Privacy notice

What we collect, and what we do not

Written to the Digital Personal Data Protection Act, 2023. It describes what actually happens in the system, not what would be convenient to say.

Last updated 9 August 2026 · Nada Kodagu is operated by Cyberhuman AI Inc. · Contact: the contact form

The short version. We ask for an email address so that one person cannot pretend to be twenty. Your email is never shown to anyone and never shared. Reports are public by design — that is the point of the platform — but the map deliberately shows an approximate position, never the exact one, and your photograph is stripped of its hidden metadata before anyone else sees it.

Who is responsible

Nada Kodagu is operated by Cyberhuman AI Inc., which is the Data Fiduciary for the purposes of the DPDP Act. Questions, corrections, and requests about your data go through the contact form, choosing Grievance if you want the statutory timelines to apply.

What we collect

What	Why	Who can see it
Email address	To verify you are a real person and to send you a sign-in code. This is the single control that keeps the map free of fake reports.	Nobody. It is never displayed, never published, never shared, and is not visible to other users or to moderators through the app.
Public name	So a report has an author. You choose it; it does not have to be your real name.	Everyone, next to your reports.
Photograph	It is the report.	Everyone. Re-encoded on our servers before publication, which removes the hidden metadata — including the GPS coordinates most cameras embed.
Precise location	To decide which department a report belongs to and whether it is inside Kodagu.	Only us. Stored separately from the report itself and never published.
Approximate location	To place the report on the public map.	Everyone. Rounded to three decimal places — roughly a 110-metre square — so a report never points at a doorstep.
Your note, category, time	Context for the report.	Everyone.
Technical signals — whether the photo came from the camera or the gallery, image fingerprints, error codes, browser type	To detect forwarded, staged and duplicate images, and to find bugs.	Only us.

What we deliberately do not do

No advertising, and nothing is sold. Your data is not a product here and there is no business model that would make it one.
No third-party analytics or tracking scripts. There is no Google Analytics, no Facebook pixel, no advertising SDK. The site's security policy blocks them at the browser level, so one cannot be added by accident.
No tracking cookies. The only thing stored in your browser is your sign-in session and your language choice.
No selling, renting or sharing of personal data with anyone for their own purposes.
No phone number, no address, no date of birth beyond an age check, no contacts, no photo library access. The app asks for the camera and your location, and nothing else.

Artificial intelligence, stated plainly

When you submit a photograph, a copy is sent to Google's Gemini model to suggest a category and severity. This is disclosed because you are entitled to know that an automated system looked at your photograph, and because we think a platform that uses AI silently has already lost the argument.

The model's suggestion is a suggestion. You can change it before submitting, and every AI-derived category is labelled as such on the report.
The image sent for classification is a reduced copy with metadata already stripped. Your email and name are never sent with it.
No decision that materially affects you is made by the model alone. Reports the system is unsure about go to a human moderator, not to an automatic rejection.

Where your data lives

Databases, photographs and backups are hosted in Mumbai, India (ap-south-1). The website is served through Cloudflare's global network, which handles traffic and blocks abuse but does not store your reports.

Two processors handle data on our behalf: Supabase (database, file storage, sign-in emails) and Resend (email delivery). Photographs are additionally processed by Google for the classification described above. We use these because they are the honest engineering choice for a project this size; we would rather say so than imply everything is built in-house.

How long we keep things

Published reports stay while they are useful. Most categories expire automatically; a report about something long since fixed is not a permanent record of a place.
Rejected reports and their photographs are kept briefly, so that a wrong decision can be appealed, and then removed.
Your account lasts until you ask us to delete it.
Moderation records are kept longer, because a decision that cannot be audited is a decision nobody can challenge.
Messages you send us are kept while we deal with them and for as long as the law requires afterwards.

Your rights

Under the DPDP Act you may:

Ask what we hold about you, and get a summary of it.
Correct anything wrong — including your public name and any report of yours.
Ask us to erase your data. We will delete your account and personal data. Note that a report which has already been sent to a government department cannot be recalled from that department, and reports which the law requires us to retain will be kept for that period only.
Nominate someone to exercise these rights if you die or become unable to.
Complain — to us first, through the form, and to the Data Protection Board of India if we do not resolve it.

All of these go through the contact form. Choose Grievance and we will acknowledge within 24 hours and resolve within 15 days, as the IT Rules 2021 require.

Children

Nada Kodagu is not for under-18s, and we do not knowingly keep accounts for them. If you believe a child has an account here, tell us and we will remove it.

One thing to be clear about. A report is public. If you photograph something in front of your own house, the approximate location of that report is visible to everyone, and someone who knows the area may be able to work out who filed it. The 110-metre rounding is real protection but it is not anonymity. If that matters to you in a particular case, do not file that report.

Changes

If this notice changes in a way that affects what we do with your data, we will say so in the app rather than quietly updating the date at the top.