Privacy Policy

Last updated: 8 March 2026

Nibandana is a free, open-source search engine for Indian court judgments. This policy explains what data we collect, how we use it, and what third-party services are involved. We believe in transparency — this policy reflects the actual technical architecture of the service.

Data We Collect

Nibandana has no user accounts, no login system, and no tracking or analytics. We collect only the minimum data necessary to serve your search requests.

Search queries and filters

When you perform a search, the query text and any filters you apply (court, judge, year range, disposal nature, sort order, page number) are sent to our server to process your request. This data is passed to our internal search engine (MeiliSearch), which runs on the same server. Search parameters are not stored in any database or log file beyond the duration of the request.

IP address

Your IP address is used for two purposes: rate limiting and optional bot detection. Rate limit counters are held in server memory and automatically expire every 60 seconds — they are never written to disk or sent to any external service. If Cloudflare Turnstile bot detection is enabled, your IP may also be sent to Cloudflare as part of the verification request (see Third-Party Services below).

Theme preference

If you switch between light and dark mode, your preference is stored in a browser cookie so it persists across page loads. This cookie contains only your theme choice (e.g. "light" or "dark") and is not used for tracking.

Search state in URL

Your current search query and filters are stored in the page URL (e.g. /search?q=habeas+corpus&court=7_26). This means your search is bookmarkable and shareable, but no search state is stored in cookies or browser storage.

Data We Do Not Collect

No user accounts, emails, names, or passwords
No browsing history or search history
No device fingerprinting
No analytics or telemetry — we do not use Google Analytics, Segment, Amplitude, Mixpanel, or any similar service
No error tracking services (no Sentry, Rollbar, or equivalent)
No advertising or ad-related tracking
No tracking cookies of any kind
Internal search engine telemetry is explicitly disabled

Third-Party Services

Nibandana relies on three external services. No other third-party services receive your data.

Cloudflare (CDN and HTTPS)

All traffic to Nibandana passes through Cloudflare's content delivery network, which provides HTTPS encryption and edge caching. Cloudflare may process standard connection metadata (IP address, TLS version, HTTP headers) as part of delivering the service. Cached API responses are public search results and contain no personal data. Cloudflare's privacy policy applies to their processing of network traffic.

Cloudflare Turnstile (bot detection)

Nibandana may use Cloudflare Turnstile, an invisible bot detection service, to protect search endpoints from automated abuse. When active, Turnstile runs a challenge in your browser and sends a verification token along with your IP address to Cloudflare. Turnstile does not use cookies for tracking and does not display a visible CAPTCHA unless it suspects automated access. This feature is optional and may be disabled entirely.

AWS S3 (PDF hosting)

Judgment PDFs are hosted on Amazon Web Services S3 as part of the AWS Open Data Registry. When you open a judgment PDF, your browser connects directly to AWS S3 — the request does not pass through Nibandana's servers. Amazon's privacy policy applies to these direct connections.

Data Retention

Rate limit counters: held in server memory, automatically expire every 60 seconds, never written to disk
Cloudflare edge cache: public API responses cached for 5 minutes (search, suggestions) to 1 hour (court listings, judgment details)
Theme cookie: persists in your browser until you clear it
Server logs: error messages are logged to the server console for debugging; no structured logging or external log aggregation service is used

Security Measures

Nibandana implements the following security measures:

HTTPS enforced via HSTS with a two-year duration, including subdomains
Content Security Policy restricting scripts, styles, and connections to trusted sources
Rate limiting per IP address: 60 requests per minute for search, 120 per minute for suggestions and judgment lookups
Input validation and sanitization — search queries are truncated, and filter values are validated against allowlists
XSS prevention via HTML sanitization of search result highlights
Clickjacking protection (X-Frame-Options: DENY)
CORS restricted to same-origin requests in production
Browser sensor APIs (camera, microphone, geolocation) disabled via Permissions-Policy

Judgment Data

All judgment data indexed by Nibandana is sourced from publicly available court records. The data includes case titles (party names), judge names, court names, decision dates, disposal outcomes, and excerpts from judgment texts. This is public information published by Indian courts and made available through the AWS Open Data Registry. Nibandana does not collect or store any private or non-public personal information from court records.

Children's Privacy

Nibandana does not knowingly collect any personal information from anyone, including children. Since we do not collect personal data, no special provisions for children's data are necessary.

Changes to This Policy

We may update this policy to reflect changes to the service. The "last updated" date at the top of this page indicates when the policy was last revised. Continued use of Nibandana after changes constitutes acceptance of the updated policy.

Contact

Nibandana is an open-source project. If you have questions about this privacy policy or the data practices described here, you can open an issue on the project's GitHub repository.