Privacy Policy

We collect as little as we need, store it responsibly, and give you full control over it. Here is exactly what that means.

Last updated: August 2026. This policy covers IndianCivics at indiancivics.org.

What data we collect and why

When you sign in

We use Google OAuth via Supabase for authentication. When you sign in, we receive your name, email address, and profile photo URL from Google. We store these in our database to:

  • Identify your account across sessions
  • Display your name on your public pledge certificate (if you choose to pledge)

We do not store your Google password. We do not access your Google contacts, Drive, or any other Google data.

When you take a pledge

When you sign the Civic Pledge, we store:

  • The three commitments you selected
  • The city you entered
  • The display name you typed (may differ from your Google name)
  • The date and time of signing

Your pledge is public by default — it can be viewed by anyone at /pledge/[your-pledge-id]. This is intentional: the social visibility of your commitment is what gives it meaning. If you want your pledge removed, see the "Your rights" section below.

Hosting, security, and operational data

We use Cloudflare to host, deliver, and protect IndianCivics. When you visit the site, Cloudflare may process technical request information such as your IP address, browser and device information, requested URL, and security signals. This information is used to deliver the site, prevent abuse, and diagnose operational problems.

We do not currently use advertising analytics, tracking pixels, or a third-party application error-tracking service. We do not maintain a separate application analytics or error-tracking database.

What we do NOT collect

  • We do not use advertising cookies or tracking pixels.
  • We do not sell your personal data.
  • We disclose personal data only to the service providers identified in this policy when necessary to operate IndianCivics.
  • We do not collect your phone number.
  • We do not build behavioural profiles.

Where your data is stored

Your account and pledge data is stored in Supabase, a managed authentication and PostgreSQL database service hosted in the Singapore AWS region (ap-southeast-1). Supabase processes your Google profile information to authenticate you and stores the account and pledge information described above.

Cloudflare processes the technical request information described above to host and protect the site. We do not currently send your Google profile information to an email delivery service or a third-party error-tracking service.

How long we keep your data

  • Account data (name, email, avatar): retained while your account is active.
  • Pledge data: retained indefinitely, as the Living Archive is meant to be a durable public record. Individual pledges can be deleted on request.
  • Cloudflare operational and security data: retained for the limited periods provided by our current Cloudflare account settings and Cloudflare's applicable service terms.

If you delete your account, your name and email are removed from our database within 7 days. Your pledge entry will be anonymised (display name replaced with "Anonymous") rather than deleted, to preserve the integrity of the archive count.

Your rights under the DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Erase your personal data (subject to the note on pledge anonymisation above)
  • Withdraw consent at any time (this will result in account deletion)
  • Nominate a person to exercise these rights on your behalf

To exercise any of these rights, email grievance@indiancivics.org with the subject line "DPDP Request". We will respond within 72 hours and complete the action within 30 days.

Grievance officer

Grievance Officer: IndianCivics
Contact: grievance@indiancivics.org
Response time: 72 hours acknowledgement; 30 days resolution

If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India once it is constituted under the DPDP Act.

Changes to this policy

We will post material changes to this page and update the "Last updated" date at the top.

This policy is written to be readable, not to bury you in legalese. If something is unclear, ask us — hello@indiancivics.org.