Draft — not yet reviewed by a lawyer.
This document describes how Mandiram actually works today, but it has not been reviewed by a qualified lawyer and must be before Mandiram launches. Last updated 15 October 2026.
Last updated 15 October 2026.
Mandiram is a social network and directory for places of worship, built for the Sanatani, Sikh, Bauddh and Jain traditions. For the purposes of this policy, Mandiram is the data fiduciary for the personal data described below: it decides what is collected and why. This policy describes what Mandiram does with your data; the Terms and Conditions describe the rest of what using Mandiram means. For anything in this policy — a question, a correction, a complaint — write to the grievance contact described on the Grievance Redressal page.
Optional newsletters and app alerts have separate Email, SMS and WhatsApp choices. Newsletter sign-in need not create an app account. We use your verified email and Indian mobile, consent choices, contact-proof versions, eligible age-band declaration and consent history. Providers receive the destination and message needed for the channel you chose; they do not own enrollment. Delivery attempts and receipts record outcomes, not whether you read a message. Contact-derived HMAC suppression fences are pseudonymous, not anonymous.
When you create an account, Mandiram collects your name, email address and password.
Your password is never stored as text Mandiram can read. It is hashed by Better Auth, the authentication system built into Mandiram's own backend, and only that hash is kept. Mandiram itself never stores or sees your password.
Your email address is verified before you can sign in: Mandiram sends a confirmation link to it, and an account whose address has not been confirmed cannot be used. That proves the address reaches you. It does not prove anything else about who you are, and your address is never used to decide what you are allowed to do — that is keyed to your account itself.
Beyond your account, Mandiram collects what you do with it: the posts you write, the places you join, the likes you leave, place claims and the note you attach when you file one, and donation records together with any message you add to a donation.
If you choose “Use current location” when writing a post, your browser asks for location permission. Publishing that post stores the coordinates with it and shares your precise location with the post's audience. They also help eligible posts appear in nearby discovery. You can remove the location before publishing. Account erasure removes these coordinates, including from content retained by a place.
Mandiram also keeps technical data about your sessions: each active session record has an IP address and browser user-agent field. Signing in happens entirely on Mandiram's own server, not in your browser, so these fields hold Mandiram's server's IP address and its server-side request's user-agent — the same two values for every account, every time. Mandiram's database does not record your device's IP address. Nothing in Mandiram checks or compares these fields automatically, and they are not used for analytics. Product analytics — PostHog, described under “Other services involved” below — reaches it two ways, and they differ. The events Mandiram's own server sends carry no IP address at all, yours or anyone's, and PostHog is told not to infer one. The events your browser sends travel through Mandiram to PostHog, so they arrive carrying your address the way any relayed request does; PostHog is set to discard it rather than store it.
| Name | What it holds | How long it lasts | Readable by page scripts |
|---|---|---|---|
mandiram_session | Your signed-in session, encrypted: your account id, name, email, access token, and — if your account is identified in analytics — the pseudonymous id described under “Product analytics and your age”. | 30 days | No |
mandiram_theme | Whether you chose the light or dark appearance. | 1 year | Yes |
mandiram_location | The place you asked to browse — a country, state or city — or, if you used “use my location”, the coordinates your browser reported. | 1 year | Yes |
mandiram_locale | A language code — remembers your chosen interface language. | 1 year | Yes |
mandiram_location deserves a specific note: it is readable by scripts running on the page, and if you used “use my location”, it holds the coordinates your browser reported — coordinates that can be precise enough to identify where you were standing.
All four cookies above are first-party — set and read only by Mandiram, never by anyone else — and strictly functional: one keeps you signed in, one remembers your appearance choice, one remembers the place you asked to browse, one remembers your chosen interface language. This is why Mandiram shows no cookie-consent banner: there is nothing here that consent law asks us to gate.
Some of these are contacted directly by your browser. Others are contacted by Mandiram's own server on your behalf, which means that service sees Mandiram, not you. The two are different privacy exposures, so they are listed separately below.
Three of them are contacted because of something you chose to do: Razorpay if you give to a place through the payment gateway, Google if you use the Google sign-in button, and MSG91 if you sign in with a phone number. New shop orders do not open a gateway checkout.
PostHog sits in the second table for a reason worth stating: your browser never addresses it directly, because what your browser sends is passed through Mandiram to PostHog. So unlike Railway and MSG91, which only ever see Mandiram's own server, PostHog does receive a request carrying your IP address on arrival — and it is set to discard it rather than store it.
| Service | Why | What it receives |
|---|---|---|
tile.openstreetmap.org | Draws the map on the Map page. | Your IP address, and which map tiles you asked for — roughly, the area you are looking at. |
Vercel | Hosts this website — your browser loads every page from it. | Your IP address and the pages you request, in ordinary web server logs. |
Cloudflare (R2) | Stores and serves uploaded media — avatars, cover images, post photos, videos and audio. | Your IP address, and which file you loaded. Your browser fetches media from Cloudflare directly, so this happens on every page showing somebody's photo. The file names are random, and Cloudflare is told nothing about who you are. |
checkout.razorpay.com | Takes eligible place donations in a window Razorpay controls. Historical online shop orders may also be settled or refunded there. | Your IP address, the amount and order reference, and whatever you type into that window — your card, UPI or wallet details. Mandiram never sees those: they go to Razorpay, which tells Mandiram only whether the payment succeeded. New shop orders never open this checkout; place giving can open it when you choose to give. |
accounts.google.com | Signing in with Google, if you choose that instead of a password. | Your IP address, and the fact that you are signing in to Mandiram. Google then tells Mandiram your name, email address and Google account id. Your Google password is never seen by Mandiram. This is only ever contacted if you use the Google button. |
syd.cloud.appwrite.io | Serves photographs of places imported from an earlier version of Mandiram. | Your IP address and which image you loaded. |
cdn.mandiram.app | Serves Mandiram-owned placeholder artwork and clearly labelled demo media from Cloudflare's CDN. | Your IP address and which placeholder image you loaded. |
Firebase Authentication (Google) | Temporarily sends and verifies the one-time code when Firebase is the configured phone sign-in provider. | Your phone number, IP address, browser and abuse-prevention signals, and verification activity. Google may retain the supplied number for spam and abuse prevention. This is contacted only when you choose phone sign-in and Firebase is configured. |
Firebase Cloud Messaging (Google) | Delivers browser push notifications after you explicitly enable push in notification settings. | Your browser installation identifier, push subscription metadata, notification payload and delivery events. This is contacted only after you enable browser push. |
| Service | Why | What it receives |
|---|---|---|
MSG91 | When MSG91 is the configured provider, it sends the one-time code when you sign in with a phone number. | Your phone number and the code, so it can deliver the message. Not your IP address — Mandiram's own server asks MSG91 to send it. This is only ever used if you sign in by phone; phone sign-in is India-only and is switched off unless configured. |
Railway | Hosts Mandiram's API and database. | Mandiram's web server's IP address, not yours. The API is called only from Mandiram's server, never from your browser, so Railway's logs never contain your address. |
PostHog (US) | Product analytics and error reports — which kinds of things people do, and what breaks. | Page types with place names, handles and query strings removed; error types without their messages; your browser, operating system, device type, screen and window size, and language. For accounts that confirmed they are 18 or older and have not turned analytics off, also a pseudonymous account id and which kinds of actions were taken — never which post, place or person. Your browser never contacts PostHog: what it sends goes to Mandiram, which relays it, and the rest is sent by Mandiram's own server. PostHog is set to discard IP addresses. |
Everything in the first table sees your IP address, because your browser connects to it directly — that is how the web works and Mandiram cannot prevent it. What Mandiram can say is narrower, and it is the sentence above about session records: your IP address is not stored in Mandiram's own database. It appears in those services' ordinary server logs, under their own retention policies, not in anything Mandiram keeps or can search.
Mandiram uses PostHog for product analytics and error reports — which parts of Mandiram are used, and what breaks. Your browser never contacts PostHog directly: what it sends goes to Mandiram's own address and Mandiram relays it onward, and everything else is sent by Mandiram's own server. PostHog's analytics library runs in your browser as part of Mandiram's own code, and it fetches one further PostHog script — the one that reports browser errors — through Mandiram's address rather than PostHog's.
What your browser sends is the type of page you are on — the route, with place names, handles, query strings and anything after a # removed — the type of any error, your browser, operating system, device type, screen and window size, and language, and, if you arrived from another website, that site's address but never the page on it. For accounts covered by the next section, Mandiram's server also sends a pseudonymous account id and which kinds of actions were taken. What is never sent: which place, post or person was involved; the title of any page; any query string; anything you searched for; and the text of any error message. An error that happens while Mandiram is building a page is reported as the error's type and the route template alone — never the message, never the address you asked for, never the request headers.
Nothing is kept in your browser for this: no analytics cookie, and no stored identifier. What the library needs it holds in memory for the life of the page, and it is gone when the tab closes. While starting up, the library does write one throwaway key into local storage to test whether storage works and deletes it in the same moment; nothing that identifies you is written.
There is no tag manager, no advertising network and no other third-party tracker. Nothing about you is sold or shared for advertising.
An account is identified in analytics only after its holder confirms, in Settings, that they are 18 or older. That confirmation is your own statement and Mandiram does not verify it — nothing is asked for and nothing is checked.
Until you confirm it, for anyone who is not signed in, and after you turn analytics off, pages and browser errors are still counted — but without anything that identifies you: no account id, nothing stored in your browser, and no person record on PostHog's side, only a random id that lasts as long as the page is open and is thrown away when it closes.
Turning analytics off in Settings, or withdrawing the age confirmation, stops your account being identified and asks PostHog to delete the person record and the events already sent. The person disappears straight away; deletion of past events runs on PostHog's own schedule rather than Mandiram's. The anonymous counting described above continues, as it does for anyone who is not signed in.
Having your account deleted erases the person record too, and no new sign-in can be identified afterwards. A browser you were already signed in on is the exception: it holds a session of its own, and can keep sending identified events under the erased id until it is signed out or that session expires, which can be up to 30 days. If that matters to you, sign out on every device before asking for deletion, or say so when you write.
Nothing you give Mandiram is used for advertising or for building a profile of you.
Your account and what you have posted stay until you ask for them to be deleted. Sessions expire on their own, after 30 days.
The following data is cleaned up on a schedule, whether or not you ask:
Optional communications discard abandoned, unactivated feature state after 30 days, and unsubscribe capabilities expire within 30 days. This does not delete your sign-in identity. Terminal delivery and receipt operations are removed after 180 days. Inactive consent evidence and declarations are removed or redacted after 400 days. Active consent and the version fences needed to enforce your choices remain while needed. STOP, bounce and complaint fences are not cleared by ordinary unsubscribe, renewed consent, provider replay or age-based cleanup. Active alert decisions remain while their source notifications are eligible for recovery; obsolete generations follow the operational window.
At Newsletter preferences you can export your own data or erase a newsletter-only sign-in without an app account. App accounts use the existing account deletion path. Requesting account deletion withdraws optional choices immediately; restoration never subscribes you again. Explicit erasure deletes personal communications state, contact-derived suppression fences and editorial author attribution, but retains published editorial issues. A send already started cannot be recalled. Old delivery callbacks cannot recreate an erased subscriber. We do not promise historical cross-identity blocking after explicit erasure: a later independent application needs a new sign-in authority, both current contact proofs and new explicit consent.
You can delete your account yourself, at Settings, by retyping your own handle. It is reversible for 30 days and then it is not. Erasure is refused, with a reason, while you own a shop, hold a role in one, or have placed an order — those are someone else's records too, and they have to be dealt with first rather than destroyed on your way out.
Under India's Digital Personal Data Protection Act 2023, you may ask to access your data, correct it, or have it erased; you may raise a grievance about how Mandiram has handled it; and you may nominate someone else to act on your behalf if you are unable to.
If you are in the EU or UK, the GDPR gives you additional rights: to restrict how your data is processed, to object to processing, and to receive a portable copy of your data.
Erasure you can do yourself, at Settings — see “How long we keep it” above for what that does and what refuses it.
Every other right is exercised by writing to the grievance contact, for correction or other requests. You can also download your own data at Account export when signed in. Requests are acknowledged within 24 hours and resolved within 15 days.
The minimum age to hold a Mandiram account is 13. Anyone under 18 needs a parent's or guardian's consent to use it.
Mandiram does not knowingly collect data from anyone under 13, and will delete such data on notice. Consent from a parent or guardian is not verified — Mandiram has no mechanism to confirm it was given.
Mandiram does no advertising and builds no profile of anyone. It never identifies an account in analytics unless the person holding it has confirmed they are 18 or older, so no child is tracked as a person. The anonymous counts of pages and errors described under “Other services involved” include everyone.
Passwords are hashed by Better Auth. The session cookie that keeps you signed in is encrypted. Every API request's access token is checked against the database on the server, so signing out ends that session immediately rather than waiting for a token to expire on its own.
Mandiram has not undergone any third-party security certification, audit or penetration test, and does not encrypt its database at rest.
The date at the top of this page changes whenever this document does. If a change is material, Mandiram will signal it in the product rather than only here.