Policies · Security
Security and responsible disclosure
How we protect this website and the data you share with us, how to give safely, and how to report a security problem to us.
Last updated: 17 October 2026
Part 1
How we protect the site
Encrypted connections
Every page and form is served over HTTPS, so what you send is encrypted on its way to us.
Content Security Policy
Our pages tell your browser which sources may run scripts or load content on them, which helps block malicious code.
No third-party scripts before consent
Analytics scripts load only after you choose “Accept all”. YouTube players load only when you press play, and WhatsApp opens only when you click. Our cookie policy lists what loads and when.
Spam protection
Our forms include a hidden field that people do not see but automated bots tend to fill in, and a check that the form was not completed faster than a person could. We do not use a third-party CAPTCHA by default, so no extra tracking is added to our forms.
Trusted providers
The site is hosted by Wix.com. Form submissions are stored in Wix Forms and Wix Contacts and emailed to the Trust’s own mailboxes, csr@groundreality.org and prathaap@groundreality.org. Each provider runs its own security controls.
Part 2
How we handle your data
Only what we need
Our forms ask only for what we need to reply to you, and we delete what we no longer need.
Limited access
Only the people who need your details for your request can see them. Our team reviews enquiries and visit statistics in a private dashboard that reads this data from Wix and that only the Trust’s team can open. Nothing in it is sold or shared for marketing.
Donation details
PAN and donation details are used only for receipts, certificates and the reporting the law requires.
Our privacy policy explains what we collect, why, and the rights you have.
Part 3
Give safely, and spot impersonation
We never ask for secrets
We never ask for your card PIN, OTP, UPI PIN or passwords, and we never ask for card numbers by email, phone or WhatsApp.
Donations go only to the Trust
Donations go only to accounts in the name of GroundReality Trust, never to a personal account. If a message asks you to pay into an account you have not used with us before, call +91 814 768 4653 before you pay. Our donation policy explains how to give.
Watch for impersonation
If a message, call, social media page or person collecting money in the PotHoleRaja name looks wrong, such as an urgent request for money, new bank details or an unexpected attachment, do not act on it. Check with us first, and forward suspicious emails to csr@groundreality.org with the subject “Security report”.
Part 4
Report a vulnerability
If you think you have found a security weakness in this website or our other systems, please tell us. Email csr@groundreality.org with the subject “Security report”, and include:
the web address or system affected;
what the problem is, and what someone could do with it;
the steps to reproduce it, with screenshots or a proof of concept if you have them; and
how we can contact you.
If you do not hear back, or the problem affects that mailbox, write to the founder at prathaap@groundreality.org.
We aim to acknowledge your report within 5 working days. We will keep you informed while we look into it, and tell you when it is fixed. We are a charitable trust and do not run a paid bug bounty, but we are grateful for every report made in good faith.
Our security contact is also published in machine-readable form at /.well-known/security.txt, following the RFC 9116 standard.
Part 5
Rules for research, and safe harbour
When you look for security problems, please:
do not access, copy, change or delete other people’s data. If you come across personal data, stop, do not keep it, and tell us;
do not run denial-of-service attacks, load tests or high-volume automated scans, or do anything else that could slow down or disrupt the site;
do not use phishing, social engineering, spam or physical attacks against our team, volunteers, partners or premises;
use only your own test details in our forms, and keep test submissions to a minimum;
do not test services run by others, such as Wix, Google, YouTube or WhatsApp, through our site. Report problems in their platforms to them directly; and
keep the details confidential until we have fixed the problem, or for a reasonable time agreed with us.
Safe harbour: if you act in good faith and follow these rules, we will treat your research on systems we run as authorised, we will not take or support legal action against you for it, and we will work with you to understand and fix the problem quickly. If you are unsure whether something is allowed, ask us first.
Contact
Contact and Grievance Officer
For a security report, use the subject “Security report”. For any other concern or complaint about how we handle your data, write to our Grievance Officer.
We aim to resolve grievances within one month of receiving them.
- Write toGrievance Officer, PotHoleRaja
- Emailcsr@groundreality.org
- Founderprathaap@groundreality.org
- WhatsApp or phone+91 814 POTHOLE · +91 814 768 4653
- LocationBengaluru, Karnataka, India