Privacy policy

Last updated 18 October 2026

Van Sampada (the website vansampada.in and the Van Sampada Android app) is used by officers and field staff of the Himachal Pradesh Forest Department to record, verify and approve forest works, nurseries and success stories. It is operated by Anthropy India ("we"), which is responsible for the personal data processed through it (the data fiduciary under India's Digital Personal Data Protection Act, 2023).

Who can use Van Sampada

Accounts ("seats") are issued by the Forest Department to its staff; there is no public sign-up. Van Sampada is not meant for anyone under 18.

What we collect

Your profile: name and mobile number, and if added, email address, date of birth and a profile photo; the seats (role and place) you hold. Passwords are stored only in hashed form.
Records you create: photos and videos taken in the app, each with the date, time and precise location of capture (also printed on the photo), and the descriptions, measurements, amounts, remarks and approval decisions of works; nursery and success-story text, photos and videos.
Location: the app uses your precise location only when you take a photo or video, to show where the work was done. It does not track your location in the background.
Camera: used only to take the photos and videos you choose to record.
Notifications: a push token from Google's Firebase Cloud Messaging (and, in a browser, a web-push subscription) so we can tell you about assignments and decisions.
Usage and device data: the app uses Google's Firebase Analytics, which collects how the app is used (screens viewed, sessions, app version), device model and Android version, an app-instance identifier, approximate location derived from the network, and the advertising ID where the device makes it available. We use it only to understand and improve the app, never for advertising.
Security and audit records: sign-in attempts with the IP address and device or browser, and a tamper-evident audit log of actions taken in Van Sampada (who did what and when, with device information and, for some actions, the location).

How we use it

To run the department's workflow: assigning, recording, submitting, verifying and approving works, nurseries and success stories.
To show where and when work was done, so that records can be checked.
To notify you of work assigned to you and of decisions on your records.
To keep accounts secure, for example by locking a seat after repeated failed sign-ins.
To understand how the app is used and fix problems.

Who sees it

Inside Van Sampada: officers in your reporting chain and department administrators, according to their role and place. Names and contact numbers appear in the department directory; a date of birth is shown only to you and to officers who manage your profile.
Publicly, by design: a seat's public page (the holder's name, role and seat code); approved success stories (their text, photos and videos, and the author's name, seat and place); and the verification page of a work reached through its QR code (the work's details, location and GPS coordinates, and its photos and videos).
Service providers who host or process data for us: Vultr (application server and database, in India), Akamai's Linode Object Storage (photos, videos and encrypted backups, in India), Cloudflare (network security and delivery), and Google Firebase (push notifications and analytics; Google may process this data outside India).
Authorities where the law requires it.

We do not sell personal data and do not show advertising.

How long we keep it

Profiles and work records are the department's records and are kept while they are needed for that purpose or by law. A file that is deleted is removed from storage for good within 30 days.
The audit log is kept online for six months and then archived in encrypted form.
Failed sign-in records are deleted after about a day; expired sign-in sessions after 30 days.
Encrypted backups: daily copies for 7 days, monthly copies for 200 days.
Firebase Analytics data is kept for the period set in Google's Firebase Analytics.

How we protect it

All traffic is encrypted (HTTPS). Passwords are hashed, access depends on role and place, repeated failed sign-ins lock the seat for a while, files are served through signed, expiring links, and off-site backups are encrypted.

Your rights

Under the Digital Personal Data Protection Act, 2023 you may ask for a summary of your personal data and how it is processed, have it corrected, completed or updated, have it erased where it is not required to be kept for the department's records or by law, nominate someone to exercise these rights for you, and have a grievance addressed. Write to us or to the Grievance Officer below. If your grievance is not resolved, you may complain to the Data Protection Board of India.

Changes

We will post any change to this policy on this page and update the date above.

Contact

Anthropy India, Jaipur, Rajasthan, India - 302017
Email: [email protected]
Grievance Officer: Priyanka, [email protected]