Privacy Policy

Welcome to Thela Khojo ("we", "our", "us") — Jaipur's community-powered street food directory. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and what choices you have. By using our website at thelakhojo.in or our services, you agree to the practices described here.

If you do not agree with this policy, please do not use our platform.

Account Information

• Name and email address when you register.
• Password (stored in hashed form — we never store it in plain text).
• If you sign in with Google, we receive your name, email, and profile picture from Google OAuth.

Contributions You Make

• Food stall listings you add: name, area, location, photos, description, timings, and any other details you submit.
• Reviews, ratings, and open/closed confirmations.
• Profile details visible on the community leaderboard.

Automatically Collected Data

• IP address, browser type, device type, and operating system.
• Pages you visit, time spent, and general browsing patterns (server logs).
• GPS/location coordinates — only if you grant permission for the "Near Me" feature. See Section 4.

• Create and manage your account, authenticate sign-ins, and send email OTPs for verification.
• Display the street food directory and power search, filters, and the Near Me feature.
• Show your Explorer points balance and rank on the community leaderboard.
• Send transactional emails (account verification, spot submission updates) via Resend.
• Monitor server health, debug issues, and prevent abuse (rate limiting, spam detection).
• Improve the platform based on aggregated, non-identifiable usage patterns.

We do not use your data for advertising or sell it to third parties.

The "Near Me" feature requests your device's GPS coordinates through your browser. We ask for your permission before accessing location.

• Location is requested only when you tap "Near Me" — not automatically or in the background.
• Your coordinates are sent to our server solely to calculate distances and return nearby spots.
• We do not store your GPS coordinates on our servers after the response is sent.
• If you deny location permission, the Near Me feature simply will not work; all other features are unaffected.

When you submit or edit a spot, you may pin a location by pasting a Google Maps link or using your current position. The resulting latitude/longitude is stored as part of the spot listing, not linked to your personal profile.

Thela Khojo is a community platform. Anything you choose to contribute — stall listings, reviews, ratings, photos, open/closed confirmations, and comments — may be displayed publicly on the website and visible to all visitors, including people without an account.

• Please do not include sensitive personal information in reviews or listings (such as your phone number, home address, or financial details).
• Photos you upload are stored on Cloudinary (our image hosting service) and may be publicly accessible via direct URL.
• We reserve the right to moderate, edit, or remove content that violates our community guidelines.

The following information about you may be visible to other users or the public:

• Your display name and profile picture (if signed in via Google, this comes from your Google account).
• Your Explorer points balance and leaderboard rank.
• The number of spots, reviews, and confirmations you have contributed.

Your email address is never shown publicly.

We use a small number of essential cookies and browser storage to operate the site:

• Authentication token: Stored in your browser's localStorage to keep you signed in across page visits. Cleared when you sign out.
• Draft autosave: When you're filling in the "Add a Spot" form, your progress is temporarily saved in localStorage so you don't lose it if you navigate away. This data never leaves your device.
• Cloudflare cookies: Our DNS and security provider (Cloudflare) may set technical cookies for bot detection and security. These do not track you for advertising purposes.

We do not use advertising cookies, tracking pixels, or third-party behavioural cookies.

We collect basic technical logs (IP address, request path, timestamps, HTTP status codes) on our backend server for security monitoring and debugging. These logs are not shared with advertising platforms.

Our frontend is hosted on Vercel, which may collect anonymous performance metrics (page load times, error rates) to operate the hosting infrastructure. Vercel's own privacy policy applies to this data.

We do not sell, rent, or trade your personal information. We share data only in these limited circumstances:

• Service providers: Trusted third parties that help us operate the platform (see Section 10). They are permitted to use your data only to provide services to us.
• Legal requirements: If required by applicable law, court order, or government authority.
• Safety: To protect the rights, property, or safety of Thela Khojo, our users, or the public.

The following services process data on our behalf:

Each provider operates under their own privacy policy. We encourage you to review them if relevant to you.

• Account data is retained for as long as your account is active.
• Spot listings, reviews, and photos you contribute remain on the platform even after account deletion, unless you specifically request their removal.
• Server logs are retained for up to 90 days for security and debugging purposes.
• Draft data saved in your browser (localStorage) is stored only on your device and cleared when you complete or abandon a submission.

You can request deletion of your account at any time by emailing support@thelakhojo.in. We will delete your account credentials and personal profile information within a reasonable time.

Please note: content you contributed (spot listings, reviews, photos) is community data and may remain on the platform in anonymised or attributed form unless you also request its removal. Let us know in your deletion request if you want your contributions removed as well.

We use reasonable technical and organisational safeguards to protect your information, including:

• Passwords stored using industry-standard hashing (bcrypt).
• HTTPS encryption for all data in transit.
• Database access restricted to backend servers only.
• Rate limiting on all API endpoints to prevent abuse.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately.

You have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correct: Ask us to update inaccurate information in your account.
• Delete: Request deletion of your account and personal data (see Section 12).
• Withdraw consent: Revoke location permission through your browser settings at any time.

To exercise any of these rights, email us at support@thelakhojo.in. We will respond within a reasonable timeframe.

Thela Khojo is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will promptly delete the account and associated data.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this page. Continued use of Thela Khojo after changes are posted constitutes your acceptance of the updated policy.

We encourage you to review this page periodically.