Privacy Policy

1. Introduction

VR-Track and the MLA File Tracking System (collectively, the "Service") are provided by the office of Shree Vishwajit Rane ("we", "our", or "us") to track files, grievances, and works submitted across the Valpoi Constituency. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have. By using the Service you agree to the collection and use of information in accordance with this Policy.

2. Information We Collect

We collect only the information needed to operate the Service. The categories below align with the disclosures made in the Apple App Store privacy nutrition label and the Google Play Data Safety form.

• Identity & contact data: name, username, email address, mobile number, role, department, and constituency assignment.
• Authentication data: securely hashed passwords, session identifiers, login timestamps, IP address, and device/user-agent information used to maintain a secure session and prevent unauthorised access.
• File and activity data: records of files, grievances, movements, remarks, and status changes that you create, view, or act upon within the Service.
• Device data: device model, operating system version, app version, language, time zone, push-notification token (FCM/APNs), and diagnostic / crash data.
• Usage data: in-app interactions, feature usage, and error logs used solely for improving stability and performance.
• Permissions-based data (only with your consent):
  • Notifications: to deliver alerts about file movements and announcements.
  • Camera / Photos: only when you choose to attach a document or photograph to a file. Images are not accessed in the background.
  • Storage: to read or save attachments associated with a file.

We do not collect precise location, contacts, microphone, health, financial, or advertising identifiers, and we do not use the Service for advertising or profiling.

3. How We Use Your Information

• To authenticate users and enforce role-based access.
• To enable creation, tracking, and movement of constituency files and grievances between authorised personnel.
• To route grievances to the appropriate department and notify the responsible officer.
• To send push notifications about file updates, announcements, and security alerts.
• To maintain audit trails of file activity for accountability and compliance.
• To detect, prevent, and investigate fraud, abuse, or unauthorised access.
• To diagnose crashes, monitor performance, and improve the Service.

4. Legal Basis for Processing

We process personal information on the basis of (a) your consent, given when you create an account or enable a device permission; (b) the performance of constituency duties carried out in the public interest; and (c) our legitimate interests in keeping the Service secure and operational.

5. Third-Party Services

We use a limited set of trusted third-party services to operate the Service. These providers process data only on our instructions:

• Firebase Cloud Messaging (Google LLC) — delivery of push notifications.
• Firebase Crashlytics / Analytics (Google LLC) — crash diagnostics and aggregated usage metrics.
• MongoDB Atlas — encrypted database hosting.
• Upstash Redis — rate limiting and session state.
• Google reCAPTCHA — bot and abuse prevention on web sign-in.
• SMTP email provider — transactional email such as account or security notifications.

We do not sell or rent your personal information to any third party, and we do not share data with advertisers or data brokers.

6. Data Sharing and Disclosure

Data is accessible only to authorised personnel of the MLA's office — administrators, MLAs, personal assistants, in-charge officers, and panchayat members — as required for the file-tracking workflow. We may disclose information to government authorities or law-enforcement agencies where required by law, court order, or valid legal process, or to protect the rights, safety, or property of users or the public.

7. Data Security

We implement industry-standard security measures including RSA-encrypted password transmission, bcrypt password hashing, single-active-session enforcement, IP and user-agent binding, rate limiting, account lockouts on repeated failed attempts, encrypted data in transit (HTTPS/TLS), and encryption at rest for stored databases. While we strive to use commercially acceptable means to protect your information, no method of transmission or storage is 100% secure.

8. Push Notifications

With your permission, we send push notifications about file movements, grievance updates, and official announcements. You can disable notifications at any time from your device settings (iOS: Settings → Notifications → VR-Track; Android: Settings → Apps → VR-Track → Notifications). Disabling notifications does not affect your ability to use the Service.

9. Data Retention

We retain your account information for as long as your account remains active and for a reasonable period thereafter to comply with legal obligations, resolve disputes, and enforce our agreements. File and activity logs are retained in accordance with government record-keeping requirements. Diagnostic and crash data are typically retained for up to 90 days.

10. Your Rights and Choices

You have the right to:

• Access and review the personal information we hold about you.
• Request correction of inaccurate or incomplete information through the system administrator.
• Withdraw consent for optional permissions such as notifications, camera, or storage at any time through your device settings.
• Object to or restrict certain processing, subject to legal and administrative obligations.

To exercise any of these rights, contact us using the details in Section 14. We will respond within a reasonable timeframe and in any event within the period required by applicable law.

11. Account Provisioning & Deletion

Accounts on the Service are not self-created. They are provisioned, assigned, and managed solely by the system administrator on behalf of the office of Shree Vishwajit Rane. As a result, individual users cannot self-register and cannot directly request deletion of their account through the Service.

Account creation, modification, suspension, and deletion are carried out exclusively by the administrator in line with the role assignments and administrative requirements of the constituency. If you wish to have your account deactivated or removed, you must submit a written request to the administrator or to the office of Shree Vishwajit Rane (see Section 14). Such requests are evaluated against operational and record-keeping requirements and may be approved or declined at the administrator's discretion.

Where deletion is approved, the administrator will remove your account and associated personal data within a reasonable timeframe, except information we are required to retain by law or for legitimate audit and record-keeping purposes (such as file-activity logs, which may be retained in anonymised form).

12. Children's Privacy

The Service is intended for use by authorised government personnel only and is not directed to children under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without verified parental consent, we will delete that information promptly.

13. International Data Transfers

Data is primarily stored and processed within India. Some third-party providers (such as Google Firebase) may process data on servers located outside India under appropriate contractual safeguards. By using the Service, you consent to such transfers where necessary for the operation of the Service.

14. Contact Us

For questions, requests, or concerns about this Privacy Policy or your personal information, contact:

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified through the App or by email, and the "Last updated" date above will be revised. Continued use of the Service after such changes constitutes your acknowledgement of the revised Policy.