Privacy Policy

1. Summary

• We collect your account details (username, email), report content (photos/videos, category, description, location, timestamp) and basic technical data (device, IP, app version).
• Your precise location is collected only when you report a hazard or explicitly use location features (e.g. drop a pin, route near me).
• Public map data shows report location, category and status — never your home address, email or phone number, which we do not publish.
• You can edit your display name, delete reports you created, request account deletion, or ask us anything at Contact.

2. Data We Collect

We do not knowingly collect phone numbers, Aadhaar, or payment card details. We do not sell your personal data. Never include other people's personal information in your reports.

3. Device Permissions

• Location (GPS) — to attach a precise position to reports and to centre the map/route features. Deniable at any time in your browser/OS settings; reports can still be placed manually on the map.
• Camera & photo library — to attach evidence images/videos. Deniable; you can forego photo evidence.
• Notifications — to alert you about report status updates, rewards and announcements. Optional.
• Local storage — see the Cookie Policy.

4. How We Use Data

• Service delivery — publish reports on the hazard map, track status, route verified reports to Authorities, power rewards.
• Account management — authenticate, maintain profiles, secure accounts.
• Safety, anti-fraud & abuse prevention — detect fake reports, bots, harassment and violations of the Terms.
• Analytics & improvement — aggregate, de-identified usage statistics to improve report quality and routing.
• Legal compliance — responding to lawful requests, protecting rights and safety.
• Service communications — status updates, security alerts, announcements (you can opt out of most non-essential ones).

We do not use your personal data for behavioural advertising, and we do not profile you across third-party sites.

5. Legal Basis for Processing

• Consent — precise location, camera, notifications, non-essential cookies. Withdrawable anytime via browser settings or account deletion.
• Contract — processing needed to deliver the Service you use (account, report features).
• Legitimate interests — security, anti-fraud, aggregate analytics, alumni of the Service operated in a public-interest civic context.
• Legal obligation — retaining or disclosing data under Indian law, including the IT Act and the Digital Personal Data Protection Act, 2023 (DPDP Act).

6. Sharing & Disclosure

We share personal data only in these situations:

• With Authorities — verified reports (including reporter username and report location/timestamp) may be forwarded to the relevant municipal or government department for action.
• Publicly on the map — report location, category, description, evidence media and status. We do not publish your email, phone number or home address.
• Service providers (processors) — hosting, authentication, notifications and analytics, bound by contract. See §7.
• Legal enforcement — to law enforcement, courts or regulators when legally required, or to protect rights, property or safety, or to investigate fraud.
• Corporate events — merger, acquisition or reorganisation, with notice and the same protections continuing to apply.

We never sell personal data.

7. Third-Party Processors

• Firebase / Google Cloud — hosting, authentication (email/password), Firestore database, cloud functions and messaging. Google privacy policy applies beyond our control.
• OpenStreetMap tile providers — map basemap tiles; basemap requests may be logged by tile providers.
• Browser & OS vendors — crash and platform diagnostics.

8. Your Rights & Choices

Under the DPDP Act 2023 (India) and — where applicable — GDPR/EU-UK law and other Indian laws, you may:

• Access copies of your personal data and the categories processed.
• Correct inaccurate data (most of it is editable in your Profile).
• Erasure — request account/data deletion (subject to legal holds and applicable law).
• Withdraw consent for optional processing (location, notifications).
• Object/restrict processing or lodge a complaint with a supervisory authority (e.g. India's Data Protection Board; your local authority in your jurisdiction).
• Data portability (GDPR) — obtain a machine-readable export.
• Opt out of non-essential communications and non-essential cookies at any time.

To exercise rights, email tictactoeonline.in@gmail.com or use the Contact page. We respond within 30 days (shorter under GDPR, where applicable).

9. Children's Privacy

The Service is not directed at children under 13 (and under 18s require parental consent under applicable Indian rules). We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact us and we will delete it promptly.

10. Security

We protect your data using encryption in transit (HTTPS/TLS), restrictive database rules, least-privilege access and routine review of infrastructure. No system is 100% secure; do not send sensitive data through the app. In case of a breach, we will notify affected users and authorities as required by law.

11. International Transfers

Your data may be processed on cloud infrastructure located in India, the United States and other jurisdictions. Where EU/UK data is transferred, we rely on appropriate safeguards (e.g. Standard Contractual Clauses) offered by our processors.

12. Changes to this Policy

We may revise this Policy; material changes will be announced via in-app notice or email, and the "Last updated" date at the top will change. Continued use after changes means acceptance.

13. Contact