Privacy, in plain language.

This policy covers the ACRES website and its demonstration workflows. It does not cover any government land-record portal or public authority because ACRES does not connect to those systems.

Every parcel, owner, phone number, application and document supplied with the demo is invented. Any resemblance to a real person or holding is coincidental.

• What you type: situation descriptions, parcel-search text, form answers and document-checklist responses.
• What you select: state or union territory, language, parcel, service and workflow choices.
• Demo workspace activity: conversations, synthetic applications, status steps, generated documents and audit events.
• Demo sign-in: a seeded fictional phone number is matched to a fictional person. The fixed demonstration OTP is not sent to a phone.

ACRES does not ask for or store an Aadhaar number, perform Aadhaar authentication, validate PAN, complete eKYC, access DigiLocker, or process a real payment.

ACRES uses first-party storage to keep the demonstration usable:

• A signed, HTTP-only session cookie keeps a demo persona signed in for up to 30 days.
• An opaque, HTTP-only browser token keeps anonymous conversation history connected to one browser for up to 30 days.
• State and language preferences are stored for up to one year.
• A selected parcel is stored briefly so it can follow you into a service workflow.
• Your light or dark theme preference is stored locally in the browser.

These features are functional, not advertising cookies. The current code does not include advertising trackers or an ad-personalisation system. Blocking cookies may prevent sign-in, recent conversations and workflow continuity from working correctly.

When AI is configured, ACRES may send the text you enter to OpenRouter for processing by an OpenAI model. The model helps identify a state and service, interpret parcel search text, or produce structured draft output. If the AI request fails or is not configured, the product uses deterministic fallbacks where available.

AI does not approve an application, determine legal rights, or authorise a change to a record. Rules perform checks and a named officer role records decisions in the demo. Information sent to an external AI provider is also subject to that provider's data handling; do not submit real personal, confidential or legally sensitive information.

The demonstration uses PostgreSQL for workspace records such as people, parcels, conversations, applications and audit events. Redis may temporarily cache workspace and service results to make pages load faster; PostgreSQL remains the source used when the cache is unavailable.

Hosting, database, cache and AI providers may process technical information needed to deliver their services. ACRES does not transmit a filing to a government office or update a live government land record.

This prototype does not yet have a formal record-retention schedule. Database entries may remain until the demonstration environment is reset or an operator removes them. Cached copies expire automatically according to short technical cache periods, but clearing a cache does not delete the underlying database entry.

Signing out removes the session cookie; it does not automatically erase conversations or synthetic applications already saved in the workspace. You can remove an individual recent conversation from the sidebar. You can also clear this site's cookies and local storage in your browser.

You may use the browsing parts of ACRES without signing in. You can sign out, clear browser storage, and avoid entering free text. For a request to inspect or remove information associated with a demo session, email hello@acres.in. Include only enough detail to find the demo session; never send an Aadhaar number or real land document.

Because ACRES is a hackathon prototype, it does not claim a certified privacy programme or a guaranteed response time. If this becomes a real service, this policy, its legal basis, retention schedule and request process must be replaced before handling citizen data.

Session identifiers are signed, session and browser-token cookies are HTTP-only, and production session cookies are sent with the secure flag. These controls reduce common risks but do not make this demonstration suitable for real identity or land data.

This page may change as the prototype changes. The date at the top will be updated when the policy is materially revised.