Privacy

Pujo Parikrama (“we”) is a free Durga Puja companion. This policy explains what the app collects, why, who else handles it, how long it's kept and what you can do about it. It is written to meet India's Digital Personal Data Protection Act, 2023, and the main principles of the GDPR (EU/UK), CCPA/CPRA (California), LGPD (Brazil) and PIPEDA (Canada).

The short version

• No ads, no analytics, no tracking cookies, and we never sell or rent personal data.
• You can browse everything without an account. The app never asks for your location on its own: only when you tap Check in, Use my location or the Bheer-o-meter. Once you have allowed it, it also keeps your city up to date while the app is open.
• You can download everything we hold about you, or delete your account, from Profile → Your data.

What we collect and why

Without signing in

• Guest session. When you first follow a pandal, report a queue or turn on the Bheer-o-meter, the app creates an anonymous guest account: a random id with no name or email. It keeps those choices on your phone and lets you keep them if you sign in later.
• Approximate city. To suggest your city, our host reads a rough location from your IP address for that one request. It is not stored or logged by us.
• Your city from your location. If you have allowed location, your phone matches it to a city itself. Only when you are outside the cities we know does it send a point rounded to about 1 km to our server, which asks OpenStreetMap's Nominatim for the town's name. Neither we nor Nominatim get your exact position, and we keep only the town name, on your phone.
• Settings on your phone. Language, theme, city, your pandal plan and similar choices stay in your browser (see the cookie notice).

If you sign in

• Account: your email address (email sign-in), or the email and name Google shares if you choose Continue with Google. Used to sign you in and keep your passport.
• Profile: display name, username, para (neighbourhood) and avatar, all chosen by you. These are public (see below).
• Check-ins: your GPS position and its accuracy at the moment you tap Check in, the pandal, the distance and the time. Used to confirm you were at the pandal (within its check-in radius) and to stop fake check-ins. Location is never tracked in the background.
• Stamps and photos: stamp images you make, and photos of the protima you upload. Before a photo leaves your phone it is redrawn, which removes its EXIF and other metadata (including the location it was taken at, the time and the camera). Uploaded photos are reviewed by a moderator; if approved they may appear on the pandal's page, credited with your display name.
• Activity: votes, quiz answers, game scores, XP and badges, who and which pandals you follow, queue-wait reports, timings you propose and organiser claims. Used to run those features, the leaderboard and the results.
• Alerts (optional): if you turn on ritual alerts, your browser's push address, your alert preferences and a log of alerts sent (so you don't get the same one twice).

Bheer-o-meter (optional, off by default)

If you turn it on in Profile → Settings, then while the app is open during pandal-hopping hours it sends your approximate position about every four minutes, with a random device token that changes and is never linked to your account. Only “a device was near pandal X in this five-minute window” is stored, not the coordinates, and it is deleted after 24 hours. It never asks for location permission by itself. Turn it off at any time in the same place.

Technical data

Like any website, our host and database receive your IP address and browser details with each request, kept in short-lived logs for security and troubleshooting. If a page crashes, the app sends an error report (the error message, the page and your browser type) so we can fix it.

Links to other sites

The stay-search links on “Where to stay” take you to other sites. Some stay links are referral links that tell the site we sent you, so we may earn a commission if you book; we send them nothing about you, and their own privacy policy applies once you're there. Sharing your passport card uses your phone's share sheet: the image is made on your device and goes only where you send it.

What is public

Your display name, username, para, avatar, level, badges and stamp count appear on the leaderboard and on your public profile page. When you check in, the live ticker on the home page shows your first name and the pandal for up to 24 hours. Stamps are private unless you share a stamp link. Pandals you submit and timings you propose are shown without your name.

Legal basis

We process data with your consent (signing in, location for check-ins, the Bheer-o-meter, alerts, photos) and, where the law allows, to provide the features you asked for and to keep the service secure and free of abuse. You can withdraw consent at any time: turn features off in Profile, revoke location or notification permission in your browser, or delete your account. Withdrawing consent doesn't affect what was done before.

Who processes your data

We share data only with the services that run the app, under their own data-protection terms. None of them may use it for advertising.

Traffic conditions near pandals come from TomTom, queried by our server with pandal locations only; no visitor data is sent. We may disclose data if required by Indian law or a valid legal order.

Where it's stored

Our database and servers are in Mumbai, India. Some of the services above (map tiles, YouTube, push delivery, Google sign-in) may process requests outside India under their own safeguards.

How long we keep it

• Account, profile, passport, stamps, photos and activity: until you delete your account.
• Bheer-o-meter presence and the live check-in ticker: 24 hours.
• Queue-wait reports: 3 days. Alert log: 30 days.
• Server and error logs: kept briefly by our host for troubleshooting, then discarded.

Your rights

Wherever you live, you can:

• Access and take your data: Profile → Your data → Download gives you a JSON file of everything tied to your account.
• Correct it: edit your name, username, para and avatar in Profile.
• Erase it: Profile → Your data → Delete account removes your account, passport, stamps, photos and activity permanently. Pandal pictures that came from your photos are removed too.
• Withdraw consent or object to any optional processing, as described above.
• Nominate someone to exercise these rights if you can't, and complain to us or to your data protection authority (in India, the Data Protection Board of India).

For anything the app can't do for you, write to puja.parikrama.support@gmail.com. We reply within 7 days and complete requests within 30 days. We will not treat you differently for using your rights.

Children

The app is meant for everyone celebrating Puja, but if you are under 18, please use it with a parent's or guardian's permission and let them help with signing in. We don't knowingly profile children or show them targeted content. If you think a child gave us personal data without consent, write to us and we will delete it.

Security

All traffic is encrypted (HTTPS). Database rules let each person read and change only their own private data, service keys stay on the server, and check-ins are verified on the server. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Changes

If this policy changes in a way that matters, we'll update the date above and say so in the app before the change applies.

Contact and grievances

Email the Pujo Parikrama team at puja.parikrama.support@gmail.com for questions, requests or complaints (this address also serves as our grievance contact).