Privacy Policy

Welcome to Ujjain Maha Kumbh 2028 (referred to as "we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and what rights you have regarding it.

This policy applies to our website https://ujjainmahakumbh.com and our official Android mobile application ("Ujjain Maha Kumbh", published on Google Play Store by DeveloperZone).

When you register on our portal as a pilgrim, volunteer, vendor, or media person, we collect the following information:

• Full name — to identify and address you
• Email address — to send registration confirmation and event updates
• Phone number — for logistical coordination if you attend the event
• State of residence — for travel and arrangement planning
• Category — whether you are registering as a pilgrim, volunteer, vendor, or media representative
• Number of pilgrims (for pilgrim category) — to estimate group size
• Skills (for volunteers) — to match you with appropriate roles
• Organization (for vendors/media) — for verification
• Special needs, messages, and notes — to accommodate your requirements

We also automatically collect basic technical data (IP address, browser type, device type, pages visited) solely for security, debugging, and anonymous usage analytics.

We do NOT collect: Aadhaar numbers, government IDs, financial information, credit card data, precise GPS location, photos, videos, audio recordings, or contacts list.

Your information is used exclusively for:

• Sending you a registration confirmation email
• Sending important updates about the event, such as Shahi Snan (royal bath) dates, travel guidelines, safety announcements, and volunteer assignments
• Coordinating on-ground logistics for pilgrims, volunteers, and vendors
• Responding to your queries and messages
• Improving our website and services based on anonymous usage patterns

• We never sell your personal information
• We never rent or trade your information with advertisers, marketers, or data brokers
• We do not share your information with any third party except as described in Section 5 below
• We do not use your information for behavioral targeting or profiling
• We do not send you unsolicited promotional emails from third parties

Your personal information is shared only in the following strictly limited circumstances:

• Email service provider: We use Gmail SMTP to deliver confirmation and broadcast emails. Google processes the email envelope (sender, recipient, subject) as needed for delivery.
• Hosting provider: Our website and database are hosted on secure cloud infrastructure. The provider has access to encrypted data at rest but cannot read the contents in meaningful form.
• Legal compliance: If required by a valid court order or legal process under Indian law, we may share information with authorized government authorities.
• Event coordination (opt-in only): If you volunteer, your contact info may be shared with on-ground coordinators for your specific assignment — only after explicit confirmation from you.

Under Indian law (Digital Personal Data Protection Act 2023) and international privacy standards (GDPR, CCPA), you have the following rights:

• Right to access: Request a copy of all personal data we hold about you
• Right to rectification: Ask us to correct any inaccurate information
• Right to erasure ("right to be forgotten"): Request deletion of your data at any time
• Right to withdraw consent: Opt out of future communications
• Right to data portability: Receive your data in a machine-readable format
• Right to lodge a complaint: With the Data Protection Board of India or any relevant authority

To exercise any of these rights, email us at contact@ujjainmahakumbh.com. We respond within 7 business days.

We retain your registration information until the Kumbh Mela 2028 event concludes (approximately May 2028) plus 1 additional year for follow-up communications. After that, your records are permanently deleted from our active database.

You may request earlier deletion at any time by emailing contact@ujjainmahakumbh.com.

We implement industry-standard security measures:

• HTTPS (TLS 1.2+) encryption for all data in transit
• Passwords hashed using bcrypt
• Admin access protected by JWT tokens with 24-hour expiry
• Database access restricted to authorized administrators only
• Regular automated backups stored in encrypted form

However, no system is 100% secure. If we detect a breach affecting your data, we will notify you within 72 hours via email as required by law.

Our services are not directed to children under 13. We do not knowingly collect information from anyone under 13. Parents registering on behalf of minors under 18 should include the minor's information only in the "Number of pilgrims" field or "Message" section — not create separate registrations for them.

Our website uses minimal essential cookies only — for session management and basic functionality. We do NOT use third-party advertising cookies, Google Analytics, Facebook Pixel, or any behavioral tracking tools.

The "Ujjain Maha Kumbh" Android app requests minimal permissions:

• Internet access — to connect to our backend API (required for all features)
• Network state — to detect when you are offline and cache accordingly

The app does NOT request access to your camera, microphone, contacts, SMS, calendar, location, storage (beyond app-private), or any other sensitive permission.

We use these third-party services with strict data-minimization:

• Google Places API (via Pica Passthrough) — for location search on the Locations page. No personal data is sent; only your anonymous search query.
• Google Gmail SMTP — for outbound email delivery. Handles recipient address and email content only.
• MongoDB Atlas / self-hosted MongoDB — database hosting.

Our services are primarily intended for Indian residents and pilgrims traveling to Ujjain, India. If you access our services from outside India, your data will be processed and stored in India (or cloud data centers serving the India region).

We may update this Privacy Policy occasionally to reflect legal changes or new features. When we do, we'll update the "Last updated" date at the top. For material changes, we'll notify registered users via email at least 7 days before the change takes effect.

For any privacy questions, data requests, or concerns, please contact: