Privacy Policy

1.Who we are

PJ Connect is a residential-society management platform operated by Pandit Javdekar (“we”, “us”). It is supplied to housing societies, and each society administers its own residents, staff and records inside the platform.

This policy is written to India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”). You are the Data Principal. In its language, your society is the Data Fiduciary — it decides what records it keeps about you — and we are the Data Processor that runs the platform on its instructions. Questions about your own records are usually best raised with your society committee first, but you may come to us directly at any time.

2.How your account is created, and the consent we ask for

Nobody signs themselves up for PJ Connect. Your society’s administrator enters you — your name, mobile number and flat — or, for a family member, a primary member of your household does. That is how a society works, but it means your account exists before you have been told anything about it.

So, the first time you sign in, the app shows you a plain-language notice describing what we hold and why, and asks you to agree. Until you do, you cannot use the app. We record the date and time you agreed and the version of the notice you saw, and we can produce that record if you ever ask what you consented to.

You can withdraw that consent at any time from Settings → Privacy & consent. Because everything we hold is needed to provide the service, withdrawing it means you will be asked to review the notice again before continuing, or to delete your account instead.

If we materially change the notice, we ask you again rather than relying on your old agreement.

3.Information we collect

We collect only what the platform needs in order to work:

Exactly what we declare on Google Play and the App Store

The table below is the same declaration we file in Google Play's Data Safety form and Apple's App Privacy questionnaire, reproduced here so you can check the two against each other. Every item is linked to your identity and none of it is used for tracking.

We do not collect precise location. There is no advertising identifier, no analytics SDK and no third-party tracking in this app, and we do not track you across other apps or websites. There is also no third-party social login — you sign in with your own mobile number — so no account of yours is shared with, or created at, any other company.

4.Camera and photo permissions

The app asks for camera access only when you scan a visitor or gate QR code, or photograph a maintenance issue. It asks for photo-library access only when you attach an existing picture. Both are optional — declining them simply disables those specific features, and the rest of the app continues to work.

5.How your information is used

• To authenticate you and keep your session secure.
• To show you only what your role permits. Access is enforced on our servers, not merely hidden in the interface.
• To send notifications you have a reason to receive — a notice from your committee, a reply on your maintenance request, a visitor at the gate, or an emergency alert.
• To keep an audit trail of administrative actions, which societies are expected to hold.
• To investigate misuse and to protect the safety of residents.

We do not sell your personal information, and we do not use it for advertising or profiling.

6.Who can see your information

Visibility inside your society follows your role:

• Other residents see only what the directory is configured to show, and content addressed to them.
• Your committee and building manager see the records they need to run the society — the directory, maintenance requests, bookings and safety logs.
• Security staff see visitor and gate information, not your household records.
• We access data only to operate, support and secure the service.

Societies are strictly separated. Data from one society is never visible to another.

We share data with third parties only where necessary to run the service: our hosting and database providers, and the push-notification services operated by Expo, Apple and Google. We also disclose information where the law requires it.

7.How we protect it

• All traffic is encrypted in transit over HTTPS.
• Passwords are stored hashed, never in plain text. Sign-in tokens are hashed and rotated.
• On your phone, session credentials are held in the device’s secure keystore.
• Uploaded files are not publicly readable; every request is authorised and audience-checked.
• Sign-in attempts are rate-limited to frustrate brute-force attacks.
• Removing a resident requires a one-time code approved by a platform administrator.

No system is perfectly secure, but we take these measures seriously and review them regularly.

8.How long we keep it

We keep your information for as long as you hold a role in a society on the platform. When a resident is removed, the account is deactivated rather than erased immediately, so that the society’s historical records — who approved what, and when — stay intact.

If you delete your account, we remove your personal details as described below. Records that a society must retain for accountability, such as audit entries and safety logs, are kept in a form that no longer identifies you.

9.Deleting your account

You can delete your account yourself, from inside the app: open Settings → Delete my account and confirm. This removes your access to every society and erases your personal details. It cannot be undone.

What survives, and why. The notices, polls, documents, maintenance requests, bookings and gate records you created belong to the society’s own history — a poll result cannot be unpicked because one voter left. Those records stay, but your name is removed from them and they are shown simply as “Deleted user”. Nobody can get back from them to you.

If you no longer have the app installed, email us at support@pja.app from the address on your account, or include the phone number you registered with, and we will action the deletion.

Full details of what is erased and what your society must retain are on the account deletion page.

10.Children

A household may add its children to the flat so they can use the gate pass and receive society notices. Under section 9 of the DPDP Act a child’s personal data may only be processed with the verifiable consent of a parent or legal guardian, so the app enforces that:

• Adding any family member requires their date of birth. We use it only to work out whether that person is under 18.
• If they are, the primary member adding them — an adult of the household whose own identity we have already verified by one-time code to their mobile number — must explicitly confirm that they are the parent or guardian and that they consent.
• We store that confirmation as a dated record naming both the guardian and the child it covers, and the record is kept even after the account is closed so the society can show the consent was validly obtained.
• Without that confirmation the record is refused outright — a child cannot be added by omitting their age.

A guardian may withdraw consent at any time by removing the child from the household, which deletes the child’s record.

We do not use a child’s data for tracking, behavioural monitoring or advertising — none of which exists anywhere in this platform — and we never show a child targeted advertising, as section 9(3) requires.

11.Your rights as a Data Principal

The DPDP Act gives you the following rights, and the app implements each of them:

• To be informed (s.5). The notice you are shown at first sign-in, and this policy, tell you what we hold and why.
• Access (s.11). Your own record is visible in Settings. You may also ask us for a copy of everything we hold about you, including a summary of the consents you have given.
• Correction and completion (s.12). You can correct your name, photo and contact details in Settings; your society can correct your flat and role.
• Erasure (s.12(3)). Delete your account from Settings, as described above.
• Withdrawal of consent (s.6(4)). Available from Settings, and as easy as giving it was.
• Grievance redressal (s.13). See the section below.
• Nomination (s.14). You may nominate someone to exercise these rights on your behalf if you die or become incapacitated. Write to us and we will record it.

We respond to any of these requests within 30 days. We may need to confirm it is really you asking before we act.

12.If something goes wrong

If personal data is ever lost, disclosed or accessed without authorisation, we will inform the affected Data Principals and the Data Protection Board of India as section 8(6) requires, describing what happened, what it means for you, and what we are doing about it.

13.Grievance Officer and contact

If you are unhappy with how your personal data has been handled, write to The Grievance Officer at privacy@pja.app. Please tell us the mobile number on your account and what you would like us to do. We acknowledge every complaint and aim to resolve it within 30 days.

For matters specific to your own society’s records — who is on the directory, which flat you are listed against — your committee can usually resolve them faster.

For anything else, email support@pja.app.

If we have not resolved your complaint to your satisfaction, you may escalate it to the Data Protection Board of India.

14.Changes to this policy

If we make a material change we will update the date at the top of this page and ask you to review and accept the notice again the next time you open the app.