FixMyCity — Privacy Policy
Last updated: 2026-09-14
Applies to: the FixMyCity mobile application (com.mycity.orrgo) and fmc.orrgo.com
This is a working draft prepared alongside the code. It reflects what the software actually does as of this date — every claim below is traceable to a specific behaviour in the codebase. Have it reviewed by a lawyer qualified in Indian data-protection law before publishing. Google Play requires a live URL for this document before the listing can go live.
Who we are
FixMyCity is an independent civic issue reporting platform for Bengaluru. It is not a government service and is not affiliated with, endorsed by, or operated by any government body.
- Data Fiduciary: Suvidha Technologies
- Registered address: Bengaluru, 560077
- Contact: privacy@orrgo.com
- Grievance Officer: not published — see the contact page — grievance@orrgo.com — required under the Information Technology (Intermediary Guidelines) Rules, 2021, and under the Digital Personal Data Protection Act, 2023. Must respond within 15 days.
What we collect, and why
| Data | Why | Kept |
| Google account email, name, profile picture | To create and identify your account | Until you delete your account |
| Phone number (optional) | A contact detail you may add to your profile, for future complaint filing. Not used to sign in, never displayed on a report | Until you delete your account |
| Device identifier (hashed) | To recognise your devices and revoke a lost one | Until the device is removed |
| Device integrity verdict | To distinguish real handsets from emulators submitting fabricated locations | 30 days |
| Precise location of a report | To attribute the issue to the correct ward and authority | See "Location" below |
| Photographs you capture | The evidence in a report | Until the report is removed or your account is deleted |
| Photo EXIF (GPS, capture time) | To check the photo was taken where and when the report claims. Read on your device and not carried into the uploaded image | Metadata retained with the report; not in the served file |
| IP address | Rate limiting, abuse prevention, security logs | 30 days |
| Notification token | To tell you when your report is updated | Until you sign out or uninstall |
We do not collect contacts, calendar, SMS, call logs, browsing history, or advertising identifiers. We do not use advertising or third-party analytics SDKs.
Location — read this part
This is the most sensitive thing we handle, and we treat it differently from most apps:
- We capture your precise coordinate when you file a report, because a pothole two streets away is a different pothole.
- We never publish it. What appears on the public feed and map is the report's location snapped to the nearest road centreline — accurate enough to walk or drive to, but a public road, never the doorway the photo was taken from. Where no road is close enough, we publish a ~1.2 km grid cell instead.
- Reading screens (feed, map, search) work from an approximate location. Only filing a report uses the precise one.
- Location is collected only while the app is in use. There is no background location collection.
Who we share it with
- The responsible government authority, when you choose to file a report with them. We send the category, the road-level location, the coordinates, the photograph and the supporter count. We do not send your name, email or phone number.
- Service providers who process data on our behalf under contract: cloud hosting, object storage, SMS delivery, push notification delivery, error reporting, and automated image safety screening.
- Law enforcement, only on a lawful, specific written order.
We do not sell personal data. We do not share it for advertising.
Where your photographs are stored
Naming this specifically, because you could not infer it from using the app and the provider's brand has nothing to do with civic reporting.
Your photographs are uploaded from your device straight to an image storage and delivery service operated by BuddyLoan (nudge.buddyloan.in for upload, media.buddyloan.com for delivery). They do not pass through our own API. They are encrypted with AES-256-GCM before they leave your device, and decrypted again when the app displays them.
The rest of your report — the location, the answers, your note — is held on our own infrastructure and is not sent to that provider.
If you donate
Donations are optional and change nothing about your account or your reports.
Payment is handled entirely by HDFC SmartGateway, on their page. We never see and never store your card number, UPI ID, or bank credentials — what comes back to us is a reference, an amount, and whether it succeeded.
If you give us a name or an email address on the donation form we keep them with that record, so we can send a receipt and answer questions about the payment. Both are optional; a donation without either is a perfectly good donation. We do not add a donor's email to any mailing list, because we do not have one.
Donation records are kept as long as the law requires us to keep financial records, which is longer than the rest of your data. Deleting your account does not delete them, for the same reason.
Public content
Reports, photographs, captions, comments and support counts are public. Anyone can see them, in the app and on the web. Your display name is shown; your email and phone number never are. Do not photograph identifiable people, number plates or house numbers if you would not want that published.
Automated processing
- Uploaded photographs are screened by an automated content-safety service before publication. A photograph may be held for human review or refused.
- Reports are scored for location plausibility using the photo's metadata, the device's integrity verdict and the reported accuracy. A low score holds the report for review rather than publishing it immediately.
- You can contest either outcome by writing to the grievance officer.
Your rights (DPDP Act, 2023)
- Access — Settings → Download my data returns everything we hold, as JSON.
- Correction — edit your display name in the app; write to us for anything else.
- Erasure — Settings → Delete my account. This removes your photographs, detaches your reports from you, deletes your precise coordinates, comments and notifications, and revokes every session. The civic record of an issue survives anonymously, because other people have supported and commented on it and ward statistics are built from it.
- Grievance redressal — contact the grievance officer above. If unsatisfied, you may complain to the Data Protection Board of India.
- Withdraw consent — Settings → Withdraw consent. Note that you cannot use the reporting features without it.
Children
FixMyCity is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, contact the grievance officer and we will remove it.
Security
Credentials are stored in the device's hardware-backed keystore. Traffic is HTTPS only — the app refuses cleartext connections. Sessions can be revoked individually or all at once from Settings. Refresh tokens rotate on every use, and a reused token invalidates the whole session family.
Changes
We will update the "last updated" date and, for material changes, ask you to accept the new version in the app before you continue.