Privacy Policy

1. What We Collect

RagRaksha is built on a foundation of privacy. We collect only the minimum data necessary to process bullying reports and provide you with a safe experience.

• Report data: Type, severity, description, location, incident date, and evidence files you voluntarily submit.
• Passphrase: A one-way hashed version of your tracking passphrase. We cannot read or recover it.
• Account data (if signed in): Google profile name, email, and avatar from OAuth. Used for authentication only.
• Messages: Content exchanged between reporters and admins through the secure messaging system.
• Feedback & contact: Ratings, comments, and contact form submissions.

2. What We Do NOT Collect

• IP addresses are not stored in any database table.
• Browser fingerprints are not collected.
• We do not use cookies for tracking, analytics, or advertising.
• We do not share any data with third-party advertisers or data brokers.
• Anonymous reports have no link to any user identity.

3. How We Use Your Data

• To process, investigate, and resolve bullying reports.
• To enable two-way communication between reporters and administrators.
• To generate anonymized platform statistics (total reports, resolution rates).
• To send email notifications about report status changes (admin only).
• To improve the platform based on feedback submissions.

4. Data Retention & Destruction

We take data minimization seriously. Our automated systems enforce strict retention policies:

• Evidence files (images, videos, audio) are permanently deleted from storage 30 days after a case reaches terminal status (resolved, closed, or dismissed).
• Archived reports are automatically archived 7 days after reaching terminal status.
• Soft-deleted data is permanently and irreversibly purged 90 days after deletion.
• Admin audit logs older than 6 months are automatically rotated.

5. Data Security

• All data is encrypted in transit (TLS/HTTPS) and at rest (AES-256 via Supabase).
• Passphrases are stored as irreversible cryptographic hashes (SHA-256).
• Row-Level Security (RLS) policies enforce access control at the database level.
• Admin access requires Google OAuth with email whitelist verification.
• API endpoints are protected by rate limiting and honeypot anti-spam measures.
• Evidence files are stored in a private, non-public storage bucket.

6. Your Rights

• You can withdraw any report you submitted while logged in.
• You can export all your data from the dashboard.
• You can delete your account and all associated data at any time.
• You can submit reports anonymously without creating an account.

7. Third-Party Services

• Supabase: Database hosting and authentication (PostgreSQL, encrypted at rest).
• Vercel: Application hosting and edge delivery.
• Google OAuth: Authentication provider (only for optional sign-in).
• Resend: Transactional email delivery (admin notifications only).

None of these services receive report content or evidence files. They process only what is necessary for their function.

8. Children's Privacy

RagRaksha is designed to be used by students of all ages. We do not knowingly collect personally identifiable information from children under 13 beyond what is voluntarily submitted in reports. All reports can be submitted anonymously.