Privacy policy

1.Who we are

On The Hills (onthehills.in) is a listings site for events in India's hill towns. It is operated by Ankur, an individual — not a registered company. Under India's Digital Personal Data Protection Act, 2023, that individual is the Data Fiduciary for the personal data described here.

Questions, corrections and grievances: hello@onthehills.in.

2.If you are just browsing

You do not need an account to read anything on this site, and we do not ask you to make one. We do not know who you are.

Until you answer the cookie bar, we set no analytics cookie at all. Google Analytics loads with every storage permission denied, which means Google receives an anonymous signal that a visit happened and nothing that identifies you or your device. If you press Accept, Google Analytics begins setting its usual cookies and we can then see things like which pages are read, roughly which region visitors come from, and whether they arrived from search. If you press Decline, it stays in the cookieless state permanently.

Separately, we use Vercel Analytics and Vercel Speed Insights to measure page performance. These are aggregate and set no cookies, so there is nothing to consent to and no way for us to single you out through them.

Our hosting provider keeps standard server logs, which include IP addresses, for a short period for security and debugging. That is a normal part of running a website and is not used to build any profile of you.

3.What we store on your device

Four small values are saved in your browser's local storage. These stay on your device — they are not sent to us and we cannot read them from our servers.

oth-theme remembers whether you chose light or dark. oth-analytics-consent remembers your answer to the cookie bar, so you are not asked again. oth-town remembers the last town you looked at, so the site opens where you left off. oth-spot-ring is a small interface state value.

Clearing your browser storage removes all four. The only consequence is that the site forgets your theme and town, and asks about cookies again.

4.If you list an event

Listing requires an account. We collect and store your email address, which must be verified before you can publish; your name, which is shown publicly as the host of your listings; and optionally a phone number, which is verified by you sending us a code over WhatsApp. Phone verification records include the number the code was issued for and the number it arrived from — that pairing is what stops someone claiming a number they do not control.

We also store what you submit: event details, and any poster image you upload. Your name is published alongside your listings. Your email address and phone number are not published. A WhatsApp number attached to an event is published as the contact route for that event, because that is the entire point of it — if you do not want a number to be public, do not attach it to a listing.

Signing in sets a session cookie so you stay logged in. It is strictly necessary for the account to function and is not used for analytics.

5.If you send us a poster

You can send a poster without an account. If you do, we store whatever contact details you give us — typically an email address or phone number — so we can come back to you if something on the poster is unclear.

The poster image is sent to Google's Gemini service, which reads the text off it and proposes structured details like the date, venue and price. This is an automated first pass only. Nothing is published on the strength of it: a person reviews every extracted listing before it goes live, and holds it back rather than guessing when a detail is uncertain.

6.RSVPs and WhatsApp

We do not run RSVPs and we do not record them. The RSVP button opens WhatsApp with a message already written to the organizer. Nothing about that is stored on our side — we never learn that you pressed it, and we hold no list of who is attending anything.

Once WhatsApp opens, you are in WhatsApp, and Meta's own terms and privacy policy apply to that conversation. We are not a party to it.

7.Who else processes your data

We are a small operation and rely on established providers rather than running our own infrastructure. Supabase hosts the database and handles sign-in, so account data lives there. Vercel hosts the site and provides the performance analytics. Google provides Analytics (only after you accept) and the Gemini service that reads posters. Brevo sends transactional email such as sign-in and verification messages.

Each processes data on our instructions for the purpose described. We do not sell personal data, we do not share it for advertising, and we run no advertising on this site.

8.How long we keep things

Account data is kept while your account exists. Phone verification codes are short-lived and expire on their own. Poster submissions are kept while the listing is live and for a reasonable period afterwards, because a past event remains part of a town's record.

If you ask us to delete your account, we remove your email address, phone number and name. Listings you published stay up with your personal contact details stripped out — a published event is a public record of something that actually happened in a town, and removing it retroactively would break links from guides and search results that point to it. If you want a specific listing taken down as well, ask and we will take it down.

9.Your rights

Under the Digital Personal Data Protection Act, 2023 you can ask us for a summary of the personal data we hold about you and what we do with it; ask us to correct anything inaccurate, or complete anything incomplete; ask us to erase your personal data, subject to the listing position described above; and nominate someone to exercise these rights on your behalf if you die or become incapacitated.

To exercise any of these, write to hello@onthehills.in. We will respond within a reasonable period and will tell you if we need something from you to confirm the request is genuinely yours.

10.Grievances

If you are unhappy with how we have handled your personal data, write to hello@onthehills.in with “Grievance” in the subject line. Because the site is operated by one person, that person reads and answers it directly.

If you are not satisfied with our response, the Data Protection Board of India can be approached under the Act.

11.Children

This site is not directed at children under 18 and we do not knowingly collect their personal data. Listing an event requires an account with a verified email address, and we expect account holders to be adults. If you believe a child has given us personal data, tell us and we will delete it.

Events listed here are run by third parties, and some may have their own age restrictions. Those are set by the organizer, not by us.

12.Changes

If we change what we collect or who processes it, we change this page in the same breath, and update the date at the top. We will not quietly start collecting something new and leave this page describing the old behaviour.