Scope
Divine Mandir is operated by Brahma Bhogar Arkaa Private Limited. This policy covers information used for website accounts, sign-in, Mandir contributions, contact, security and editorial review. The Mandir Submission Privacy notice provides additional detail about submitted Mandir information and optional photographs.
Accounts and sign-in
Sign in with Google
Google provides Divine Mandir with an identity token. The account system validates the token and uses the stable Google account identifier, verified email address and available display name to create or open an account. The implemented flow does not request a Google access token or refresh token and does not access Gmail, Google Drive, Calendar, Contacts or other Google account content.
Email sign-in
Divine Mandir processes the email address you enter and sends a six-digit, single-use code. The system stores a protected hash of the code rather than the readable code, together with its expiry, attempt count, purpose, timestamps and a one-way security hash derived from the connection address. The raw connection address is not stored in these account challenge records.
Authenticated email delivery necessarily provides the recipient address and message to the email service. One-time codes expire, can be used only once and should not be shared.
Profiles, login methods and account combination
An account may contain a display name, verified email identities, an optional mobile number, account status, sign-in timestamps and private links to Mandir contributions. An optional mobile number is not treated as verified unless the account explicitly says otherwise. Public SMS sign-in is not offered.
Verified login methods let you return to the same account. Matching email text alone does not automatically combine two accounts. Account combination requires recent authentication and confirmation using a verified login method. The system records a protected merge audit so ownership changes can be reviewed.
A login method can be removed only when another verified method remains. The current account pages do not provide a self-service account-deletion control; privacy and account-help requests can be sent to info@divinemandir.com.
Mandir contributions and browser drafts
Mandir submissions may include Mandir identity, location, visitor information, source links, optional photographs, submitter name, relationship to the Mandir, email address, WhatsApp or contact number, confirmations, review status and timestamps. An eligible signed-in submission or verified-contact claim may be linked privately to an account and displayed in My Contributions.
Contributor access does not grant staff, moderation, editorial or publication permission. Contributions remain subject to manual review. Contact details, account information and unpublished submissions are not automatically displayed on public Mandir pages.
If you choose to sign in from Suggest a Mandir, non-file form fields are temporarily saved in that browser tab's session storage so they can be restored after sign-in. The implemented draft expires after two hours and is removed after submission. Selected photographs are not included in the browser draft and must be chosen again.
Optional photographs
The implemented form accepts up to three JPEG, PNG or WebP photographs within its displayed size limits. Files are validated, resized and re-encoded before private storage, which removes embedded metadata such as location details. Photographs remain outside the public website directory and are not published automatically. Submit only photographs you took or have permission to share.
Cookies and security records
Divine Mandir uses session cookies for form security and signed-in sessions. The implemented production settings use Secure, HTTP-only and SameSite cookie controls. Account security controls include CSRF protection, single-use request tokens, rate limits, attempt limits, one-way connection-address hashes and short-lived authentication state.
Hosting and email providers may maintain technical service logs under their own operational and security practices. Private credentials and submission photographs are intended to remain outside the public website directory.
How information is used
Information is used to authenticate accounts, maintain profiles and login methods, restore short-lived drafts, link contributions, review submissions, respond to requests, deliver necessary messages, prevent abuse and preserve editorial and ownership records.
Information may be processed by infrastructure, database, identity and email providers that support these functions. The implemented Google sign-in flow is used for authentication and does not read other Google services.
Operator and contact
Divine Mandir is operated by Brahma Bhogar Arkaa Private Limited. For privacy questions, account help, or requests concerning your information, email info@divinemandir.com.
Retention and requests
No single fixed retention schedule has been approved for every account, security, audit, consent, contribution and photo record. This draft therefore does not promise automatic deletion after a particular number of days. A record-specific schedule must be approved before this policy is published.
To request access, correction, account closure, identity removal or deletion review, email info@divinemandir.com. The final policy must explain any applicable legal process and any records that must be retained for security, disputes, legal obligations or editorial and consent integrity.
Items required before publication
- Confirm the applicable privacy law and the process for access, correction and deletion requests.
- Approve a record-specific retention schedule, especially for expired OTP challenges and account-merge audit records.
- Confirm provider descriptions and any required processor or international-transfer disclosures.
Material changes should be reflected in the published policy before new data practices are enabled.