Privacy Policy

MandirBD is a community-focused digital platform operated from Bangladesh. We provide a mandir directory, Panjika and festival information, nearby discovery, community contributions, notifications, and related services through mandir.bd and the MandirBD mobile application. For personal information collected directly through these services, MandirBD determines why and how it is used.

This policy applies to visitors, registered users, volunteers, temple representatives, contributors, and people who contact us. A linked website, embedded provider, payment provider, or app store may process information under its own terms and privacy policy.

The information collected depends on the feature you use, the permissions you grant, and whether a backend feature flag enables that feature.

Account and identity information

• Name, email address, phone number, profile image, language, preferences, and Laravel account identifiers.
• Authentication information and tokens used for email/password, phone OTP, or Google sign-in. Password credentials are handled by the relevant authentication system and are not displayed to MandirBD administrators.
• Notification preferences, Firebase installation or messaging token, login and security events, and records needed to protect an account from abuse.

Information you submit

• Mandir suggestions and edits, addresses, coordinates, deity and festival details, opening times, contact details, opinions, reviews, check-ins, questions, support messages, and source notes.
• Photos, captions, copyright or consent information, and image metadata that remains after our upload pipeline validates, sanitizes, resizes, and converts images for publication.
• Temple-claim and representative-verification information, including organizational details and supporting documents, plus transaction references if an enabled payment feature is used.

Device, activity, and diagnostic information

• IP address, browser or app type, device and operating-system details, app version, language, time zone, referrer, request time, and security signals.
• Pages and features viewed, searches, taps, navigation, session and interaction events, approximate region, and campaign or referral information.
• Crash reports, stack traces, performance measurements, diagnostic logs, installation identifiers, and information about whether the app or device passes integrity checks.

Payment information

Payments and donations are collected only when the relevant feature is enabled. SSLCommerz and participating banks or payment networks process payment credentials. MandirBD may receive and retain the payer name and contact details, amount, currency, transaction identifier, status, gateway response, refund or dispute information, and audit records; we do not intend to store complete card or mobile-banking credentials.

• Provide accounts, authentication, the directory, Panjika, maps, nearby results, saved or offline content, contributions, and support.
• Review, verify, moderate, attribute, publish, correct, and maintain temple and community information.
• Send requested OTPs, transactional email, service notices, reminders, and push notifications, and remember your preferences.
• Understand usage, diagnose crashes, measure reliability, improve accessibility and performance, and develop useful features.
• Detect spam, fraud, impersonation, malicious uploads, automated abuse, and threats to users, mandirs, or our systems.
• Process enabled payments, keep appropriate financial records, resolve disputes, enforce our terms, and comply with applicable law.

Depending on the context and applicable law, we process information on one or more of these grounds:

• To provide a service you request or take steps at your request, such as creating an account, signing in, locating a nearby mandir, or submitting content.
• With your consent, such as device location, photos, notifications, or non-essential analytics where consent is required. You may withdraw consent through the app, browser, or device controls, without affecting earlier lawful processing.
• For legitimate operational interests, including securing the service, preventing abuse, maintaining accurate public information, fixing errors, and understanding aggregate use, where those interests are not overridden by your rights.
• To meet legal, accounting, regulatory, dispute-resolution, and public-safety obligations.

Temple names, addresses, coordinates, schedules, public contact details, festivals, photos, captions, reviews, contributor credit, and other accepted submissions may become public and may be indexed by search engines. Do not submit private contact details, identity documents, faces, or personal information unless you have authority and a valid reason to do so.

We may preserve an accepted factual contribution after account deletion so the public directory remains useful, but we may remove or anonymize its link to your account. Claim documents and non-public review notes are not intended for public display.

If you choose nearby discovery or a map feature and grant permission, the app may read precise or approximate device location to calculate distance, center a map, or suggest nearby mandirs. You can deny or revoke location permission in device or browser settings and search by division, district, upazila, or text instead.

A location attached to a temple submission or check-in may be sent to MandirBD. A device location used only to request nearby results is not presented publicly as your personal location, although our servers and map providers may receive network and request information needed to answer the request.

We use the following processors, infrastructure providers, and embedded services. The exact services that run depend on platform, configuration, consent, permissions, and feature flags.

These providers may process data in countries outside Bangladesh under their own infrastructure and retention arrangements. We configure access for service delivery, security, diagnostics, communications, or measurement—not to sell your personal information.

Our website and app use cookies, secure storage, local databases, cached files, SDK identifiers, and similar technologies. These may:

• Maintain login state, language, theme, onboarding completion, permissions, security tokens, and other essential preferences.
• Store a rolling offline copy of Panjika data and selected temple or image data so supported information remains available with limited connectivity.
• Measure use and diagnose faults through analytics, Clarity, Sentry, Firebase Analytics, and Crashlytics when configured and permitted.

Deleting app data, uninstalling the app, clearing browser storage, or changing browser and device settings can remove local information and may sign you out. More detail is available in our Cookie Policy

We do not sell or rent personal information. We disclose it only as reasonably necessary:

• To service providers listed above that host, secure, authenticate, measure, diagnose, communicate, map, store media, or process an enabled transaction for us.
• To authorized MandirBD administrators, moderators, and reviewers who need it to review submissions, resolve support requests, verify claims, prevent abuse, or operate the service.
• To a mandir or its authorized representative when necessary to verify a claim, correct a listing, investigate an issue, or complete a user-requested interaction.
• When required by applicable law, a valid legal process, or a good-faith need to protect rights, safety, property, users, mandirs, or the public; or as part of a merger, reorganization, or transfer with appropriate notice and safeguards.

Public content is shared by its nature. Aggregated or de-identified statistics may be published or shared when they are not reasonably capable of identifying you.

We retain each category only for as long as reasonably needed for the purposes above, subject to legal, security, backup, dispute, and provider requirements. In particular:

• An account-deletion request enters a 30-day grace period. Signing in during that period cancels the request. After the period, the Laravel account is deleted or anonymized through our scheduled process unless a lawful exception applies.
• IP addresses attached to community contributions are scheduled for removal after 90 days. Security logs may be held longer when needed to investigate active abuse or an incident.
• Accepted public temple facts, media, and community contributions may remain after account deletion, with account attribution removed or anonymized where appropriate.
• Claim evidence, support records, and payment, refund, fraud, tax, or audit records may be retained for the period reasonably required to verify authority, resolve disputes, prevent abuse, and meet legal or financial obligations.
• Backups and provider-held data are deleted or expire on their normal secure rotation and service-specific schedules. Data already aggregated or de-identified may be retained without an account link.

Subject to identity verification and applicable law, you may ask us to:

• Provide access to or a portable copy of personal information associated with your MandirBD account.
• Correct inaccurate account information or report an inaccurate public listing.
• Delete your account and associated personal information, subject to the retention exceptions described above.
• Withdraw optional permissions or consent, disable push notifications or location access, and manage cookies or analytics controls available in your browser, device, or app.
• Object to or restrict certain processing where applicable, or ask a question or make a privacy complaint.

We use reasonable technical and organizational safeguards appropriate to the service, including encrypted transport, access controls, token-based authentication, application-integrity and bot checks, upload validation and sanitization, media processing, rate limits, monitoring, and backups.

No online system is completely secure. Keep your device, OTPs, passwords, and recovery methods private; use an up-to-date app and browser; and contact us promptly if you suspect unauthorized access.

MandirBD is operated from Bangladesh, while some providers use regional or global infrastructure, including facilities outside Bangladesh. This means personal information may be processed in jurisdictions with different data-protection rules.

Where required, we rely on provider contractual and security measures and limit transferred information to what is reasonably needed for the service. Provider privacy notices explain their locations and safeguards in more detail.

MandirBD is a general-audience service and is not designed to collect personal information from children without appropriate involvement of a parent or legal guardian. A person who cannot legally consent to these terms should use account or contribution features only with guardian authorization and supervision.

Do not upload a child's identifiable photo, contact information, precise location, or document without lawful authority and appropriate consent. If you believe a child provided personal information improperly, contact us so we can review and remove it where appropriate.

We may update this policy when our services, providers, or legal responsibilities change. We will publish the revised version and date here and, for a material change, provide a proportionate notice in the service or through available contact information.

For access, correction, deletion, provider-data questions, complaints, or any privacy concern, contact us. We may request reasonable information to verify identity and protect the account before acting.