Effective Date: September 21, 2026 · Last Updated: October 26, 2026 · Version 1.1.6+ · University of Hyderabad (UoH)
Governing Legal Framework (India)
Digital Personal Data Protection Act, 2023IT Act, 2000 (Section 43A & 79)SPDI Rules, 2011Intermediary Guidelines, 2021
1. Overview & Scope
Loky ("the App", "we", "us", or "our") is an independent campus companion platform built for students and researchers at the University of Hyderabad (UoH), Telangana, India. Loky provides campus shuttle schedules, an academic holiday calendar, interactive campus navigation, private attendance tracking, study notes, and a peer-to-peer student marketplace.
We are firmly committed to user privacy, data minimization, and total transparency. This policy sets out how we handle your information in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and Indian information technology laws.
2. What Is Collected vs. What Is NOT Collected
We believe in data minimization: we collect only what is strictly required to run the specific features you use.
What We Collect
University Email (used for secure sign-in and verifying UoH student status).
Name & Student Roll Number (e.g. 24MCPC15) for profile identity and cloud restore.
Marketplace Listings: Item titles, asking prices, photos, and descriptions you choose to publish.
Protected Seller Contact: Phone number uploaded when posting an item, stored securely in an isolated database.
Encrypted Attendance & Timetable Cloud Backup: Synced to the server using client-side AES-256 encryption so you never lose attendance records when changing or resetting devices.
Encrypted Cloud Notes Backup: Synced under client-side AES-256 encryption so your study notes remain safe and confidential.
What We DO NOT Collect
NO Payment / Financial Details: No UPI PINs, bank accounts, or debit cards. All marketplace transactions are peer-to-peer outside Loky.
NO Background Location Tracking: Real-time GPS is accessed only while actively viewing the map or navigating. Never logged, never tracked in background.
NO University Portal Passwords: We never ask for or access your university e-governance credentials.
NO Unencrypted Personal Records: Attendance logs, timetables, and notes are always encrypted with AES-256 before cloud transmission.
NO Sharing with University Administration: Attendance logs are strictly private to you; never reported to university administration or professors.
NO Data Selling: We never sell, rent, or trade your personal information with third-party advertisers or data brokers.
3. Purpose & Legal Grounds for Processing (DPDP Act, 2023)
Under Section 4 and Section 6 of India's Digital Personal Data Protection Act, 2023, personal data is processed solely for specified, lawful, and necessary purposes:
Account Authentication & Verification: Verifying authentic student affiliation with the University of Hyderabad.
Encrypted Cloud Backup: Safeguarding your attendance logs, timetable schedules, and study notes with client-side encryption.
Campus Peer-to-Peer Marketplace: Enabling students to publish used books, cycles, and study essentials, while safeguarding seller contact details.
Cross-Device Synchronization: Enabling seamless restoration of your profile, encrypted attendance, and notes across devices.
Campus Navigation: Calculating live walking directions between university schools, hostels, and libraries locally on your device.
Platform Security & Abuse Prevention: Preventing duplicate fraudulent listings, spam, and malicious system tampering.
4. Location Data & Permissions
Foreground-Only Location Access: Loky requests device location permissions (ACCESS_FINE_LOCATION / ACCESS_COARSE_LOCATION) strictly when you tap the GPS button on the map or request turn-by-turn navigation.
Your coordinates are processed in device RAM to position you on the campus vector map and are immediately discarded. Campus map base tiles are pre-bundled in a local offline SQLite database (~19.9 MB), allowing full map interaction with zero location logging or external tile server tracking.
5. Third-Party Service Providers
We work with industry-standard, ISO-certified infrastructure partners who act as secure data processors:
Google Firebase (Alphabet Inc.) — Industry-standard user authentication, secure token management, app performance monitoring, and push notifications via Firebase Cloud Messaging (FCM). (Firebase Privacy)
Supabase (Supabase Inc.) — Cloud PostgreSQL database and media storage for marketplace items and encrypted user backups with Row-Level Security (RLS) policies. (Supabase Privacy)
Google AdMob — If display advertisements are enabled, ad delivery operates under Google's non-personalized ad guidelines. (Google Ads Policy)
Esri ArcGIS Online (Environmental Systems Research Institute, Inc.) — High-resolution satellite imagery tiles for real-time aerial view. Operates with anonymous geographic tile queries without transmitting user personal information. (Esri Privacy Policy)
6. Security Standards (Section 43A, IT Act 2000)
Loky implements comprehensive technical and organizational safeguards:
Client-Side AES-256 Encryption at Rest: Timetables, attendance records, and personal study notes are encrypted client-side using strong AES-256 encryption before upload, ensuring zero-knowledge confidentiality on the server.
Encryption in Transit: All API requests and cloud sync interactions enforce strict HTTPS / TLS 1.3 protocol encryption.
Database Row-Level Security (RLS): Granular database access policies ensure that only the authenticated user can access their own encrypted records.
Protected Seller Contacts: Contact telephone numbers are stored in a partitioned table (listing_contacts) and are never exposed to search engine bots or automated scrapers.
Password Protection: Credentials are cryptographically salted and hashed via Firebase Authentication; plain-text passwords never touch our servers.
7. Data Retention & Account Deletion (Right to Erasure)
Under Section 12 of the DPDP Act 2023, you have the complete right to erasure and to be forgotten:
Marketplace Listings: Sellers can delete any active or completed listing at any time directly through the app.
Complete Account Erasure: You can permanently wipe your account, cloud profile, encrypted attendance records, encrypted study notes, and active marketplace items at any time:
In the App: Open Options / Settings → Account → Delete Account.
Upon confirmation, all cloud-associated records are permanently purged from our databases without undue delay.
8. Your Rights as a Data Principal (DPDP Act, 2023)
Under the laws of India, every user of Loky enjoys the following statutory rights:
Right to Access: Inquire whether we process your personal data and receive a summary of processed data.
Right to Correction & Completion: Correct inaccurate, misleading, or outdated personal information.
Right to Erasure: Request complete deletion of personal data no longer necessary for the purpose collected.
Right of Grievance Redressal: Readily register and have grievances addressed by our Grievance Officer.
Right to Nominate: Nominate another individual to exercise your privacy rights in the event of incapacity.
9. Grievance Redressal & Statutory Contact
In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 13 of the Digital Personal Data Protection Act, 2023, the details of our designated Grievance Officer are provided below: