Privacy Policy

Effective 3 July 2026 · Last updated 3 July 2026

1. Who we are

This app and service ("Statement", "we", "our", "us") is operated by Alactic Inc, headquartered in Gurugram, Haryana, India. Contact: support@alacticai.com.

2. What we collect

We collect only what the app actually needs to work. Nothing is collected in the background for advertising, profiling, or resale.

2.1 Information you provide directly

• Account details — name, username, email address, and a password (stored only as a bcrypt hash, never in plain text). If you sign in with Google, we receive your name, email address, profile picture URL, and Google account ID from Google.
• Optional profile details — city, state, and any bio content you choose to add.
• Incident reports — the text, category, photos, and precise location coordinates you submit with each report you post.
• Comments and support signals — text you post as a comment, and the fact that you tapped "support" on an incident.
• Support and moderation requests — any content you send us via support@alacticai.com, or any report you flag from within the app.

2.2 Information collected automatically

• Precise location (latitude/longitude) — only when you actively submit an incident or when you enable the "Near me" feed filter. You can decline location permission at any time and continue using the rest of the app.
• Device identifiers — a per-installation identifier generated by Expo/React Native, used to authenticate your session and deliver push notifications. This is not Google's Advertising ID; we do not read or use the Advertising ID.
• Session logs — server-side access logs (timestamp, endpoint, HTTP status) retained for 30 days for security and debugging.

2.3 What we do not collect

• We do not collect contacts, calendar, SMS, call logs, health data, or financial data.
• We do not read files outside of photos you explicitly attach to a report.
• We do not track you across other apps or websites.
• We do not use third-party advertising or analytics SDKs.

3. Why we collect it (purposes)

• Account creation and authentication — email + password (or Google Sign-In) so you can log in.
• Publishing incident reports — text, photos, and coordinates are shown on the community feed and map so nearby users can see and react.
• Feed personalisation — location is used only to compute distance for filters like "near me", "my city", "my state". No behavioural profile is built from this.
• Safety and moderation — flagged content and reports are reviewed by our moderators to enforce our community rules.
• Push notifications — to notify you of comments on your reports, new incidents in your area, and moderation decisions.

4. Legal basis for processing

Where the Digital Personal Data Protection Act, 2023 ("DPDP Act") applies, we process your data based on your consent (given when you create an account and grant permissions in-app). You can withdraw consent at any time by deleting your account.

Where the EU/UK GDPR applies (if you access the service from those regions), we process your data under Article 6(1)(a) — your consent — and Article 6(1)(f) — our legitimate interest in operating a safe community platform.

5. Sharing and disclosure

We do not sell your data. We share it only in these narrow circumstances:

• Publicly on the feed — the content of an incident report you post (text, photo, coordinates, your username and profile picture) is visible to other Statement users. Do not include anything in a report you would not want public.
• Service providers we operate through: MongoDB Atlas (database, region: Asia South), Google Cloud Platform (compute + hosting in the asia-south1 Mumbai region), Google Play Services (for authentication and push notifications), and the Expo push service (for delivering notifications). These providers process data only on our instructions.
• Legal obligation — if we receive a lawful, written order from an Indian court or government authority, we may disclose the minimum information required. We will notify you unless prohibited by law.
• Safety of persons — if we reasonably believe disclosure is necessary to prevent imminent harm to a person, we may share relevant information with law-enforcement.

6. Data retention

• Account data — until you delete your account.
• Incident reports and comments — retained after account deletion in anonymised form (username replaced with "deleted user") so the community record remains, unless you specifically request removal of a report.
• Server access logs — 30 days rolling.
• OTP records — deleted immediately after use or expiry.
• Push notification history — 90 days.

7. Security

• All traffic between the app and our servers is encrypted in transit with TLS 1.2+ (Let's Encrypt certificates, HTTPS enforced).
• Passwords are hashed with bcrypt (cost factor 12); we never store plaintext passwords.
• Session tokens are short-lived JWTs signed with a private key held only on our server.
• Database access is restricted by IP whitelist and role-based credentials.
• Our production VM runs on Google Cloud in Mumbai (asia-south1) with the OS kept patched. Application code is code-reviewed before deployment.

No system is ever perfectly secure. If we detect a breach affecting your personal data we will notify you within 72 hours in accordance with the DPDP Act.

8. Your rights

You have the following rights over your personal data at all times:

• Access — request a copy of what we hold on you.
• Correction — update your name, email, city, state, profile picture, and password from Settings inside the app.
• Deletion — delete your account from Settings, or by emailing support@alacticai.com. On deletion your account and profile picture are erased; posted reports are anonymised.
• Portability — request an export of your data in a machine-readable format.
• Withdraw consent — you may revoke location, camera, or notification permissions at any time from your device settings; the app will continue to function with reduced features.
• Complaint — under the DPDP Act, you may lodge a complaint with the Data Protection Board of India.

To exercise any of these rights email support@alacticai.com. We respond within 30 days.

9. Children

Statement is not intended for children under 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a person under 18 we will delete it promptly. If you are a parent or guardian and believe your child has used Statement, email support@alacticai.com.

10. International transfers

Your data is stored in India (asia-south1, Mumbai). If any of our sub-processors process data outside India, they do so under contractual protections that maintain a comparable level of protection to Indian law.

11. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify you in-app or by email at the address associated with your account. The "Effective" date at the top of this page will always reflect the current version.

12. Contact

Grievance officer (DPDP Act, 2023) and general privacy contact:
Alactic Inc
Email: support@alacticai.com
Registered address: Gurugram, Haryana, India