Privacy notice
Under the Digital Personal Data Protection Act, 2023. Version [version]. You can ask us for this notice in English or in any of the 22 languages of the Eighth Schedule to the Constitution.
Who is responsible
[Legal entity name], [registered address], is the Data Fiduciary for Dua Parivaar.
Children's data, protected first
- We keep anything about a child only with a parent's or legal guardian's verifiable consent, after Dua has checked that parent's identity.
- We never track children, never monitor their behaviour, never show them or you advertising, and never build profiles to sell or target.
- Parivaar does not diagnose or label children. Health information is entered by parents, is visible only to parents, and is encrypted where it is written in words.
What we keep, and why
This list is generated from the same register our database uses, so it always matches what we actually store.
Loading…
We also keep security records: sign-in codes (24 hours), signed-in devices, a record of who read or changed a child's information (one year), and records of consent (for as long as your account exists, and one year after it is erased), as Indian law requires.
Safety
Parivaar runs fixed safety rules over text written in it, to notice when a child or an adult may be in danger (for example self-harm, abuse, threats or online exploitation). The rules are fixed patterns, not AI, and they never score or profile anyone. When they match, the writer is shown free 24-hour helplines, and a trained person at Dua is told so they can decide what to do. Nothing is reported by software; a person decides, and the law (such as the Protection of Children from Sexual Offences Act) may require Dua to report. The record of a match holds which rules matched and what was decided, never the text, and is kept three years.
Who processes it for us
- Supabase: database and file storage, in Mumbai, India.
- Render: runs our servers in Singapore. Your information passes through it while being processed and is not stored there.
- Vercel: delivers the app's pages.
- Resend: sends our emails (sign-in codes and notices).
- Your phone's browser company (Apple, Google, Mozilla or Microsoft) delivers phone notifications, encrypted so they cannot read them. Notifications never contain a child's name or words.
Your rights, and how to use them
- See and download your data: Family › Privacy › Download.
- Correct it: edit it directly, or write to us.
- Withdraw consent: Family › Privacy › Withdraw my consent. It is as easy as giving it.
- Erase it: Family › Privacy › Erase. Everything is hidden at once and erased after a short grace period.
- Name a nominee to act for you if you die or cannot act: Family › Our story › Your nominee.
- Complain: write to our Grievance Officer, [name], at [email]. We aim to reply within [30] days. If you are not satisfied, you may complain to the Data Protection Board of India.
At 18
When a child turns 18, their story becomes theirs. Their own consent then replaces the parent's for anything new.
Security
Children's written words, letters and portraits are encrypted with keys kept outside the database. Every read and change of a child's information is recorded. Photos lose their location and camera details before anyone can see them.