Nasha Mukt Yuva — Privacy Policy
Who we are
Nasha Mukt Yuva ("the app") is the citizen app of the Nasha Mukt Hyderabad Walk, part of the Nasha Mukt Bharat Abhiyaan (NMBA) movement against drug abuse. With it you can take the pledge against drug abuse, receive your certificate, follow campaign events, volunteer, and report a concern or share an idea.
The app is published and run by NITI AIDE SOLUTIONS PRIVATE LIMITED ("NitiAide", "we", "us"), CIN U63119TS2025PTC205025, Hyderabad, in support of the Nasha Mukt Hyderabad Walk, a public awareness initiative led by Shri G. Kishan Reddy, Minister of Coal and Mines, Government of India. NitiAide decides why and how your personal data is used, and is the organisation responsible for it under Indian law.
This policy covers the app on Android and iOS and the online services it connects to. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act").
Information we collect
We collect only what you give us through the app, plus a small amount of technical data needed to keep your sign-in secure. Only your mobile number is required; everything else depends on which features you use.
| What | When it is collected | Required? |
|---|---|---|
| Mobile number | When you sign in with a one-time password (OTP) | Yes |
| Your name | When you take the pledge or edit your profile; it is printed on your certificate | No |
| Language preference (English or Telugu) | When you choose it | No |
| District, mandal and village or ward | When you register as a volunteer or take part in an activity | No |
| Pledge record | When you take the pledge: the pledge text and version, the date, and your certificate number | Only to take the pledge |
| Consent record | Each time you agree to a notice: which notice, which version, and when | Only for the feature it covers |
| Volunteer details | When you register as a volunteer: category, skills, availability, any organisation you belong to, and the opportunities you join | Only to volunteer |
| Organisation details | When you register an organisation: its name, type, registration number, district, mandal, address, contact person's name and role, size, and what it offers | Only to register an organisation |
| Concerns | When you report one: the category, your description, the place you type in, up to three photos, and the activity it is about | Only to report a concern |
| Ideas | When you share one: the text you write | Only to share an idea |
| Push notification token | When you allow notifications: a code issued by Google or Apple that identifies your phone to their notification service, so we can deliver alerts to it. It carries no name or number | Only to receive notifications |
| Technical data | When you sign in or open a campaign link or QR code: the time, your device or browser type, and your IP address, which we store only in a scrambled (one-way hashed) form | Yes, for security |
Anonymous concerns. If you mark a concern as anonymous, it is stored with no link to your account at all. The only thing kept about the sender is the district in your profile, if you have set one, which is shared by everyone in that district.
Photos. Photos you attach are re-processed on our server. Hidden details that phones add to photos, such as GPS location, time taken and device serial number, are removed before the photo is stored.
What we do not collect. The app does not read your GPS location, contacts, call logs, messages or other files. It asks for no Aadhaar number, email address or payment details. It contains no advertising and no third-party analytics or tracking tools.
How we use your information
We use your information only to run the campaign and this app, and only for the purpose you gave it for. You give consent for each purpose separately, on the screen where you use that feature.
- Mobile number: to send you a one-time password, to sign you in, and to keep one account per number.
- Name: to show on your profile and print on your pledge certificate.
- District, mandal and village or ward: to connect you with activities and volunteer opportunities near you, and to count campaign reach by area.
- Pledge and certificate: to record your pledge, issue your certificate, and let you download it again later.
- Volunteer and organisation details: so campaign staff can review your registration, contact you about opportunities, and plan activities.
- Concerns and ideas: so campaign staff can read them and act on them.
- Technical data: to keep your account secure, prevent misuse such as repeated sign-in attempts, and count how many people open campaign links and QR codes.
- Notifications: to show campaign messages in the app's Alerts screen and, if you allow notifications, to deliver them to your phone as push notifications. You can turn them off at any time in your phone's settings.
We publish only totals, such as the number of pledges or volunteers in a district. These never identify you.
We do not use your information for advertising. We do not sell it, rent it, or use it to build a profile of you for any other purpose.
Who we share it with
We share your information only with the people and services needed to run the app, and never sell it.
- The campaign office. Authorised members of the Walk's campaign office and the coordinators of its events can see the records they need for their role, such as the volunteer registrations for their area. Each has a personal login, and their access is recorded.
- NitiAide's own team. Only the people who operate, secure and support the service can reach personal data, and only for that purpose.
- Amazon Web Services (AWS). Our servers, database and photo storage run on AWS in its Mumbai region, in India.
- Cloudflare. The campaign website and the published campaign photographs are delivered through Cloudflare's network, which sees the IP address of the phone or browser asking for them.
- SMS provider. Your mobile number is passed to our SMS provider only to deliver your one-time password, sent under our registered sender ID, NMYUVA.
- Google and Apple notification services. If you allow notifications, your phone's push token is held by Google (Firebase Cloud Messaging) or Apple (Apple Push Notification service), which deliver the alerts. They do not receive your name or mobile number.
- Google Maps and YouTube. The map screens load maps from Google, and campaign videos play through YouTube's player. These services receive technical details from your phone, such as its IP address, under Google's Privacy Policy. The app does not send them your name, mobile number or location.
- When you choose to share. If you tap Share, for example to invite a friend on WhatsApp or send your certificate, the content goes to the app you pick.
- When the law requires it. We may disclose information when required by law, a court order, or a lawful request from a government authority.
When you join a volunteer opportunity, the app shows you the coordinator's phone number so you can contact them. Your own details are visible only to authorised members of the campaign office.
Where your data is kept, how it is protected, and for how long
Your personal data is stored in India, on Amazon Web Services servers in Mumbai. Published campaign photographs are also served through Cloudflare's network so they load quickly.
How we protect it
- All traffic between the app and our servers is encrypted (HTTPS).
- The database and photo storage are encrypted at rest, and the database cannot be reached from the internet.
- Your sign-in is kept in your phone's secure storage (Android Keystore or iOS Keychain), not in ordinary app files.
- IP addresses are stored only in a one-way hashed form.
- Concern photos are private. Staff can view one only through a link that expires within minutes.
- Staff access is limited by role, and actions on personal records are logged.
How long we keep it
| Data | Kept for |
|---|---|
| One-time passwords | A few minutes, until they expire or are used |
| Your account, profile, pledge, certificate and registrations | While your account is active, and for 12 months after your last sign-in, unless you ask us to delete it sooner |
| Concerns and ideas | 24 months from when they were sent |
| Push notification token | Until you turn notifications off, sign out, or delete your account |
| Technical and security records | 12 months |
| Consent records | As long as the data they cover, and afterwards as long as the law requires us to show that consent was given |
| Database backups | 35 days, after which deleted data is gone from backups too |
When a retention period ends, we delete the data or remove everything that identifies you. We may keep anonymous totals, such as the number of pledges in a district.
App permissions
The app asks for as little access to your phone as possible, and only when you use the feature that needs it.
| Permission | Why | When it is asked |
|---|---|---|
| Internet | To connect to the campaign's servers | Always (Android grants this automatically) |
| Notifications | To deliver campaign alerts to your phone | Once, the first time you open the app signed in. Older Android versions allow it without asking. You can change it any time in your phone's settings |
| Camera (iPhone) | To take a photo for a concern you are reporting | Only when you choose to take a photo |
| Photos (iPhone) | To choose a photo for a concern you are reporting | Only when you choose a photo |
On Android, photos are picked with the system photo picker, so the app never gets access to your whole gallery. The app does not ask for your location, contacts, microphone, phone or SMS. You can withdraw any permission at any time in your phone's settings.
Your rights and choices
Under the DPDP Act you have the following rights, and exercising them is free.
- Access: ask for a summary of the personal data we hold about you and how we use it.
- Correction: correct or update your details. You can change your language yourself in the app's Profile screen; to correct your name once it is set, contact us.
- Withdraw consent: withdraw consent you gave for any feature. Withdrawing is as easy as giving it, and it does not affect anything done before you withdrew.
- Erasure: ask us to delete your account and personal data.
- Nominate: name another person to exercise these rights for you if you die or become unable to.
- Grievance: complain to our Grievance Officer (below) and, if you are not satisfied, to the Data Protection Board of India.
How to delete your account
- In the app: open Profile and tap Delete account.
- Or email tech@nitiaide.com from any address, giving your registered mobile number, or follow the steps on our Delete Account page.
We confirm your request by sending a one-time password to your registered number, then delete your account within 30 days. This removes your profile, pledge, certificate, volunteer and organisation registrations, and the concerns and ideas you sent under your name. Anonymous concerns cannot be found or deleted, because they carry no link to you. Deleted data disappears from our backups within 35 days.
We reply to every request under this section within 30 days.
Children
The app is open to people under 18. The campaign exists for young people, who are the most at risk, and the app is how they take the pledge and take part. Under the DPDP Act a person under 18 is a child, and we process a child's personal data only with a parent's or guardian's consent.
If you are under 18, a parent or guardian must agree to this policy for you before you sign in. The consent notice you accept in the app says so, the one-time code goes to the mobile number they provide, and they may ask us at any time to see, correct or delete what we hold about you. We collect no more from a child than from an adult, we do not track or profile anyone, and we show no advertising to anyone.
If you are a parent or guardian and believe we hold a child's personal data without your agreement, contact the Grievance Officer below and we will delete it.
Changes to this policy
When we change this policy, we update the "Last updated" date at the top. If a change affects how we use data you have already given us, we tell you in the app before it takes effect, and ask for your consent again where the law requires it.
Contact and Grievance Officer
For any question, request or complaint about your personal data, contact our Grievance Officer. We reply within 30 days.
| Grievance Officer | Reshmanth Jonnalagadda, Director |
|---|---|
| Organisation | NITI AIDE SOLUTIONS PRIVATE LIMITED (CIN U63119TS2025PTC205025) |
| tech@nitiaide.com | |
| Phone | +91 70568 64606 |
| Address | 4th Floor, 2/91/20, BP Raju Marg, Laxmi Cyber City, Whitefields, Kondapur, Hyderabad, Telangana 500084 |
If you are not satisfied with our response, you can complain to the Data Protection Board of India.