Privacy Policy

QRakshak is a safety-first QR platform. This policy explains what information we collect, why we collect it, who we share it with, and what rights you have under the DPDP Act 2023.

1. What we collect

• Account: email, name, phone number and PIN. We store the PIN hashed with PBKDF2 (100,000 iterations) — the plaintext PIN is never stored.
• QR and scan events: timestamp, QR reference, and approximate location only when you choose to share it during a family alert (foreground only, on your tap).
• Device: push notification token (FCM), app version, platform.

We do NOT collect: background location, your messages or contacts, microphone/audio, photos, or any advertising identifier.

2. How we use it

• To send family alerts (email, push notification, masked call).
• To run safety features and prevent abuse (rate limiting).

3. Who we share it with

We never sell your data. Only these processors (acting on our instructions) are used:

• Cloudflare — hosting (Workers + Pages)
• Railway + Supabase Mumbai — database (India data residency)
• Resend — email alerts
• TeleCMI — masked call bridging (the number is always masked)
• Google FCM — push notifications

Information is shared with law enforcement only on a valid legal request.

4. Number masking (D-004)

In the woman-safety category the phone number is never exposed directly. Both helper and owner see the provider's masked/virtual number. This masking is mandatory, not optional.

5. How long we keep it

• Audit logs: 180 days (security + compliance), then automatic deletion.
• Account deletion requests: processed within 30 days.
• Backups: daily automatic (7-day retention) + a weekly encrypted copy.

6. Your rights (DPDP Act 2023)

• Access, correct and erase your data.
• Withdraw consent.
• Grievance officer: grievance@qrakshak.com.
• Lodge a complaint with the Data Protection Board of India.

7. Children

This service is not for people under 18 years of age.

8. Security

Data is encrypted in transit with TLS, multi-tenant isolation is enforced with Row-Level Security (RLS), PINs are hashed, secrets live only in the environment (never in logs), and security-relevant events are kept in an audit trail.