Privacy policy

1. What we collect and why

• Account: name, email, a securely hashed password (never readable by us), whether you signed up with email or Google, and when you accepted these terms. To run your account and record your consent.
• Google sign-in: Google shares your name, email address and an account ID. We don't receive your Google password or anything else from your Google account.
• City and area: when you allow location or pick a place, your city and a point rounded to about 1 km. To show works near you and know which cities use the site. Your exact live location is never stored.
• How you found us: the campaign link, website or friend's invite that brought you, and the first page you opened. To learn which promotion works.
• Device type: phone, tablet or computer, operating system and browser. To make the site work well on what people use.
• Usage: which sections you open and on how many days, counted per day, not every click. To improve the site and see how many people come back.
• Optional answers: how you travel, your interests, what describes you, and a mobile number for WhatsApp alerts. To show what matters to you and, for business users, offer data services. You can change or remove them any time.
• Saved places, alerts, reports and feedback you create, including locations you pin. To send alerts, check reports and improve the service. Your name and email are never shown publicly.
• Business enquiries you send. To reply to you.
• Email delivery records: whether an email to you was delivered, bounced or marked as spam. To keep email working.
• Security logs: IP addresses kept briefly in server logs and memory to stop abuse (for example repeated failed sign-ins). Not linked to your profile.

2. Consent and your choices

We process your data on the basis of your consent, given when you sign up, and for legitimate uses allowed by the DPDP Act (such as keeping the service secure). The newsletter and WhatsApp alerts are separate, optional choices. You can withdraw any consent at any time in Account → My account and data, through the unsubscribe link in any newsletter, or by emailing us. Withdrawing doesn't affect processing done before.

3. Cookies and similar storage

We use only what the site needs, and no advertising or third-party tracking cookies:

• kya_session: keeps you signed in (up to 14 days). Essential.
• kya_attr: remembers how you first arrived (campaign link, referring site, invite code) until you sign up, for up to 60 days.
• kya_google: protects Google sign-in for 10 minutes while you sign in.
• Browser storage: your theme, map settings and last location, kept on your device only.

You can clear these in your browser settings at any time; you'll be signed out.

4. Who we share data with

We don't sell your data and don't share it with advertisers. We use these service providers, only for the purposes above:

• Resend: sends our emails (your email address and the message).
• Google: only if you choose Google sign-in.
• Our server host: stores the database in India.
• Map and font services (OpenFreeMap map tiles, cdnjs for the map library, Google Fonts): your browser loads files from them, so they see your IP address, as with any website.

We may disclose data if required by law, a court order or a lawful request from a government authority, or to protect people's safety.

5. Reports to the owner

The site owner receives a weekly summary report. It is password-protected and may include the names, emails and cities of new users and the details of business enquiries.

6. How long we keep data

• Account data: while your account is active. Deleting your account removes it straight away.
• Sign-ups that never confirm their email: deleted after 30 days.
• Daily usage counts: about 13 months. Email delivery records: 180 days.
• Backups: overwritten within 14 days.

7. Your rights

Under the DPDP Act you can: get a summary of your data and how it's used; correct, complete or update it; have it erased; withdraw consent; nominate someone to exercise these rights if you die or can't; and have your grievances addressed. Most of this is self-service in Account → My account and data (see, download, edit, delete). Otherwise email hello@knowyourarea.co.in. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

8. Security

Data travels over HTTPS only. Passwords are hashed with bcrypt. Access to the database is limited to the site itself, backups are private, and the weekly report is encrypted. No system is perfectly secure; if a breach affects your data we'll inform you and the Data Protection Board as the law requires.

9. Children

KnowYourArea is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has signed up, email us and we'll delete the account.

10. Changes to this policy

We'll update this page when our practices change, and tell signed-in users about significant changes. The date at the top shows the latest version.

11. Contact and grievances

Questions: hello@knowyourarea.co.in. Grievance Officer: KnowYourArea, hello@knowyourarea.co.in. We acknowledge within 24 hours and resolve within 15 days.