Privacy notice
Prototype · Updated October 17, 2026
Thirakku is a prototype. This notice describes the current app behavior; hosting and authentication providers may have their own retention practices.
Account information
Sign-in is handled by Supabase Auth. Email sign-up sends the email address and an optional profile name (the email prefix is used if no name is entered); Google sign-in also redirects through Google. Crowd reports and short-lived rate-limit counters use a keyed hash derived from the authenticated account ID. The hash lets the app enforce one report per train per India calendar day and limit repeated report attempts. Expired minute counters are periodically removed.
Photos
The camera preview and captured photo stay in the browser. The app does not upload or analyze the photo, blur faces, or save the image with a report. Avoid capturing identifiable people, and take a photo only from a safe place.
Location
If you allow it, the browser provides coordinates while the report camera step is open. The report request sends them to the server for a proximity check. The app stores the selected station with the report, not the coordinates. Hosting-provider request logging is outside the app database and depends on that provider’s settings.
Reports and signatures
Crowd reports store the selected train, station, level, travel date, report time, location-check result, and verification status. Petition signatures store a keyed account hash and petition ID; they do not store your email in the signatures table. Reports are unverified because photo analysis is not available.
Questions
No privacy contact channel is configured in this prototype yet.