Privacy Policy

1. The short version

• We collect the minimum data needed to run the Platform.
• We never sell your data. We never share it with advertisers.
• Your real name, phone number, and government ID numbers are never displayed publicly.
• Your data is stored on infrastructure within Indian jurisdiction.
• You can ask us to delete your account and data at any time.

2. What we collect

When you create an account:

• Phone number — used as your sign-in identifier. Stored encrypted; never shown publicly.
• Email address — for password recovery and notifications. Stored encrypted; never shown publicly.
• Password — stored as a salted hash; we never see your plain password.
• Language preference — to show the interface in your language.
• Pseudonym — auto-generated (e.g., “Resident-3217”); the only identifier shown publicly.

When you apply for verified membership:

• Real name, date of birth, gender, occupation — for human review.
• Government ID (Aadhaar / Voter ID) and selfie — used once for verification, encrypted at rest, never displayed.

When you post issues, comments, or reactions:

• Content — title, body, media, location of the issue. Publicly visible.
• IP address and browser info — kept for security and abuse forensics. Not displayed publicly.

Automatic technical data:

• Cookies / session tokens — to keep you signed in. Strictly necessary; no advertising cookies.
• IP-based country — to pre-select your country on the Platform. Cached in your session, not stored long-term.

3. What we do NOT collect

• Your home address (we never ask for it).
• Your social-media accounts or contacts list.
• Information about other people on your device.
• Continuous or background location. See Section 3a below for the opt-in, one-time location feature.

3a. Optional location detection (opt-in)

To help you find civic issues in your area, we offer an optional “Use my location” button on certain pages. We do not access your location automatically or without your action.

If you click the button:

• Your browser asks for your permission. If you decline, nothing is shared.
• If you allow, your device sends your latitude and longitude to bigdatacloud.net, a third-party reverse-geocoding service, to convert the coordinates into a postal code.
• The postal code is sent to our server, which looks up your Assembly Constituency.
• Your raw GPS coordinates are NOT stored on our server or kept in your browser. Only the resolved constituency (and only after you confirm) is saved to your session.
• You can always pick your area manually instead.

If we do not have postal-code-to-constituency data for your country, the GPS option is not offered and the IP-based country detection (described below) is the only fallback.

Separately, we read your approximate country from your IP address on every visit so we can show you the right interface — this does not require browser permission and is not stored long-term.

4. How we use what we collect

• To operate the Platform — show your posts to neighbours, let people co-sign, send you notifications about your own activity.
• To prevent abuse — block accounts that violate the Terms of Service; rate-limit suspicious traffic.
• To improve the Platform — aggregate, de-identified analytics about which categories of issues are most reported, how fast they get resolved.
• To comply with law — respond to valid, written legal orders served on us in India.

5. How we protect your data

• Encryption at rest — AES-256-GCM for all personally identifying fields including phone and email.
• Encryption in transit — TLS 1.2+ for every connection.
• Access control — four-tier role hierarchy; every PII view is written to an append-only audit log.
• India-resident storage — your data is held on infrastructure within Indian jurisdiction.
• Media handling — uploaded photos and audio have EXIF GPS data stripped; faces and vehicle plates are auto-blurred before publication.
• Breach response — we follow CERT-In’s 6-hour notification window for reportable incidents.

6. Who can see what

7. How long we keep your data

• Account data — for as long as your account exists.
• Deleted account data — purged within 30 days, except where retention is required by law.
• Verification documents — auto-archived after membership review, deleted within 90 days unless retained for active disputes.
• Audit logs — retained as required by CERT-In and the IT Rules, 2021 (currently 180 days).

8. Your rights under DPDP Act 2023

You have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate data.
• Erase your data (delete your account).
• Withdraw consent for processing.
• Grievance redressal through our Grievance Officer (below).
• Nominate someone to exercise these rights on your behalf in case of your death or incapacity.

To exercise any of these rights, write to voicezenz@gmail.com with your registered email and the request. We respond within seven working days.

9. Lawful disclosure

We disclose user data only against valid, written orders served on us under Section 91 of the Code of Criminal Procedure (or its successor under the Bharatiya Nagarik Suraksha Sanhita, 2023), or under analogous statutory authority. Informal requests are refused in writing. Every disclosure is logged in an immutable register. We publish a transparency report twice a year.

10. Children

The Platform is for adults. We do not knowingly collect data from children under 18. If you believe we have inadvertently collected data from a child, write to voicezenz@gmail.com and we will delete it.

11. Changes to this Policy

We may update this Policy. Material changes will be announced on the homepage and by email to registered users.

12. Contact & Grievance Officer