Privacy Policy

1. Overview

Reality of World (“we”, “us”, “our”) operates the civic polling platform at https://poll.realityofworld.org. This Privacy Policy explains what personal data we collect, why we collect it, and how it is used and protected. We are committed to complying with India's Digital Personal Data Protection Act, 2023 (DPDPA) and other applicable privacy laws.

2. Data We Collect

• Account data — email address, username, hashed password (email sign-up), or OAuth provider identifier (Google, X/Twitter, Microsoft).
• Location data — Indian PIN code and state, provided by you at registration. This is used solely to determine which polls are relevant to your region.
• Activity data — votes you cast, comments you post, and timestamps of those actions.
• Device signals — browser fingerprint (collected via an open-source library for fraud prevention only; not stored permanently) and IP address (used transiently for anti-abuse checks).

3. How We Use Your Data

• To create and authenticate your account.
• To personalise which polls you see — national polls are shown to everyone; state and PIN-code polls are shown only to users in the matching region.
• To display your comments and vote counts within the Platform.
• To detect and prevent fraudulent voting, spam, or abuse of the Platform.
• To send transactional emails (e.g. email confirmation on sign-up).

We do not use your data for targeted advertising and we do not sell your data to any third party.

4. Data Processors and Third Parties

• Supabase — authentication, real-time subscriptions, and file storage. Data is stored on Supabase-managed infrastructure.
• Vercel — hosting and serverless compute.
• Cloudflare Turnstile — bot detection on sign-up forms. No personal data is shared beyond what is necessary for the challenge.
• Resend (optional) — transactional email delivery.
• India Post (postal API) — used to look up post office names for a given PIN code during registration. No account data is transmitted.

All third-party processors are engaged under data processing agreements that restrict their use of your data to the purposes described above.

5. Location Data

Your PIN code and state are the only location data we store. We do not collect GPS coordinates or precise geolocation. You may update your location once every six months from your profile settings.

6. Data Retention

We retain your account data for as long as your account is active. If you request account deletion, your personal data will be removed within 30 days, except where we are required to retain it for legal or fraud-prevention purposes. Anonymised vote counts may be retained indefinitely as aggregate statistics.

7. Your Rights (DPDPA 2023)

Under the Digital Personal Data Protection Act, 2023, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request erasure of your personal data.
• Withdraw consent for processing where consent is the legal basis.
• Nominate a person to exercise your rights in the event of your death or incapacity.

To exercise any of these rights, contact us through the Platform. We will respond within the timeframe required by applicable law.

8. Cookies and Local Storage

We use cookies and browser local storage solely for authentication session management (via Supabase Auth). We do not use tracking or advertising cookies.

9. Children's Privacy

The Platform is not directed at children under the age of 13. If we become aware that we have collected personal data from a child under 13, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via a notice on the Platform. The “Last updated” date at the top reflects the most recent revision.

11. Contact

For privacy-related enquiries or to exercise your rights, please contact us via the Platform. You can also review our Terms of Service.