Draft — not yet reviewed by a lawyer.
This document describes how Mandiram actually works today, but it has not been reviewed by a qualified lawyer and must be before Mandiram launches. Last updated 12 September 2026.
Privacy Policy
Last updated 12 September 2026.
Who we are
Mandiram is a social network and directory for places of worship, built for the Sanatani, Sikh, Bauddh and Jain traditions. For the purposes of this policy, Mandiram is the data fiduciary for the personal data described below: it decides what is collected and why. This policy describes what Mandiram does with your data; the Terms and Conditions describe the rest of what using Mandiram means. For anything in this policy — a question, a correction, a complaint — write to the grievance contact described on the Grievance Redressal page.
What we collect
When you create an account, Mandiram collects your name, email address and password.
Your password is never stored as text Mandiram can read. It is hashed by Better Auth, the authentication system built into Mandiram's own backend, and only that hash is kept. Mandiram itself never stores or sees your password.
Your email address is never verified. Mandiram takes it on your word, as typed, and nothing confirms it belongs to you.
Beyond your account, Mandiram collects what you do with it: the posts you write, the places you join, the likes you leave, place claims and the note you attach when you file one, and donation records together with any message you add to a donation.
Mandiram also keeps technical data about your sessions: each active session record has an IP address and browser user-agent field. Signing in happens entirely on Mandiram's own server, not in your browser, so these fields hold Mandiram's server's IP address and its server-side request's user-agent — the same two values for every account, every time. Mandiram's database does not record your device's IP address. Nothing in Mandiram checks or compares these fields automatically, and they are not used for analytics, because Mandiram runs none.
Cookies
| Name | What it holds | How long it lasts | Readable by page scripts |
|---|---|---|---|
mandiram_session | Your signed-in session, encrypted: your account id, name, email and access token. | 30 days | No |
mandiram_theme | Whether you chose the light or dark appearance. | 1 year | Yes |
mandiram_location | The place you asked to browse — a country, state or city — or, if you used “use my location”, the coordinates your browser reported. | 1 year | Yes |
mandiram_location deserves a specific note: it is readable by scripts running on the page, and if you used “use my location”, it holds the coordinates your browser reported — coordinates that can be precise enough to identify where you were standing.
All three cookies above are first-party — set and read only by Mandiram, never by anyone else — and strictly functional: one keeps you signed in, one remembers your appearance choice, one remembers the place you asked to browse. This is why Mandiram shows no cookie-consent banner: there is nothing here that consent law asks us to gate.
Other services involved
Some of these are contacted directly by your browser. Others are contacted by Mandiram's own server on your behalf, which means that service sees Mandiram, not you. The two are different privacy exposures, so they are listed separately below.
Contacted by your browser
| Service | Why | What it receives |
|---|---|---|
tile.openstreetmap.org | Draws the map on the Map page. | Your IP address, and which map tiles you asked for — roughly, the area you are looking at. |
Vercel | Hosts this website — your browser loads every page from it. | Your IP address and the pages you request, in ordinary web server logs. |
Fetched by Mandiram's server on your behalf
| Service | Why | What it receives |
|---|---|---|
loremflickr.com | Supplies the stand-in photograph shown on every listing — no place in the imported directory came with a real one. | Mandiram's server's IP address, not yours. These images are fetched by Mandiram's image optimiser and served to you from Mandiram's own domain, so LoremFlickr never sees your device. |
Railway | Hosts Mandiram's API and database. | Mandiram's web server's IP address, not yours. The API is called only from Mandiram's server, never from your browser, so Railway's logs never contain your address. |
Everything in the first table sees your IP address, because your browser connects to it directly — that is how the web works and Mandiram cannot prevent it. What Mandiram can say is narrower, and it is the sentence above about session records: your IP address is not stored in Mandiram's own database. It appears in those services' ordinary server logs, under their own retention policies, not in anything Mandiram keeps or can search.
Mandiram runs no analytics, no tag manager, no advertising network and no third-party tracker of any kind. Nothing about you is sold or shared for advertising.
Why we use your information
- To give you an account and keep you signed in.
- To show what you post to other people — that is the product.
- To keep sessions secure and to investigate abuse.
- To run the directory of places itself.
Nothing you give Mandiram is used for advertising or for building a profile of you.
How long we keep it
Your account and what you have posted stay until you ask for them to be deleted. Sessions expire on their own; Mandiram does not keep a separate retention schedule beyond that.
Deletion today is handled by a person, by writing to the grievance contact — see “Your rights” below.
Your rights
Under India's Digital Personal Data Protection Act 2023, you may ask to access your data, correct it, or have it erased; you may raise a grievance about how Mandiram has handled it; and you may nominate someone else to act on your behalf if you are unable to.
If you are in the EU or UK, the GDPR gives you additional rights: to restrict how your data is processed, to object to processing, and to receive a portable copy of your data.
Every one of these is exercised the same way: by writing to the grievance contact. A person reads that mail and acts on it — Mandiram has no self-service screen for deleting your account or exporting your data. Requests are acknowledged within 24 hours and resolved within 15 days.
Children
The minimum age to hold a Mandiram account is 13. Anyone under 18 needs a parent's or guardian's consent to use it.
Mandiram does not knowingly collect data from anyone under 13, and will delete such data on notice. Consent from a parent or guardian is not verified — Mandiram has no mechanism to confirm it was given.
Because Mandiram runs no analytics or advertising, it does no behavioural tracking or profiling of anyone, including children.
How we protect it
Passwords are hashed by Better Auth. The session cookie that keeps you signed in is encrypted. Every API request's access token is checked against the database on the server, so signing out ends that session immediately rather than waiting for a token to expire on its own.
Mandiram has not undergone any third-party security certification, audit or penetration test, and does not encrypt its database at rest.
Changes to this policy
The date at the top of this page changes whenever this document does. If a change is material, Mandiram will signal it in the product rather than only here.