Privacy notice

Toran is run by Company name Ltd, a company registered in England and Wales (number number), registered office address. We are the "controller" of the personal data described here. ICO registration number: number.

Questions or requests about your data: privacy@domain. We reply within one month.

The short version

• You can browse Toran without an account. We don't use tracking cookies or advertising, and we don't sell or share data for marketing.
• What you save (mandirs you follow, your plan, seva you've taken, your text size) stays on your phone, not with us.
• Mandir committee members who look after a mandir's page log in with their email address. That's most of what we hold.
• Knowing which mandir someone is involved with can reveal their religion. We treat that with extra care and collect as little as we can.

If you just visit the site

• No account and no tracking cookies. We don't record who you are or which mandirs you look at.
• Server logs. Our hosting provider, Vercel, briefly keeps technical logs, including IP addresses, to run the site and protect it from abuse: one hour on its free plan, one day on its Pro plan. The site's servers are in London.
• Error reports. If a page breaks, an error report goes to Sentry so we can fix it. We set it up not to store IP addresses, cookies, browser headers or email addresses. Reports are deleted after 30 days (90 days on Sentry's Team plan).
• The maps. The street map comes from OpenFreeMap (or, on some phones, from OpenStreetMap). Your browser fetches it directly, so OpenFreeMap or OpenStreetMap sees your IP address, as any website you visit does; neither uses cookies. If you press "Near me", your browser asks first; your location only moves the map on your screen and is never sent to us or kept. If you type a postcode in the mandir search, we look it up with postcodes.io for you, without anything about you, and don't keep it.
• "Near me" on What's on and the festival pages. If you press it, your browser asks first, then sends your position (rounded to about a kilometre) to postcodes.io to find your postcode district, such as "RG1". Only the district reaches Toran, just as if you'd typed it; your position isn't sent to us or kept. postcodes.io is a free public service run by Ideal Postcodes. Your phone remembers the postcode or district you chose (or that you chose all of the UK), so What's on starts there next time. It stays on your phone; clearing the site's data in your browser forgets it.
• Directions, live streams, tickets and mandirs' websites. Buttons like "Directions", "Watch live", "Book tickets" and "Website" take you to another site (Google Maps, YouTube, a mandir's booking page and so on). Toran doesn't send them anything about you, but once you're there their own privacy notice applies.
• Calendars. If you add a mandir's events or the festival dates to your calendar, your calendar app checks Toran for changes every few hours. Like any visit, that shows up briefly in the server logs; we don't know who subscribes and need no account.
• Offline copies. Your phone keeps copies of the public pages you've opened (What's on, mandir and festival pages), so they still open without signal. They stay on your phone; clearing the site's data in your browser removes them. Nothing personal is kept.
• Text size and contrast. If you change these, your phone remembers your choice. Nothing is sent to us.
• Read aloud. Your phone or browser reads the page aloud with its own voices. Toran sends nothing anywhere; some browsers use their maker's online voices, under that maker's privacy terms.
• Seva slots. If a mandir lets you take a seva slot on Toran, we keep only that one more slot is taken, with the time. We don't ask for or keep your name, contact details or anything about your phone. Your phone remembers which slots you took, so you can see them, add them to your calendar or give them back; clearing the site's data in your browser forgets them.
• Following a mandir. If you press "Follow" on a mandir's page, your phone remembers that mandir; nothing is sent to us and you need no account. When you choose "Only mandirs I follow" on What's on, the mandirs' web addresses go in the page's address so Toran can show their events, like any other choice on that page; we don't keep them. The home page shows their next events: it comes with every mandir's next event and your phone shows the ones you follow, so who you follow stays on your phone. Your phone also keeps their pages, so they open without signal. Clearing the site's data in your browser forgets who you follow, and those pages.
• Making a plan. If you press "Add to our plan" on an event, your phone remembers it; nothing is sent to us. When you open the plan, or send it to someone on WhatsApp, the events' codes go in the page's address so Toran can show them, like any other link; we don't keep them. Clearing the plan, or the site's data in your browser, forgets it.
• My Toran. My Toran puts together what your phone keeps: the mandirs you follow, your plan, the seva you've done and the events you say you went to (after an event in your plan, or by pressing "I went" on an event's page). All of it stays on your phone; you need no account. To show their names, the page sends Toran the mandirs' web addresses and the events' codes, with nothing about you, and we don't keep them. "Moving to a new phone" makes a link with all of it inside, in the part of the address that browsers never send to a website, so it goes from your phone to your new one without reaching us. "Clear everything" on My Toran, or clearing the site's data in your browser, forgets it.
• Telling us about an event, or asking for a correction. We keep only what you type into the form: the event's details, or what's wrong and on which page. We don't ask who you are or record your IP address, so please don't type anyone's name or contact details. To stop automated spam, the site counts how often a form is sent from the same internet address for ten minutes, in a scrambled form and in its working memory only; it is never saved. Correction and removal requests are deleted 90 days after we've dealt with them.
• Visitor numbers. Toran counts how many times each public page is seen each day, and how often events are added to calendars or shared, with its own simple counter. It uses no cookies and keeps nothing about you: no IP address, browser or device, only the page's address and a running total. If your browser asks sites not to track you ("Do Not Track" or "Global Privacy Control"), you aren't counted at all.

If you sign up for the weekly email

The weekly "What's on" email is switched off until our ICO registration and impact assessment are done. When it's on:

• We keep your email address and, if you choose one, an area (such as "London"). No name, postcode or anything else.
• You confirm by pressing the link we send. If you don't within 7 days, your address is deleted.
• Every email has a one-click link to stop them. Pressing it deletes your address straight away.
• The email is sent through Resend, our email provider. Lawful basis: your consent, which you can withdraw at any time by leaving.

If you look after a mandir's page

Being on a mandir's committee can reveal your religious beliefs, which the law treats as special category data. We rely on your explicit consent, which you give by ticking a separate box when you ask to look after a page or accept a colleague's invite. You can withdraw it at any time by leaving your mandir's committee on Toran or asking us to remove you.

We don't show your name or email on the public site. Others on the same mandir's committee can see your login email on the committee page, so they know who else helps run it. Event listings say "Confirmed by the mandir", not who confirmed them.

Photos of the mandir. A committee can add a photo of the mandir building to its page. It must show the building only, with no people in it; the committee ticks a box to confirm that and that Toran may show it. The photo is public. It is removed when the committee removes it, or straight away if anyone asks us to because it shows a person.

Reading a poster or a message. A committee, or Toran, can send a photo or PDF of a poster, or paste in a message (for example one forwarded on WhatsApp), so its events are typed up automatically. The picture or text is sent to Anthropic (the Claude API) to be read, together with an instruction to leave out anyone's name or number. Toran doesn't keep the picture or the message, only the event details it finds, which are checked before anything is published. Anthropic doesn't use what we send to train its models and deletes it within 30 days.

A monthly email to committees (switched off until our ICO registration is done): a summary of how your page did and anything worth doing. You'll be able to stop it at any time.

Mandirs' own details

Mandir names, towns, postcodes, websites, public phone numbers, live stream pages and public event calendars come from the mandirs' own websites and public registers, or from their committees. They describe organisations, not people. If a mandir's published contact is a personal email or phone number, we keep it private and use it only to contact the committee. Every night Toran reads the public event calendars mandirs have given it, and the event details their websites publish, to keep listings up to date; these are the mandirs' public information.

Coming later (this section will be updated before each launches)

• Seva sign-ups with names: today seva on Toran keeps no names at all. If a mandir ever needs names, they'll be shared only with that mandir's committee, deleted 90 days after the event, and under-16s will need a parent's or guardian's details and the mandir's sign-off.
• Forwarding posters by WhatsApp or email: the message, any image, and the sender's number or address, used to create the listing and then deleted within 90 days.

Who we share data with

Only these service providers ("processors"), who act on our instructions under contract:

Some of these companies are based in the USA. Where data leaves the UK, we rely on the UK Extension to the EU–US Data Privacy Framework where the company is certified, and otherwise on the ICO's international data transfer addendum in the company's data processing agreement.

We never sell data. We'd only share it with others if the law requires it.

How long we keep it

In short: logins until you ask us to delete them, or 24 months after your last login (we email first); an address typed on the login page whose link is never opened, 7 days; weekly email sign-ups until you leave (never confirmed: 7 days); decided page requests for 2 years; correction requests 90 days after they're dealt with; error reports 30 to 90 days; server logs one hour to one day; database backups 7 days. Our full retention schedule is available on request.

Your rights

You can ask us to:

• give you a copy of your data;
• correct it;
• delete it;
• restrict or object to how we use it;
• move it to another service.

Where we rely on consent, you can withdraw it at any time. Email privacy@domain. We reply within one month, and it's free.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.

Cookies

We only use cookies that are needed for logging in (they keep you logged in, and are set only when you log in). These don't need consent, so we don't show a cookie banner. If that ever changes, we'll ask first.

Changes

We'll update this notice when we start collecting something new, and show the date at the top. Last updated: 9 November 2026.