2. Data We Collect & Process

Under the principle of Purpose Limitation and Data Minimization, we collect only data strictly necessary for festival coordination:

• Account Identity: Display name and verified mobile phone number (authenticated securely via Firebase Phone OTP). Avatar photo URL (HTTPS only, if provided).
• Squad & Group Data: Randomly generated squad IDs, membership join timestamps, and squad owner indicators.
• Live Ephemeral Location (Strictly Opt-In): Precise GPS coordinates (latitude, longitude, accuracy, timestamp) collected only while active sharing is switched ON by you and the web page is open.
• Community Feedback: Voluntary pandal ratings and Sharad Samman votes.

3. Consent Architecture & Children's Data

Consent under DPDP Act Section 6 must be free, specific, informed, unconditional, and unambiguous:

• Separate Consents: Acceptance of general Terms of Service and Privacy Policy at account creation does NOT grant location permission. Real-time location sharing requires a distinct, affirmative in-app consent step.
• Children's Privacy Protection: PujoPulse is intended for individuals aged 18 and older. Real-time location sharing and squad creation features are disabled for minors under 18 years of age. Users confirm adulthood during account registration.
• Consent Records: Proof of affirmative consent is logged in the user's secure account record (users/{uid}.consent) with server timestamps and policy version.

4. Data Retention & Ephemeral Purging

We enforce automated deletion mechanisms to prevent unnecessary retention:

5. Data Processors & Sovereign Localization

We partner with trusted technical data processors under strict Data Processing Agreements:

• Google Cloud Platform / Firebase: Provides Cloud Firestore database, Cloud Functions v2 serverless compute, and Firebase Authentication. Primary database and computing infrastructure are localized in region asia-south1 (Mumbai, India).
• Mapbox Inc.: Provides vector map tiles and rendering. Receives transient map viewport coordinates and IP addresses for tile CDN delivery; never receives user account identities or personal phone numbers.
• Firebase Hosting CDN: Delivers statically compiled assets with Content Security Policy (CSP) enforcement.

6. Your Rights as a Data Principal

Under Chapter III of the DPDP Act, 2023, you have the following enforceable statutory rights:

7. Security Safeguards & Breach Protocol

We implement defense-in-depth safeguards including Firebase App Check attestation, strict Cloud Firestore Security Rules, scrypt key derivation for passwords, and rate limiting. In the unlikely event of a personal data breach:

• We notify the Data Protection Board of India and affected Data Principals in accordance with statutory guidelines (to be confirmed by a qualified lawyer).
• Cyber security incidents are reported to CERT-In (Indian Computer Emergency Response Team) pursuant to Section 70B of the Information Technology Act within mandatory timeframes (to be confirmed by a qualified lawyer).

8. Grievance Redressal Officer Contact

In compliance with the DPDP Act, 2023, you may address inquiries, complaints, or rights requests to our Data Protection Grievance Officer:

2. Acceptable Use & Community Conduct

PujoPulse is created to celebrate Durga Puja with devotion, safety, and camaraderie. You agree not to:

• Submit fraudulent, abusive, or malicious crowd reports, pandal ratings, or Sharad Samman votes.
• Attempt to reverse-engineer, decompile, scrape, or perform denial-of-service attacks against PujoPulse APIs or servers.
• Impersonate any individual, organization, club authority, or law enforcement agency.

3. Strict Anti-Stalking & Anti-Harassment Policy

We maintain an absolute zero-tolerance policy towards non-consensual location tracking and harassment:

• No Non-Consensual Tracking: You shall never attempt to obtain, share, or broadcast another individual's squad code or location without their explicit knowledge and affirmative consent.
• No GPS Spoofing: Falsifying GPS coordinates or broadcasting artificial locations to deceive squad members is strictly prohibited.
• Immediate Revocation: Any account identified as engaging in stalking, harassment, or unauthorized tracking will be terminated immediately, and logs may be provided to law enforcement upon valid judicial order.

4. Squad Leader & Member Responsibilities

Squad creators (leaders) are responsible for managing the dissemination of their 10-character squad code. Never post private squad codes or join links on public social media feeds. Members are encouraged to leave squads promptly once their group excursion is concluded.

5. Crowd Telemetry & Routing Disclaimer

PujoPulse provides community-contributed crowd estimates, queue waiting times, and recommended pandal circuits for informational convenience only:

6. Personal Safety in Crowds

Users are solely responsible for their personal physical safety, health precautions, hydration, companion supervision, and custody of personal belongings during Durga Puja celebrations. PujoPulse disclaims liability for personal injury, lost articles, or transit delays encountered during festival visits.

7. Governing Law & Dispute Resolution

These terms are governed by the laws of the Republic of India. Any legal dispute or proceeding arising out of or related to PujoPulse shall be subject to the jurisdiction of the competent courts located in Agartala, West Tripura, India (to be confirmed by a qualified lawyer).