Privacy Policy

01Who we are

PASSA (“Pass it forward”) is a free community website where people with spare Garba and Navratri passes can give them to others. It is run by Vaivik, an individual based in India.

Under India’s Digital Personal Data Protection Act, 2023 (the DPDP Act), Vaivik is the Data Fiduciary responsible for your personal data on PASSA. You can reach us at admin@vaivik.in.

02What we collect

We try to collect as little as possible. This is everything:

• Mobile number: your account identifier, used to sign in. It is not verified by OTP or SMS.
• PASSA PIN: the 4-digit PIN you choose. We store only a salted one-way hash of it, never the PIN itself.
• Display alias: the public name you choose. Your real name is not required.
• Listing details: event name, city, area, night, number of passes, your terms (free, barter or open to offers) and any public note.
• Request details: your alias, how many passes you want, your message and any barter you offer.
• Contact method: the one way to reach you that you choose to share (WhatsApp, phone, Instagram, email or Telegram).
• Reports and contact-form messages: the category, your message, and an email or phone number if you choose to give one for a reply.
• Moderation records: a log of admin actions, such as hiding or deleting a listing or blocking a user.
• Basic technical logs: our hosting providers automatically keep standard logs (such as IP address, browser type and request times) to run and protect their services.

03What is public and what stays private

Anything you type into a public field, such as your alias or listing note, can be seen by anyone. Please keep contact details out of those fields.

• Public: your display alias, your listing details, and the listing’s live status (for example, whether a pass is still available).
• Never public: your mobile number, your PIN and your contact details.
• Your chosen contact method is shown only to the other person in a request, and only after the pass owner accepts that request.

04Why we use your data

We do not use your data for advertising, profiling or marketing, and we never sell it.

• To create your account and let you sign in.
• To show listings and requests, and let owners accept or decline.
• To share contact details between two people once a request is accepted, so they can arrange the hand-over.
• To keep PASSA safe: reviewing reports, removing content that breaks our rules, and blocking accounts that misuse the service.
• To reply when you contact us or make a complaint.
• To meet our legal obligations in India.

05Your consent

By creating an account and posting a listing or request, you consent to us using your data as described here. You choose what to put in public fields and which contact method to share.

You can withdraw consent at any time by deleting your account from the Account page or by emailing us. This doesn’t undo anything done before you withdrew, and without consent we can no longer run your account.

06Who we share it with

We do not sell or rent personal data. Our service providers may store or process data on servers outside India, only as permitted under Indian law. We share data only with:

• Convex, which provides our database and backend and stores the data described above.
• Netlify, which hosts the PASSA website and may keep basic technical logs.
• YouTube (Google), only if you press play on Garba Radio. We use YouTube’s privacy-enhanced (youtube-nocookie.com) player, but once a song plays, YouTube may still store data under Google’s privacy policy.
• The other person in an accepted request, who sees the contact method you chose to share.
• Authorities, where Indian law requires it, such as a valid order from a court or government agency.

07How we protect it

PINs are stored only as a salted one-way hash, so even we cannot read them. Contact details stay private until a request is accepted.

No system is perfectly secure. Because mobile numbers are not verified by OTP, we cannot guarantee that anyone is who they say they are. Please use a PIN you don’t use anywhere else, and never your bank or UPI PIN.

08How long we keep it

• Listings expire after their festival night and are no longer shown.
• Listing, request and contact data is deleted within 30 days after Navratri ends (Navratri 2026 runs 11–19 October, with Dussehra on 20 October), unless it is needed for an open safety report.
• Reports and contact-form messages are kept for up to 180 days.
• Your account (mobile number, hashed PIN and alias) stays until you delete it.
• Deleting your account from the Account page deletes your profile, listings and requests.
• Hosting providers keep technical logs according to their own retention practices.

09Your rights

Under the DPDP Act, you have the right to:

• Access: ask for a summary of the personal data we hold about you and how we use it.
• Correction: ask us to correct, complete or update data that is wrong or out of date.
• Erasure: ask us to delete your data. You can also delete your account yourself from the Account page.
• Withdraw consent: at any time, as easily as you gave it.
• Grievance redressal: complain to our Grievance Officer and get a response.
• Nominate: name someone to exercise these rights for you if you die or become unable to.

10Using your rights

Email admin@vaivik.in and mention the mobile number on your account. We may ask a simple question to confirm the account is yours before acting.

If you are not satisfied with our response, you can complain to the Data Protection Board of India.

11Age

PASSA is for people aged 18 and over. If you are under 18, please don’t create an account. A parent or guardian may use their own account to arrange a pass for a child, and is responsible for that arrangement.

12Changes to this policy

If we change this policy, we will update the date on this page. Continuing to use PASSA after a change means you accept the updated policy.

13Contact

Questions about privacy? Email our Grievance Officer, Vaivik, at admin@vaivik.in.