Privacy Policy — Janadesh Karyakarta

Effective date: 2026-04-23 Last updated: 2026-08-07 Application: Janadesh Karyakarta (Android package: com.netaboard.karyakarta) Publisher: Esha Media Research Limited (EMRL) Contact: compliance@eshamedia.com

This Privacy Policy describes how the Janadesh Karyakarta mobile application ("the App", "we", "us") collects, uses, stores, and shares information when you use the App as a registered field worker ("karyakarta") of a political party or elected representative ("the Principal").

The App is an authorised field-operations tool for booth-level party workers. It is not a consumer app and is distributed only to verified workers whose registration has been approved by the Principal's administrative team.

1. Who this policy applies to

• Party workers / booth volunteers who register and are approved as karyakartas under a Principal on the App.
• The App is operated by the Principal for its own field workers. Data you enter into the App reaches the Principal's Janadesh back-office and is held by the Principal as the organisation you work for. EMRL builds and runs the App and the back-office on the Principal's behalf under a Data Processing Agreement and acts on the Principal's instructions in respect of your personal data.

1A. The Principal–EMRL–karyakarta relationship

To make the data flows in the rest of this policy unambiguous:

• You (the karyakarta) are an approved field worker registered under a Principal.
• The Principal (a political party or elected representative) deploys the App for its own internal field operations and is the data controller of the personal data you enter — they decide why and how it is used. They access your data through the Janadesh dashboard.
• EMRL is the data processor that builds and runs the App, the back-office dashboard, the databases, and the supporting infrastructure under a written agreement with the Principal. EMRL does not access your personal data for its own purposes; it does so only to operate the App on the Principal's instructions and for the limited purposes set out in this policy (security, abuse prevention, error monitoring, and statutory compliance).

When this policy refers to "we" or "us", it refers to EMRL acting in that processor capacity. References to data being "stored", "used", or "retained" describe what EMRL does on the Principal's behalf inside the karyakarta–Principal–EMRL trust boundary; they are not transfers to a separate third party. The Principal may publish its own privacy policy that supplements this one.

2. Data we collect

2.1 Information you provide during registration

Collected on the 3-step registration screen before approval:

2.2 Information collected post-approval during field work

Collected across the 10-step booth onboarding and day-to-day operations:

• Booth demographics (aggregate): total voters, families, male/female/first-time voter counts, age distribution, occupation, income, land ownership, amenity access, migration, scheme beneficiaries, voter-roll health (EPIC issued, missing, duplicates), special-needs categories, women's turnout, media consumption, festivals, local issues. These fields describe the booth area, not individual named citizens.
• Influencers and opposition intelligence: names, community, alignment, role, activity levels of opinion leaders and opposition workers in the booth area.
• Election history: past election turnouts and margins by year.
• WhatsApp groups: group name, type, member count, leader mobile, invite link.
• Emergency contacts: police / hospital / fire / ward coordinator / AC officer names and phone numbers.
• Family records (door-to-door): head of household name, voter count, caste, address, mobile, political alignment, visit date, scheme needs, notes. Duplicate and missing voter flags.
• Grievances: citizen name, mobile, category, description, priority, GPS coordinates of the complaint location, escalation chain.
• SOS events: category, description, GPS coordinates, timestamp.
• Pulse reports: mood score, issue count, free-text note.
• Chunav Buddhi / Election Day data: voter intent, polling station status, turnout, incident reports with location.

2.3 Location data

• The App requests foreground fine and coarse location (ACCESS_FINE_LOCATION, ACCESS_COARSE_LOCATION) only when you tap a feature that needs it: SOS, grievance capture, or election-day reporting.
• The App does not run background location tracking and has no foreground-service declaration for continuous tracking.
• You can deny location permission; dependent features will be disabled but the rest of the App continues to work.

2.4 Photos and media

• READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE: used solely when you upload your registration photograph via the system image picker. The App does not scan, index, or read other photos on your device.

2.5 Device and technical data

• Crash reports and error stack traces (via GlitchTip / Sentry-compatible service), when enabled by the Principal. Stack traces may incidentally reference in-memory variable names but do not include Aadhaar numbers, bank details, or plaintext passwords.
• Product analytics events (via self-hosted PostHog), when enabled by the Principal: screen views, action events (familyAdded, d2dVisitLogged, grievanceSubmitted, pulseSubmitted, sosTriggered, onboardingStepCompleted), and your internal user ID for session continuity.
• Standard network metadata (IP address, timestamp, user-agent) recorded by our API servers for security and rate-limiting.

2.6 Permissions summary

3. How we use your data

• Verify you as a bona-fide karyakarta of the Principal.
• Assign you to the correct booth and show you the workload for that area.
• Route grievances and SOS events to the appropriate ward coordinator / AC officer.
• Produce aggregate booth reports for the Principal's management team.
• Diagnose app errors and improve stability (via crash reports and analytics).
• Comply with lawful requests from government authorities in India.

We do not use your data for advertising, for resale, for profiling unrelated to the Principal's political outreach, or to make automated decisions that produce legal effects for you.

4. Who can see your data — and why we do not consider it "shared with third parties"

The App has no peer-to-peer surface: nothing you enter is ever visible to other end users of the App. The only people who can see the personal data you enter are:

• The Principal's authorised administrators, through the Janadesh back-office dashboard. This is the entire purpose of the App. The Principal is the organisation you have registered to work for, not a separate recipient — your data reaching the Principal is the karyakarta-to-employer-style flow described in §1A, not a transfer to a third party.
• EMRL personnel, only to the minimum extent required to operate, secure, and support the App and the back-office on the Principal's behalf. EMRL acts as the Principal's processor under a written agreement; it does not use your personal data for any purpose of its own.

We rely on the following supporting infrastructure, all of which is part of the same operational stack and is not a third-party recipient under the Google Play Data Safety framework:

• Servers, databases, and object storage that hold App data are self-hosted by EMRL or the Principal in India.
• Crash reporting runs on a self-hosted GlitchTip instance, when the Principal enables it.
• Product analytics runs on a self-hosted PostHog instance, when the Principal enables it.

We do not:

• Sell your data to anyone.
• Share your data with advertising networks, ad-tech SDKs, data brokers, or third-party analytics SaaS.
• Transfer your data to any party outside the karyakarta–Principal–EMRL processor relationship described above, except as required by Indian law (see below).

The only situations in which your personal data leaves this trust boundary are:

• Lawful requests by Indian authorities — we disclose data only on receipt of a written, lawful order under Indian law.
• Statutory audit or legal proceedings affecting the Principal, where retention or production is mandated by law.

5. Storage, retention, and security

• Data is stored on servers hosted in India.
• Transport is encrypted with HTTPS.
• Your registration record is retained while you are an active karyakarta of the Principal and for up to 24 months after your disengagement, for audit and legal purposes. The Principal may retain aggregate booth data for longer as part of their electoral records.
• Local on-device data (photos pending upload, draft onboarding steps, bank details entered but not yet submitted) lives in device storage only and is cleared on logout or "Reset App Data".
• You are responsible for keeping your device secure and your login OTP confidential.

6. Your rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable Indian law you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or outdated data.
• Erase your data, subject to legitimate retention obligations.
• Withdraw consent for optional processing (e.g., analytics).
• Nominate a person to exercise these rights in the event of your death or incapacity.
• Grieve any issue with a data principal to our Grievance Officer (see Section 9).

Changing your phone number

You can change the mobile number on your karyakarta account from Profile → Change phone number:

1. Enter the new number and the last 4 digits of your Aadhaar (the same one on file) as a secondary factor.
2. Enter the 6-digit OTP we send to your current number.
3. Enter the 6-digit OTP we send to the new number.

On success, we update the phone number on your user and karyakarta_profile records, revoke every active session, and sign you out. The next login happens on the new number.

A 72-hour cooldown applies after a successful change to mitigate SIM-swap abuse. If you lose access to both numbers, contact the Grievance Officer (Section 9).

Account and data deletion

You can request deletion of your account and associated personal data by either of the following routes. No app install is required for either route.

• Web form — open https://auth.janadesh.app/delete-account?app=karyakarta from any browser. Sign in with the mobile number registered with the App and the OTP we send. After signing in, enter the last 4 digits of your Aadhaar (stored on your karyakarta profile as a secondary factor), type DELETE to confirm, and enter a second 6-digit OTP we send to the same number. Your account is flagged for deletion immediately and any active sessions are revoked. The web-form route is controlled by a server-side feature flag (OFF_APP_DELETE_ENABLED, default on); if the flag is disabled, email remains the only off-app route.
• Email — write to compliance@eshamedia.com from the mobile number registered with the App. Use this route if you have lost access to the registered phone or prefer not to use the form.

30-day grace window and restoration

Once your deletion request is accepted, we do not delete your data immediately. Instead we:

1. Mark your account as deleted (deleted_at = now()) on karyakarta_profile and booth_assignment, transfer the family records you logged to the next active karyakarta assigned to the same booth (or leave them for the ward coordinator if there is no successor), and revoke every active session.
2. Keep your personal data intact on our servers for 30 days. During this window you can log back in with OTP to restore the account — logging in automatically clears the deletion flag on your profile + booth assignment.
3. After 30 days, a daily background job permanently anonymises your account: your name becomes "Deleted user"; phone, Aadhaar last-4, bank details, reference, home address, photo, and GPS fields are cleared; booth geography (state / district / PC / AC / mandal / block / ward) is retained because it is aggregate data, not personal identity. This step is irreversible.

Family records you previously logged are not erased — they describe other citizens on your booth and are needed by the successor karyakarta and the Principal's office. The Principal may retain aggregate booth data for longer as part of their electoral records.

We acknowledge deletion requests within 48 hours and complete anonymisation within 30 days, subject to legitimate retention obligations (for example, ongoing legal proceedings or statutory audit records). Where the Principal's office holds derivative booth-level aggregates, those are de-identified and retained as part of electoral records.

To exercise any other right listed above (access, correction, withdrawal of consent, nomination), use the same email.

7. Children

The App is intended for use only by adults (18+) who are authorised field workers. We do not knowingly collect data from anyone under 18. If we learn that we have collected data from a minor, we will delete it.

8. Changes to this policy

We will publish material changes to this policy in the App's "About → Privacy Policy" screen and, where appropriate, notify you in-app. Continued use after a published update constitutes acceptance.

9. Grievance Officer

In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023:

Grievance Officer Esha Media Research Limited (EMRL) CIN: L72400MH1984PLC322857 Email: compliance@eshamedia.com Address: T 14-16, A Wing, 2nd Floor, Satyam Shopping Centre, Ghatkopar (E), Mumbai, India - 400077

We will acknowledge your grievance within 48 hours and resolve it within 30 days.

10. Contact

• General privacy questions: compliance@eshamedia.com
• Security reports: compliance@eshamedia.com