Privacy Policy

Last updated: September 7, 2026

This Privacy Policy explains how Charlo processes information when you use the Charlo mobile app and related services. Charlo is a messaging and audio-calling service provided by Shahid Khan Apps.

Information We Collect

We collect or receive information that you provide, information created when you use Charlo, and information needed to operate the service. The information depends on the features you use.

Account and Profile Information

A Charlo account includes a username and display name. You may also provide an email address, which can be used for sign-in or password recovery. Charlo stores account identifiers, authentication records and account timestamps needed to operate the account.

If you use Google Sign-In, Charlo receives the verified Google account email address, display name and a Google account identifier used to authenticate or link your Charlo account. Charlo does not receive your Google password.

You may add or change profile information, including a profile photo. Profile names, usernames and profile photos can be shown to people you interact with in Charlo.

Messages and User Content

Charlo stores the content you send so that it can be delivered and displayed in your conversations. This includes text messages, replies, images, voice messages and supported files or documents. Messages can have creation timestamps and may include a client message identifier to prevent duplicate delivery.

Charlo also processes messaging metadata such as delivery and read status, conversation membership, message deletion status and reactions. Reactions and replies are associated with the relevant message and user.

Photos, Voice Messages and Files

Images, profile photos, voice messages and supported documents that you choose to upload are stored in Charlo's media storage so authorized conversation participants can access them. Charlo processes file type, size and media metadata needed to validate, resize, deliver and display that content.

Audio Calling

Charlo provides audio calls. The app uses your microphone during a call after you grant microphone permission. Charlo's call server processes call signaling and technical call metadata such as the participants, call state, timestamps, connection state and call outcome. Completed or terminal calls can create a call-history entry containing the outcome and duration.

The current call implementation does not upload or store the call audio as a recording. Call audio is exchanged by the call media connection; Charlo's signaling service coordinates that connection. This statement does not mean that calls are end-to-end encrypted, and Charlo does not make that claim here.

Device and Technical Information

To keep sessions working and deliver notifications, Charlo processes technical information such as an app installation/device identifier, Firebase Cloud Messaging token, platform information, app version, Android version and network information used during normal server operation. Servers may also process IP address and request information for connections, rate limiting, security and troubleshooting.

The app includes a bounded local call-diagnostics file containing call lifecycle and technical breadcrumbs. It is stored on the device, is not a message or call recording, and can be cleared from the app's diagnostics screen. No third-party analytics or crash-reporting SDK was identified in the current app implementation.

Permissions

Depending on the features you use, Charlo requests or declares:

• Microphone: voice messages and audio calls.
• Camera: taking a photo to send or use as a profile photo.
• Notifications: message, reaction and call notifications.
• Bluetooth audio: routing call audio to supported Bluetooth devices.
• Network access: connecting to Charlo's services.

Charlo requests location permission only when you choose the location- sharing feature, as applicable. For a user-selected static location message, Charlo can use your precise location. The coordinates are transmitted to Charlo's server and stored as part of that message so the recipient can receive and view the shared location.

Static location sharing is user-initiated. Charlo does not continuously monitor your location through this feature and does not use it for continuous or background location tracking. When you attach a photo or file, Android's system sharing or file-selection flow provides the item you choose.

How We Use Information

Charlo uses information to:

• create and maintain accounts and profiles;
• deliver, display and synchronize messages, media, reactions and receipts;
• provide audio calls, notifications and account recovery;
• operate blocking, reporting and safety features;
• authenticate users, protect accounts, prevent abuse and enforce service rules;
• troubleshoot failures and maintain service reliability; and
• meet legal and security obligations.

Push Notifications

Charlo uses Firebase Cloud Messaging to deliver push notifications for messages, reactions and calls. The server stores a protected form of the FCM token together with the account and installation/device identifier so notifications can be routed. You can disable notifications in Android settings. Signing out or deleting your account revokes or removes the associated registration handled by Charlo.

Third-Party Service Providers

Charlo uses service providers needed to operate its features, including:

• Google: Google Sign-In identity verification and Firebase Cloud Messaging.
• Resend: delivery of password-recovery email when that feature is used.
• Hosting, database and media infrastructure providers: operation of the Charlo service and storage of service data.

These providers process information for the services they provide to Charlo. Their own privacy policies may also apply to their processing.

Data Sharing

Charlo does not sell or rent personal information and does not share personal information with advertisers for advertising purposes. Information is shared with conversation participants when you choose to communicate with them, with service providers needed to run Charlo, and when necessary for safety, fraud prevention, legal process or protection of Charlo and its users.

Data Retention

Charlo keeps account information, messages, media, reactions, receipts, reports and call-history information for as long as needed to provide the service, support user safety, maintain security, resolve disputes or comply with legal obligations. Charlo does not publish a single fixed retention period for all data because retention depends on the type of information and the feature involved.

Call-signaling records have a short technical expiry for call recovery and are removed as they expire. Local call diagnostics remain on the device until cleared, rotated by the app, or removed with app data.

Account and Data Deletion

You can request deletion from the account settings inside Charlo after re-authentication. The deletion process removes or anonymizes the account's login and profile data, authentication identities, push-token registrations, profile photo, sent message content and sent media, along with other account-linked data described on the Account Deletion page.

Some anonymized conversation or call-history records and structured safety or moderation records may remain where needed to preserve other users' records, prevent abuse, resolve disputes or meet legal obligations. Those retained records cannot be used to sign in to or find the deleted account. Deletion is permanent.

Blocking, Reporting and Safety

Charlo stores block relationships so blocked users cannot interact with you through supported features. You can report a user or message with a reason and optional details. Reports may be reviewed by authorized moderators for safety and enforcement. Report records may be retained as needed for safety, fraud prevention, dispute resolution or legal obligations.

See Charlo's Child Safety Standards for the service's child-safety rules and reporting information.

Security

Charlo uses measures intended to protect information, including HTTPS network transport, authenticated access controls, password hashing, protected session storage on the device, encrypted local session preferences and protected handling of push-token data. No security method can eliminate every risk, so please protect your account credentials and device.

International Processing

Charlo and its service providers may process information in countries other than the country where you live. Where required, Charlo applies appropriate safeguards for that processing. The exact location can vary with the provider and service component.

Changes to This Privacy Policy

Charlo may update this Privacy Policy when its features, service providers, legal obligations or data practices change. The updated version will be posted at this URL with a new “Last updated” date.

Contact

For privacy questions or requests, contact support@charloapp.com. You can also review the Account Deletion page or the Child Safety page.