1. What we collect

We collect the minimum necessary to run the service.

• Your work email address — collected at sign-up for identity verification. Encrypted with AWS KMS before storage. Never shown to other members.
• Your employer's name — derived from your email domain (for example, if you register with an @accenture.com address, "Accenture" appears as a label next to your anonymous posts). This is the only professional identifier visible to other members.
• Verification codes — one-time passcodes sent to your email, valid for 10 minutes. The code itself is not retained. A pseudonymised record of verification attempts is kept for security purposes.
• Content you create — posts, comments, direct messages, and votes. These are associated with an anonymous member ID, not your email address.
• Push notification token and installation ID — used to deliver notifications to your device. Not used for advertising and not shared with third parties beyond the push delivery services listed in §5.
• Rate-limiting fingerprint — a one-way cryptographic hash (HMAC) of your IP address, used to detect and prevent abuse. Your IP address is not stored in plaintext and cannot be recovered from the hash.

We do not collect your name, phone number, precise location, or any government-issued identifier. We do not use any advertising SDK or third-party analytics SDK.

2. Privacy by design

Your identity and your activity are stored in two separate databases. Linking them requires two authorised persons acting simultaneously with separate cryptographic keys — neither can act alone. Your email address is encrypted at rest and is never visible to other members or derivable from anything on the platform.

3. How we use your data

• To verify your identity and send authentication codes
• To operate the community platform and deliver in-app notifications
• To detect and remove spam, abuse, and prohibited content
• To review reported content, including direct messages, when a complaint is submitted
• To enforce these terms and comply with applicable law

We do not sell your data. We do not use your data for advertising. We do not profile you for commercial purposes.

4. When we disclose your data

We do not share your personal data with third parties except in the following circumstances.

Lawful orders. If we receive a court order, government directive, or other legally binding demand from a competent Indian authority, we may be required to disclose information. Linking your email address to your community activity requires simultaneous action by two authorised persons using separate cryptographic keys — we cannot produce this link unilaterally. Where permitted by law, we will notify you of such a disclosure after the fact.

Threat to life. Where we have reasonable grounds to believe there is an immediate credible threat to the life or physical safety of a person, we may disclose relevant information to law enforcement without a prior court order.

Data processors. We share limited data with the third-party services listed in §5 only to the extent necessary to operate the platform. These processors do not receive your email address except AWS SES, which is used solely to deliver authentication emails.

We do not sell data and do not share data for advertising, regardless of the recipient or purpose.

5. Data processors

We use Supabase (database), AWS SES (email delivery), AWS KMS (encryption), Cloudflare (bot detection), Apple APNs and Google FCM (push notifications), and Expo EAS (app distribution) to operate the platform. Infrastructure is hosted in India where possible. Push notification providers are based in the United States. All processors operate under data processing agreements.

6. Data retention

Account deletion. When you delete your account, the deletion is immediate. Before erasure proceeds, a full export of your data is prepared and stored securely. Your email address and identity records are erased as part of the deletion transaction. Deletion is permanent and irreversible.

Posted content. Your posts and comments are de-identified at the moment of deletion — the link between your anonymous member ID and the content is severed. The content itself may remain visible in communities for up to 6 months, after which it is permanently removed. This window allows community discussions to remain coherent while your identity is already gone.

Compliance archive. A minimal compliance record — containing a one-way cryptographic hash of your email address and your registration and deletion dates — is retained for 180 days after account deletion, as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. This hash cannot be reversed to recover your email address and cannot be used to contact you. It is destroyed automatically after 180 days.

Legal holds. If your account is subject to a legal hold at the time you request deletion, erasure is deferred until the hold is released. You will be informed that a hold exists.

You can export all your data before deleting your account using the account export feature in the app settings.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 (DPDPA) and applicable law, you have the right to:

• Access — request a summary of the personal data we hold about you
• Correct — request correction of inaccurate personal data by writing to privacy@thebengaluru.app
• Erase — delete your account and all associated personal data (via account settings in the app)
• Export — receive your data in a portable format (via account settings in the app)
• Withdraw consent — at any time; withdrawal results in account closure
• Nominate a representative — register a nominee to exercise your rights on your behalf in the event of your death or incapacity (write to us at privacy@thebengaluru.app to register)
• Raise a grievance — with our Grievance Officer (§11) or with the Data Protection Board of India

Most rights can be exercised directly in the app. For anything else, write to privacy@thebengaluru.app.

8. Data breach notification

In the event of a personal data breach that is likely to result in risk to your rights or interests, we will notify affected users without undue delay. We will report the breach to the Data Protection Board of India within 72 hours of becoming aware of it, as required by the DPDPA.

Our notification will describe the nature of the breach, the categories of data affected, the likely consequences, and the steps we have taken or propose to take in response.

9. Children's privacy

The Bengaluru App is not intended for anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please write to us and we will remove it promptly.

10. Changes to this policy

We will notify you of material changes through the app or by email before they take effect. Continued use of the app after a change takes effect constitutes acceptance of the revised policy.

11. Contact and grievance officer

For privacy-related questions or to exercise your rights:

privacy@thebengaluru.app

Grievance Officer (DPDPA §8 · IT Rules 2021 Rule 3)

Email: grievance@thebengaluru.app
Address: The Bengaluru App, Bengaluru, Karnataka, India

We acknowledge grievance submissions within 24 hours and resolve them within 15 calendar days, as required by the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

If your grievance is not resolved to your satisfaction, you may write to the Data Protection Board of India.

1. Acceptance

By creating an account or using The Bengaluru App ("TBA", "the app", "we"), you agree to these terms and to our Privacy Policy. If you do not agree, do not use the app.

2. Eligibility

To use TBA, you must:

• Be at least 18 years old
• Have a valid work email address from a recognised employer
• Not have been previously permanently banned from the platform

Your work email is used to verify your identity and to determine which employer's community forum you may access. Your employer's name — derived from your email domain — is displayed as a label next to your anonymous posts. Your email address is never shown to other members.

3. Anonymous posting

TBA allows you to post under an anonymous identity. Your email address is never visible to other members. However, anonymous does not mean unaccountable — your identity is verified at sign-up, and we act on credible reports of abuse.

You may not use anonymous posting to harass, threaten, defame, or harm others. Anonymous posting is a feature for honest expression, not a shield for harmful behaviour.

Direct messages that are reported to our trust and safety team may be reviewed by a human moderator for the sole purpose of investigating the complaint. We access only what is necessary to make a moderation decision.

4. Prohibited conduct

You must not use TBA to:

• Harass, threaten, stalk, or intimidate any person
• Attempt to identify or reveal another member's real identity (doxxing)
• Post confidential, proprietary, or trade-secret information belonging to your employer or any other organisation
• Post spam, coordinated inauthentic behaviour, or materially misleading content
• Post content that threatens or undermines the sovereignty, integrity, or security of India
• Post content that promotes or incites hatred, discrimination, or violence on the basis of religion, race, caste, sex, place of birth, or disability
• Post any form of child sexual abuse material or content that sexually exploits minors
• Post content that infringes copyright, trademark, or other intellectual property rights
• Impersonate any person, organisation, employer, or public figure
• Scrape, crawl, or automate access to the platform without written permission
• Circumvent any technical measure designed to protect members or the platform

Violations may result in content removal, temporary suspension, or permanent ban, at our discretion.

5. Your content

You own the content you post. By posting it, you grant TBA a non-exclusive, royalty-free licence to display, store, and distribute it within the platform for the purpose of operating the service. This licence ends when you delete the content or your account.

You are responsible for the content you post. Do not post content you do not have the right to share.

We may remove content that violates these terms or applicable Indian law, with or without prior notice.

6. Safe harbour (IT Act §79)

TBA is an intermediary under §79 of the Information Technology Act, 2000. We do not initiate, select recipients for, or modify the content that users post on the platform. We are not the author, publisher, or endorser of user-generated content.

We observe due diligence as required by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. In particular:

• We publish and enforce terms of service that prohibit unlawful content
• We acknowledge grievance submissions within 24 hours and resolve them within 15 calendar days
• We act on court orders and directions from competent government authorities
• Content removed pursuant to a valid legal order is retained as required by applicable law

7. Termination

You may delete your account at any time from the app's account settings. Before deletion is finalised, a full export of your data is prepared. Deletion is permanent.

We may suspend or terminate your access for violations of these terms. Serious or repeated violations result in a permanent ban. A banned email domain may be blocked from future re-registration.

8. Limitation of liability

TBA is provided as-is. To the fullest extent permitted by Indian law, we are not liable for any indirect, incidental, special, or consequential damages arising from your use of or inability to use the app. We do not guarantee continuous or error-free availability of the service.

9. Governing law

These terms are governed by the laws of India. Any dispute arising from or relating to these terms or the use of the app shall be subject to the exclusive jurisdiction of the courts in Bengaluru, Karnataka.

10. Contact

For questions about these terms:

hello@thebengaluru.app

Bengaluru, Karnataka, India