Last updated 27 September 2026
This policy covers the CaseTrack India website and the CaseTrack India Android app, which are the same product — the app displays this website. It describes what the app actually stores today, not what it might store one day.
Cases, searches, the timeline on every case and the sources behind it are all public. No account is needed to read any of it. Two things still happen without one: the words you type into search are sent to Google Gemini to be interpreted, and a case request you submit is turned into web searches run by serper.dev. Neither is tied to a person. Everything further down begins only when you create an account.
Your email address and display name; an optional profile picture, home state and preferred language; the cases you follow and save; your notification preferences; the dates you visited, which is what the streak and the leaderboard are counted from; anything you write, meaning comments, case requests, reports and feedback; the readers you have blocked, and when you accepted the community rules; a record of which cases you have viewed and shared; and, if you turn notifications on, the push subscription your browser issues for this device.
To sign you in, to build your feed from what you follow, to send the alerts you asked for, and to show the leaderboard. There is no profiling for advertising, because there is no advertising.
You may sign in with Google or with an email address and a password. A password you type is sent over an encrypted connection to be checked by Supabase, which handles authentication; this app never stores it. Signing in with Google supplies your name, email address and profile picture, and nothing else. The two routes reach the same account when the email address matches. The sign-in screens load Google's sign-in button from accounts.google.com, so Google receives that page request even if you then sign in with email.
Alerts inside the app, under Alerts, are on when you create an account, and each type can be switched off separately in your profile. Push notifications to a phone or computer are off until you turn them on for that device, and they wait out a quiet window overnight. Web Push is delivered through the push service your own browser chooses — Google's for Chrome, Apple's for Safari — which necessarily learns that a message was sent to your device, though not what is in it.
Contributing is entirely optional and nothing in the app is behind a payment. Contributions are processed by Razorpay on Razorpay's own pages. No card or payment detail is ever typed into this app or stored by it, this app receives no record of a payment, and a contribution is never linked to your account. The support page is the only page that loads anything from Razorpay.
Supabase hosts the database and handles sign-in. Google handles sign-in if you choose that route. Google Gemini interprets what you type into search, answers questions about a case, writes the plain-language summaries and translates case text. serper.dev runs the web searches the engine and your case requests are built on. Razorpay handles contributions if you make one. Your browser's push service delivers notifications if you enable them. Resend delivers operational alerts to the people who run this app. Cloudflare Turnstile checks that a sign-up, sign-in or password-reset form is being used by a person, and sees your IP address and browser details when one of those pages loads. That is the complete list. There is no advertising network, no analytics product and no tracking script anywhere in this app, and fonts are served from this site rather than from a third party.
Your data is never sold, rented or shared for anyone else's marketing. It is not used to train any model. The only disclosure that would ever be made is one the law requires.
For as long as your account exists. When you delete it the live record goes immediately, with no waiting period. Encrypted nightly backups of the database are kept for 14 days before they rotate out, so a copy can remain in those archives for up to that long.
You can delete your account yourself, at any time, from your profile. It is immediate and it cannot be undone. The account-deletion page sets out exactly what is removed and the one thing that is kept.
Everything travels over an encrypted connection. Each reader's rows are isolated in the database itself rather than only by the application, so one account cannot read another's follows, saves or notifications even if the app were wrong.
This app reports on real criminal proceedings and is not directed at children. Accounts are not knowingly created for anyone under 13, and any such account found is deleted.
If this policy changes, the date at the top changes with it. A change that materially widens what is collected will be announced in the app rather than made quietly.
CaseTrack India is published independently. Write to the address below with any question about your data or this policy. If you are signed in, the feedback page in the app reaches the same people.