletion

Aphelion Pvt. Ltd. fully respects your right to control your personal data. This policy details how you can permanently delete your Maleu account and how to request access or correction under DPDPA 2023.

2. How to Delete Your Account

Account deletion is fully self-service. You do not need to contact our support team. You can delete your account inside the mobile app at this navigation path:

Once you confirm deletion:

• Immediate Removal: Your authentication account, profile, posts, messages, saved items, fitness data, Poses records, and related active database rows are removed immediately. You are logged out of the app.
• No Self-Service Restore Window: This deletion is permanent once confirmed. You cannot cancel it by logging back in.
• Media Purge Queue: Owned photos and videos are queued for backend deletion from active Cloudflare R2 storage. Backup and security log retention remains subject to the schedules and legal exceptions described below.

3. What is Completely Purged

The permanent purge erases all personal details from our active servers:

• Profile data (display name, username, biography, profile avatar, and cover photo).
• All user posts (Lines, Planes, Dots, Rays, Poses, Wrex fitness cards, and comments).
• Media assets (owned photos and videos stored in Cloudflare R2 are queued for deletion from active media storage).
• Direct messages and group chats (message text and owned chat media are removed; conversation shells may remain for other participants where needed to preserve their chat layout).
• Bloom progress, saved Bloom collections, Wrex workouts, run/walk metrics, diet and hydration logs, Poses saved records, AI suggestion metadata, notification preferences, push token, and account settings linked to your user id.
• Stored credentials and authentication session tokens.

4. What is Retained Under Exception

In accordance with Indian law, data deletion is suspended in the following exceptional cases:

• Law Enforcement Holds: If we receive a valid court summons, warrant, preservation request, or digital police hold, the affected data is locked and retained for the duration of the legal hold.
• CSAM Evidence: All digital markers, access logs, and content confirmed as CSAM are locked and preserved indefinitely for referral to the Cyber Crime Cell.
• Moderation and Safety Records: Reports, account flags, removal actions, admin audit logs, and abuse-prevention counters may be retained when needed to investigate platform misuse, protect other users, comply with legal duties, or defend enforcement decisions.
• Anonymized System Analytics: Aggregated system performance and overall metrics (devoid of usernames or identifiers) are kept to analyze traffic stability.

5. Access and Portability Requests

Under DPDPA 2023, you have the right to request a summary of the personal data we hold about you (Right to Know) or correct inaccurate information.

While automated data export features are planned for future development, you can submit manual request emails to:

Please provide your registered email or username. All valid, verified requests will be addressed by our Intermediary Compliance team within 15 working days. Escalated grievances can be directed to our designated Grievance Officer, Dharantej Reddy Poduvu, at the same email address.