NyayKutumb न्याय कुटुंब
  • FEED
  • MAP
  • ABOUT
  • TERMS
  • PRIVACY
  • LEGAL DISCLAIMER
← BACK TO PLATFORM
Zero-Trace Whistleblower Privacy Guarantee

Privacy Policy & Security Protocol

How NyayKutumb guarantees 100% whistleblower anonymity through client-side HTML5 canvas scrubbing, zero IP tracking, and local token storage.

1. Zero-Log Architecture

Most platforms claim anonymity but track user IP addresses, browser user-agents, or persistent cookies. NyayKutumb was built from the ground up to eliminate all personal tracking:

  • No User Accounts or Registrations: You never create an account, provide an email address, or enter a phone number.
  • No IP Address Logging: Backend APIs process telemetry requests without recording or storing client IP addresses.
  • No Tracking Cookies or Ad Pixels: We use zero third-party tracking scripts, analytics cookies, or advertising trackers.

2. Client-Side EXIF & GPS Canvas Scrubbing

When uploading proof attachments (photos of receipt demand slips, stalled application acknowledgments, or notices), digital camera files embedded with hidden EXIF metadata (device IMEI, camera serial numbers, precise GPS latitude/longitude) pose a severe threat to whistleblower identity.

NyayKutumb solves this using a 4-step client-side canvas decontamination pipeline before any byte leaves your device:

1
Local Image Decoding: The file is read entirely inside your browser's local memory (FileReader).
2
HTML5 Canvas Re-Rendering: Raw image pixel data is drawn onto an in-memory HTML5 <canvas> element.
3
EXIF & GPS Striping: The canvas extracts pure pixel RGB data, completely stripping out all camera headers, location geotags, timestamp metadata, and device serial numbers.
4
Decontaminated Export: Only the sanitized pixel payload is submitted to the backend server.

3. Ephemeral Cryptographic Token Hashes

When you submit a report, your browser generates a random 256-bit cryptographic token hash (e.g., anon_83f9a21b). This token is stored only in your browser's local storage (localStorage). It allows you to upvote, edit, or track your own report while keeping your identity completely untraceable to server administrators or third parties.

4. Compliance & Data Rights Officer (DPDP Act 2023 / IT Rules 2021)

Under the Digital Personal Data Protection Act, 2023 and Rule 3(2) of the Information Technology Rules, 2021, citizens have the right to request deletion or redaction of any unauthorized personal data. Contact our designated Compliance & Data Privacy Officer:

Data Privacy Officer: Compliance & Rights Desk
Email: privacy@nyayasetu.org / compliance@nyayasetu.org
Statutory SLA: Acknowledgment within 24 hours; completion within 36 hours.
© 2026 NyayKutumb (न्याय कुटुंब). Open Source Civic Technology.
About Terms of Service Privacy Policy Legal Disclaimer