Privacy Policy

Spectre is a proactive crime-intelligence assistant built for the Karnataka State Police x Hack2Skill KSP Datathon 2026. In the demo environment, the Spectre team acts as the data fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). For official deployments by a police agency, that agency is the controller and Spectre acts as a data processor under written agreement.

• Account data: full name, official email, badge number, rank, district, station and (optional) avatar.
• Authentication data: Google or Apple sign-in identifiers (no passwords stored when using OAuth), email + password for the email flow, hashed 2FA challenges and a flag indicating whether face enrollment was completed.
• Usage telemetry: minimum required to operate — last sign-in time, feature opened, error logs (no FIR content in error logs).
• Operational data: in the demo build this is synthetic Karnataka-styled FIR data. In production, this would be FIR metadata, zone coordinates and case-folder notes you choose to record.
• Cookies & local storage: session tokens, consent flags, theme. See our Cookie Policy.

We process personal data on the lawful basis of consent (section 6) for account creation and on the basis of legitimate use (section 7) for performance of statutory policing functions in production deployments. You may withdraw consent for non-essential processing at any time — see Section 8.

Officer data is used only to (a) authenticate the user, (b) display the personalised dashboard, (c) deliver MFA codes and SMS alerts, (d) record audit trail of dashboard actions. We do not sell, share or commercialise officer data.

• Lovable Cloud (Supabase): authentication, database, RLS-protected storage.
• Resend: transactional email delivery (verification, MFA codes).
• GatewayAPI: SMS alert delivery to officer phone numbers.
• Google Maps / OpenStreetMap (Carto): map tiles and geocoding.
• Google AI / Gemini via Lovable Gateway: generation of insight briefings (we send only aggregated, non-personal numeric features — never FIR text).

Account data is retained while your officer account is active and for 90 days after deactivation, after which it is anonymised. MFA challenge codes are retained for 10 minutes. Session tokens follow Supabase defaults (default expiry 1 hour, refresh up to 30 days).

Row Level Security is enabled on every user-data table. Service-role keys are server-only and never exposed to browser bundles. All web traffic is HTTPS-only. 2FA is mandatory; face enrollment is optional in the demo build and mandatory in production deployments by KSP guideline.

Under the DPDP Act 2023 and IT Act 2000 you may (i) access your data, (ii) request correction or erasure, (iii) withdraw consent for non-essential processing, (iv) nominate another person to exercise rights in event of incapacity, (v) file a grievance with our Grievance Officer or the Data Protection Board of India.

Spectre Team — grievance@spectre.local (demo). For deployments by a police agency, the grievance officer is appointed by that agency.

Spectre is an internal policing tool not intended for, and not made available to, any person under 18 years of age.

We will post material changes here with a revised "Last updated" date and, where appropriate, notify officers via in-app banner before the change takes effect.