Privacy Policy.

The short version

We do not ask for your name. We use a stable visitor ID (stored in an httpOnly cookie) to keep your chat identity consistent across sessions. We hash your IP address (with a rotating salt) for rate limiting. Aggregate, cookieless audience and performance analytics are handled by Vercel. We store messages you send in the chat. We never sell any data. If you email us, we read the email. The longer version below explains each of these in detail.

Who runs this site

The site is operated by The Cockroach Janta Party (informally TCJP), an unincorporated political and satirical movement headquartered wherever the wifi works. The publisher of this page is the same entity. The email address for any privacy question is contact@thecockroachjantaparty.org.in.

What we collect from you

This site collects the following data:

1. Visitor ID (stable identifier). When you first visit the site, we set a first-party cookie called tcjp_vid containing a random UUID. This cookie persists for one year and gives you a consistent chat identity across sessions without asking you to log in. The cookie is httpOnly (JavaScript cannot read it) and marked SameSite=lax (cross-site requests cannot send it). If you delete the cookie, a new one is generated on your next visit.

2. Hashed IP address (for rate limiting). On ingest endpoints (the join form and chat messages), we hash your IP address using SHA-256 with a rotating salt. This hashed value is used only to enforce per-IP rate limits (e.g., max 3 join-form submissions per hour from the same IP). The raw IP is never stored. The hash cannot be reversed to recover your IP.

3. Aggregate analytics (via Vercel). Audience analytics (page views) and performance analytics (Core Web Vitals) are collected by Vercel Analytics and Vercel Speed Insights. These are cookieless and aggregated: Vercel reports patterns like “the Manifesto page was viewed 4,302 times this week” and page-load timings, but does not store personal data or build a profile of you. We do not run a first-party event database of our own. See Vercel's privacy documentation for how that data is processed and retained.

4. Chat messages. Messages you send in the global chat room are stored permanently on our servers. The message, timestamp, and your visitor ID (so we can attribute messages to a consistent name) are retained. Moderation may delete offensive messages, but the deletion is permanent.

5. Emails you send us. When you contact us through your email client (not a form), that email arrives in our inbox. We read it. We sometimes reply. If you include personal information, it sits in a standard email provider. We do not paste it into a public database. We do not pass it to third parties.

6. Member accounts (Sign in with Google).If you join the movement or sign in with Google, we receive and store your Google account's email address, display name, and profile photo to create and recognise your membership. We never receive your Google password. A signed, expiring session cookie (tcjp_msid, also httpOnly) keeps you signed in so you can use member features such as friends, direct messages, and groups.

7. Private messages (direct messages and groups). When members message each other privately — one-to-one or in a group — those messages are stored on our servers the same way public chat messages are (sender, body, timestamp). They are visible to the members of that conversation, and may be reviewed for safety as described under Moderation of content.

What we do not collect

• No PII in visitor tracking. We do not ask for your name, email, phone, or any identifying information when you browse.
• No advertising or cross-site cookies. Our analytics provider (Vercel) is cookieless, and we do not drop tracking cookies from Google, Facebook, or any ad network. Some external services we link to may set their own; we do not control those.
• No session tokens in client storage. We do not set login cookies you can read with JavaScript; our admin session token is httpOnly and opaque.
• No tracking pixels, no browser fingerprinting, no canvas fingerprinting, no session recording or replay.
• No third-party ad networks. We have no advertisers.
• No data brokers or resale. Your data is never sold, licensed, or shared with marketing platforms.

Moderation of content

To keep members safe and to enforce our community standards, site administrators may review and moderate messages — including private direct messages and group chats — and may hide messages or restrict members who break the rules. We do this only for safety, abuse prevention, and legal compliance. We never read private messages to sell, profile, or advertise to you, and we do not share their contents with third parties. Every moderation action (hiding a message, restricting a member) is recorded in an internal audit log, so the power stays accountable.

Data retention and deletion

Analytics data:Audience and performance analytics are held by Vercel and retained according to Vercel's policies. We keep no raw first-party event database.

Chat and private messages: Messages you send in the public room, in direct messages, and in groups are stored permanently unless removed by moderation. If you ask us to delete messages attributed to your visitor ID or membership, we will, within thirty days.

Visitor ID and IP hash: The cookies are not deleted by us. Clear your cookies to remove them from your browser.

Emails: We treat emails as private correspondence between you and the party. If you ask us to delete an email and remove it from our records, we will, within thirty days. If you want a copy of every email we have from you, we will send it. If you want to know whether we have any emails from you at all, we will check and tell you.

Children and minors

This site is not directed at people under the age of eighteen. If you are under eighteen, you still receive a visitor ID and are counted in Vercel's cookieless page analytics, but your identity cannot be inferred from that data (we do not ask for your name). If you have sent us personal information via email, we will not retain it if you request deletion.

Changes to this policy

If we change anything material here, the Last updated line at the top will move forward and we will flag the change in our public channels. The earlier version of this policy remains in the public git history of the site.

Legal basis (DPDPA / GDPR compliance)

Under India's Digital Personal Data Protection Act (2023), we process your data on the basis of consent (you use the site) and legitimate interest (site operation, abuse prevention, analytics). You have the right to:

• Access: Request a copy of all data we hold about you (visitor ID, membership details, and your chat, direct, and group messages).
• Deletion: Request that we delete your membership, your chat, direct, and group messages, and your email correspondence (within 30 days).
• Correction: Request correction of inaccurate data (e.g., if we have the wrong date for an event).
• Portability: Request your data in a machine-readable format.

Exercise these rights by contacting us at contact@thecockroachjantaparty.org.in with PRIVACY or DPDPA in the subject line.

Contact about privacy

contact@thecockroachjantaparty.org.in — put the word PRIVACY or DPDPA in the subject line and we will route it accordingly.