Privacy

01Who's responsible

How your city moves is a personal, non-commercial project run by Alabhya Vaibhav in Bengaluru, India. Write to alabhya.vaibhav1997+hycm@gmail.com about anything on this page. That address is also the contact for privacy complaints (grievances).

The site is run from India and built mostly for people in Indian cities, though anyone can use it. It's designed to follow India's Digital Personal Data Protection Act, 2023 by avoiding personal data wherever possible, which also keeps it simple for visitors elsewhere.

02What you enter stays on your device

The commuters you add, their names and times, and whether names are shown are saved in your browser's localStorage. They are not sent to me or to anyone else. The keys are:

• blr-moves-v2: your list of commuters (each city has its own list and key)
• hycm-city: the last city you picked, if you've switched city
• blr-moves-names: whether the "Show names" switch is on
• blr-moves-contrib: a random ID, only created if you opt into city-wide stats or suggest or vote for an area (see below)
• hycm-entry: the first city page you opened, which stays unlocked
• hycm-contributed: whether you've added a commute, which unlocks every city
• hycm-gate-seen: whether you've closed the "add yours" pop-up, so it doesn't keep coming back

03City-wide stats (only if you opt in)

When you add yourself there's a checkbox, off by default, labelled "Add me to the city-wide stats". If you tick it, this is sent to a database run by Supabase in Mumbai, India:

• your city, and the area you live in and the area you work in, chosen from that city's fixed list
• how you get there: walk, cycle, bike, car or public transport
• which days of the week you travel, if you picked them
• when you leave home and when you leave work, rounded to the nearest half hour
• your commute length, rounded to the nearest 5 minutes
• a random ID created in your browser. It isn't linked to you; it exists so you can delete what you shared.

Your name, or anything else you type, is never sent. Other visitors only see totals: how many people are at home, at work or on each route in each half hour, how many use each route and each way of getting there overall, and how many are on the road in each hour. Any number smaller than 3 is left out, and nothing is shown until at least five commutes exist. Nobody can see individual entries through the site.

Shared commutes are kept until you delete them (see Clear your data) or the project shuts down, at which point they're deleted. Like any server, Supabase may briefly keep technical logs, such as IP addresses, to run and protect its service. See Supabase's privacy policy.

Suggesting and voting for areas

If you suggest an area or vote in "Wanted areas", the city, the area name you typed, and the same random ID are sent to the same database. Area names are shown to everyone on the leaderboard, so only type a place name. Votes are counted per random ID so each browser votes once; nobody can see who voted for what. Suggestions that break the site's terms may be hidden. "Clear my data" below takes back your votes and removes suggestions only you voted for.

04Anonymous usage analytics

To see which parts of the site get used, I count visits and a few interactions with PostHog. It runs without cookies and without storing anything in your browser. Each page load gets a fresh random ID, so visits can't be linked together or to you.

Along with the events below, PostHog receives standard technical details that every browser sends: the page address, the site you came from, browser and operating system, screen size, and an approximate location (country or city) worked out from your IP address. The IP address itself is thrown away, not stored. It also records when you leave a page (to work out time on page) and how quickly pages load and respond (Core Web Vitals). Events are sent to this site's own address and forwarded to PostHog, which processes them on servers in the United States. Read their data policy.

Nothing you type into the app is ever sent. No names, exact times, or free text. Here is everything that's counted:

05Hosting

The site is hosted by Vercel. Like any web host, Vercel handles your IP address and browser details to deliver pages and protect against abuse, and may keep short-lived server logs. I don't use those logs to track anyone.

The site also uses Vercel's own Web Analytics and Speed Insights. Web Analytics counts page views (which page, the referring site, and the country, browser, operating system and device type). Speed Insights measures how fast pages load and respond on your device. Neither uses cookies. Vercel doesn't store your IP address for these; visitors are told apart for 24 hours by a hash of the request that is then discarded, so you can't be followed across days or other sites. Both are sent to this site's own address, not a third party's.

To suggest your city, the page asks the site's own server which city you're probably in. Vercel works this out from your IP address for every request it serves; the site's server reads only the city, matches it against the cities on the site, and sends back that one name or nothing. Your IP address and location aren't stored, logged or passed on by the site, and no other location service is used. The answer is kept in your browser's session storage until you close the tab. It's only a suggestion: it can be wrong (on mobile networks or a VPN, for example), and the site never moves you to another city without you choosing it, except that once you've added a commute, opening the home page takes you to your city.

06Chipping in with UPI

If you chip in from the support page, the payment happens entirely in your UPI app, between your bank and mine. This site never sees your bank details, UPI PIN or whether the payment went through. Like any UPI transfer, I'll see the name and UPI ID your bank shares with the payment. I use that only to keep my own records, and never publish it or add it to the site.

07No accounts, no cookies

There's nothing to sign up for, and this site sets no cookies. Fonts are served from this site, not from Google or another font service.

08Children

The site isn't aimed at children, and it doesn't knowingly collect personal data from anyone, including people under 18. If you're under 18, please don't type real names into the app, and ask a parent or guardian before opting into city-wide stats.

09Your rights and clearing your data

Because the site avoids collecting anything that identifies you, there's usually nothing on my side to look up, correct or hand over. Your list lives only on your device, and what you shared can't be traced back to you. You still have every right under India's data protection law. To use them:

• Delete: press the button below. It deletes anything this browser shared to the city-wide stats, then removes all of this site's keys from your browser. You can also clear "site data" for this address in your browser settings.
• Ask a question, correct something, or complain: email alabhya.vaibhav1997+hycm@gmail.com. I'll reply as soon as I can, and within 30 days.
• Escalate: if you're not happy with my reply, you can complain to the Data Protection Board of India.

After clearing, the home page shows the six sample commuters again.

10Changes

If this policy changes, the date below will change too, and anything important will be noted on this page.

Last updated: 27 September 2026.