Privacy Policy

Effective 3 October 2026 · Potholes.app, Pune, India

Who we are

Potholes.app is an independent civic road-hazard map. It is not a PMC, PCMC, PMRDA, or Maharashtra government app. This policy covers the website at potholes.app, the Android app app.potholes (in closed testing), and the iOS app (in development, not yet released). Contact: [email protected].

Google user data

If you tap Continue with Google, Google Authentication asks only for:

• openid — to verify the sign-in.
• email — the Google email on the account.
• profile — the name and profile photo Google already shows on that account.

We receive that Google account identifier, email, name, and photo so we can create or resume your Potholes.app user record. We use it to authenticate you, show your name or initial in the header, and attach reports you choose to file under your account. We do not read Gmail, contacts, Drive, calendars, or any other Google product. We do not sell Google user data. We do not use it for advertising. We do not share it with other apps except the infrastructure named below that runs this product.

What else we collect

• Account profile — display name, avatar URL, optional home neighbourhood, notification preferences, and a reputation score derived from in-app civic actions.
• Hazard reports — title, description, hazard type, severity, status, photos and videos, map coordinates of the hazard, address text, neighbourhood, and whether you asked to stay anonymous on the public map. Photos are re-encoded before upload, which removes embedded location, camera, and time details. Video files are uploaded as recorded, so their own metadata may remain.
• Civic activity — comments, confirmations, votes, and community membership if you use those features.
• Device location — read on-device to centre the map. The last pin is stored only on that device so the map does not jump back to city centre. Your location reaches our servers in two cases only: the pin on a report you submit, and, if you turn on nearby alerts, an approximate area rounded to about 1 km so we can tell you about new hazards near you. We keep only the latest approximate area per device, never a history, and delete it when you turn nearby alerts off, sign out of that device, or delete your account. We do not sell location or use it for advertising.
• Push tokens — if you allow notifications, Firebase Cloud Messaging issues a device token that we store with your notification choices so we can send the repair, comment, community, and nearby-hazard alerts you opted into. Notification contents carry hazard and post identifiers, never account identifiers. We do not use advertising IDs.
• Technical logs — short-lived auth and request logs used to keep sign-in working and to debug failures.

Where it is stored

Accounts and reports are stored in our Supabase project (hosted Postgres, Auth, and Storage). Report photos, videos, and uploaded avatars are stored in a public Amazon Web Services S3 bucket in the Mumbai region (ap-south-1) so the map can show them. New file names are random and do not contain your account identifier. Sessions use industry-standard tokens. The live map and these policy pages are served from potholes.app through Cloudflare.

What is public

The map is a public civic record. Hazard photos, locations, and status are visible without signing in. Named reports, comments, and posts show the display name and avatar from your profile.

If you post anonymously, the public record carries no name, avatar, or account identifier. We keep a private link between the post and your account so you can edit or delete it and so rate limits apply. Other people and in-app moderators cannot see that link; our database administrators can, and we look only to investigate abuse or answer a lawful request. Votes, confirmations, and likes are private: others see only the totals. Do not upload faces, number plates, or private interiors if you can avoid it.

Elected representatives

MLA names, parties, and constituency numbers come from the Maharashtra Legislature’s published Assembly membership (November 2024 roll). PMC and PCMC office-holders come from the January 2026 civic election results. That information is already public. Where an MLA’s office has published a WhatsApp or mobile number as a public grievance line, WhatsApp in the app can open a chat to that number. We do not collect unpublished private mobiles and we do not scrape contacts. Google Play and Play Protect treat public-office details of this kind as public data, not as a contacts scrape, provided they are sourced and disclosed — which they are, here and in the Terms.

Legal bases and sharing

We process this data to provide the map you asked for, to keep accounts secure, and to comply with requests you send us. We share data with:

• Google — only during sign-in, as described above.
• Supabase — to host auth, the database, and fallback file storage.
• Amazon Web Services — to store report photos, videos, and avatars (S3, Mumbai region).
• Google Firebase Cloud Messaging — device push tokens, only if you enable notifications.
• Infrastructure providers needed to serve potholes.app.

We may disclose information if required by law. We do not sell personal data.

If you write to us from the feedback page, we keep your name, email, and message so we can reply and fix bugs. We do not use that inbox for ads.

Retention and deletion

Account data stays until you delete your account or ask us to. Deleting removes your profile, sign-in, push tokens, votes, confirmations, likes, community memberships, waitlist and feedback entries, and avatar uploads. Your hazard reports, comments, and posts stay as anonymous civic records with no name or account identifier, because they describe a street condition, not a profile; if you choose to remove your reports as well, those reports and their photos and videos are deleted too. Files are removed from storage within a day. See Delete your data.

Children

Potholes.app is not directed at children under 13. Do not create an account for a child under 13.

Changes

If this policy changes in a material way, we will update this page and the date above. The same URL, https://potholes.app/privacy, is the policy linked from the Google sign-in screen and from the product homepage.