DRAFT — pending legal review. Text in [brackets] must be completed before public launch.

Privacy Policy

Last updated: [DATE] · Applies to riseitsocial.com and the RiseItSocial Android and iOS apps.

RiseItSocial ("we", "us") is a platform for raising social issues, sharing ideas and talking with public representatives. It is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], India. This policy explains what we collect, why, and the choices you have. We do not sell your personal data.

1. What we collect

• Account: name, username, email address and password (stored only as a one-way hash), or — if you sign in with Google — your Google account ID instead of a password. We send a link to confirm your email address.
• Profile (optional): photo, cover image, bio, website, state, district/constituency and ward.
• What you post: posts, replies, photos, short videos, issues (including the location you choose to pin and evidence you attach), ideas, campaign and community content, reactions, supports, follows and bookmarks. Most of this is public by design.
• Anonymous issues: if you raise an issue anonymously, your name is hidden from the public, but moderators can see who raised it so we can act on abuse. Public map pins are rounded to roughly 100 metres.
• Messages: chats between you and official Pages are visible to you and that Page's team.
• Live sessions: camera and microphone are used only while you are on stage in a live session or call. Audio and video travel directly between participants (or through a relay server when networks require it) and are not recorded by us.
• Device and usage: a push-notification token if you allow notifications, login sessions, and technical logs (such as IP address, kept briefly for security and rate-limiting).
• Ads: to bill local advertisers fairly we record that your account saw or tapped an ad, at most once per ad per day. These records are deleted after 30 days.
• Payments (Pages and advertisers only): invoice and payment references. We do not store card or bank details.
• Reports and moderation: reports you file, appeals, and moderation decisions about your content.

2. How we use it

• To run the service: show your posts, deliver notifications, route issues and ideas to the officials you choose, and keep you logged in.
• Safety: detect spam and abuse, review reports, and comply with lawful orders.
• Local relevance: your profile's state/district decides which local issues and local ads you see. We never use your posts, reactions or political views to target ads.
• Account emails such as password-reset links. We do not send marketing email without your consent.

3. Who we share it with

• The public: anything you post publicly can be seen, shared and quoted by anyone.
• Officials you address: when you send an issue or idea to a representative, they receive it and can reply publicly.
• Service providers who process data for us under contract: hosting in India ([HOSTING PROVIDER], Mumbai), backups and file storage (Cloudflare R2, which may store data outside India), email delivery (Resend), push notifications (Google Firebase Cloud Messaging), Google Analytics (pages visited, device and browser type and approximate region, to understand how the service is used; Google signals and ad personalisation are turned off), and — only if ads are enabled in the app — Google AdMob, which receives device information to show non-personalised ads.
• Sign in with Google: if you choose it, Google tells us your name, email address and Google account ID so we can create or find your account. We do not receive your Google password or anything else from your Google account.
• Authorities: when required by Indian law, such as a court order or a lawful government request.

4. How long we keep it

We keep your data while your account is active. You can delete your account at any time in Settings → Delete my account. Your account, posts, reactions, follows and messages are then deleted, and uploaded files are removed. Issues and campaigns you started stay public (their history matters to other citizens) but are shown as "Deleted user" and anonymous. [LAWYER: confirm retention required under IT Rules 2021 Rule 3(1)(h) (180 days) and DPDP Rules, and update this section.] Backups are overwritten within [30] days.

5. Your rights

You can access and correct your profile in Settings, delete your account, withdraw consent for notifications in your phone settings, and contact us with any request about your data. Under the Digital Personal Data Protection Act, 2023 you may also nominate someone to exercise your rights and complain to the Data Protection Board of India.

6. Age

RiseItSocial is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.

7. Security

Data is sent over encrypted connections (HTTPS), passwords are hashed, and access to personal data is limited to staff who need it. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

8. Contact and grievances

Grievance Officer: [NAME], [EMAIL], [PHONE], [POSTAL ADDRESS]. We acknowledge complaints within 24 hours and resolve them within 15 days. See also our Terms of Service.

We may update this policy. Significant changes will be announced in the app before they take effect.