Privacy Policy

MyKharsia is a community-driven city portal for Kharsia, Raigarh District, Chhattisgarh, India. When you use our Platform, we collect certain information to provide you with a personalized and functional experience.

This Privacy Policy applies to all users of kharsia.in, whether you are a visitor browsing content, a registered citizen, a reporter, or an administrator. It covers all data collected through the website, authentication system, and community features.

We operate with a privacy-first mindset: we collect the minimum data needed, store it securely, and never exploit it for commercial gain.

The following table outlines each type of data we collect, why we collect it, and whether it is required:

We do not collect sensitive personal information such as Aadhaar numbers, financial account details, biometric data, or precise GPS location.

Your data is used solely to operate and improve the MyKharsia platform. Specific uses include:

• Account Management: Creating and maintaining your user profile, managing authentication, and personalizing your experience
• Content Publication: Displaying your name alongside submitted news articles, shop listings, event posts, photos, and city feed updates
• Gamification: Tracking daily logins, calculating coin rewards, managing streaks, and awarding badges
• Notifications: Sending in-app alerts about content approvals, rejections, new community updates, and platform announcements
• Security & Moderation: Detecting and preventing abuse, spam, fake accounts, and violations of our Terms of Use
• Platform Improvement: Understanding usage patterns (in aggregate, non-personal form) to improve features and performance
• Legal Compliance: Meeting obligations under applicable Indian law, including responses to lawful government requests

We do not use your data for targeted advertising, behavioral profiling, or selling to data brokers.

MyKharsia offers sign-in with Google as a convenient authentication option. When you choose to sign in with Google, here is exactly what happens:

Authentication is handled securely via Supabase Auth, which is a trusted OAuth 2.0 provider. Your Google credentials are never sent directly to our servers.

To revoke access: Visit your Google Account Permissions page and remove MyKharsia. You can then create a password-based account if you wish to continue using the Platform.

Our platform is currently ad-free and community-funded. Our business model is based on community growth — not data exploitation. Your data belongs to you and is used only to provide you with a better MyKharsia experience.

MyKharsia uses a minimal approach to browser storage:

• Authentication Tokens: Supabase stores an encrypted session token in your browser's local storage to keep you logged in across sessions. This token contains no personal data — only a session identifier.
• Session Cookies: A session cookie may be set to manage your login state. This cookie is essential for the Platform to function and expires when your session ends or the token is invalidated.
• No Advertising Cookies: We do not use any third-party advertising cookies, tracking pixels, or behavioral analytics tools (such as Google Analytics with advertising features, Facebook Pixel, etc.).
• No Cross-Site Tracking: We do not track your activity on other websites or apps. Our data collection is limited entirely to your activity within kharsia.in.

You may clear your browser's local storage and cookies at any time. Doing so will log you out of MyKharsia. The Platform functions correctly without any third-party cookies.

MyKharsia shares your data only in the following limited circumstances:

• Supabase (Data Processor): All user data is stored and processed on Supabase (supabase.com), a SOC 2 Type 2 certified cloud database platform. Supabase processes your data strictly on our behalf and under our instructions. They do not access or use your data for their own purposes.
• Legal Requirements: We may disclose your data if required to do so by law, court order, or a valid request from Indian government authorities. We will notify you of such requests where legally permitted.
• Safety & Security: We may share data to prevent serious harm, fraud, or criminal activity targeting the Platform or its users.
• Business Succession: If MyKharsia is acquired or merged with another entity, your data may be transferred as part of that transaction. We will notify users and ensure your rights are protected under the same or stronger privacy standards.

In all other cases, your data is never shared with any third party. We have no advertising partners, analytics resellers, or affiliate marketing relationships involving user data.

We take the security of your personal data seriously and implement multiple layers of protection:

• HTTPS Encryption: All data transmitted between your browser and our servers is encrypted using industry-standard TLS/SSL encryption.
• Supabase Encryption: Data stored in our database is encrypted at rest using AES-256 encryption by Supabase's infrastructure.
• Row Level Security (RLS): Our database uses Supabase's Row Level Security policies, which ensure that each user can only access their own data. Administrators can only access data through explicitly authorized policies.
• Secure Authentication: Passwords are never stored in plain text. Supabase Auth uses bcrypt hashing for password storage and secure token management.
• Access Controls: Admin access to the platform is restricted by role-based authentication. Only designated administrators can access user management features.
• No Shared Credentials: API keys and database credentials are never exposed in client-side code and are stored as server-side environment variables.

We retain your personal data only as long as necessary for the purposes described in this Privacy Policy:

• Active Accounts: Your profile data is retained for as long as your account is active on the Platform.
• Submitted Content: News articles, shop listings, events, and photos you submit are retained to maintain the Platform's content archive. You may request removal of specific content at any time.
• Coin Transaction Logs: Maintained for 3 years for audit and dispute resolution purposes.
• Inactive Accounts: Accounts that have been inactive for more than 24 consecutive months may be reviewed for deletion. We will attempt to notify you at your registered email before any deletion.
• Deleted Accounts: When you request account deletion, your profile information is permanently erased within 30 days. Submitted public content (news articles, etc.) may be retained in anonymized form to preserve community records, unless you specifically request its removal.
• Legal Hold: Certain data may be retained longer than the above periods if required by applicable law or for pending legal proceedings.

You have the following rights regarding your personal data. To exercise any of these rights, contact us at admin@kharsia.in:

We will respond to all data rights requests within 30 days. In complex cases, we may take up to 60 days, and will notify you of the extension within the first 30 days.

Under the Digital Personal Data Protection Act, 2023 (India), you have additional rights as a Data Principal. We are committed to honoring these rights as the Act is fully implemented.

MyKharsia is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13.

• Users must be at least 13 years of age to create an account on MyKharsia
• Users between 13 and 18 years old are encouraged to use the Platform with parental or guardian awareness and consent
• If we become aware that we have inadvertently collected personal information from a child under 13, we will take immediate steps to delete that information from our systems
• Parents or guardians who believe their child under 13 has provided us with personal information should contact us at admin@kharsia.in for immediate assistance

MyKharsia may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this page
• Post a prominent notice on the Platform's homepage for at least 14 days
• Send an in-app notification to all registered users
• For significant changes affecting your rights, seek your renewed consent where required by law

The updated Privacy Policy will be effective from the date stated at the top of the page. Your continued use of MyKharsia after that date constitutes acceptance of the updated Policy.

If you disagree with any changes, you may stop using the Platform and request account deletion by emailing admin@kharsia.in. We will process your request within 30 days.

You may also review the Terms & Conditions for related policies governing your use of the Platform.