Privacy that matches the implementation

Local files and real-mode answers

• Document-first review extracts PDF text or runs English/Hindi OCR locally after you choose a file. The reader downloads code and language files from this site; document bytes and extracted fields are not uploaded by the reader. Up to three pages are read, and unclear or incomplete readings remain limited. OCR caches for selected content are disabled.
• Cloud vision is not enabled on this deployment: no server-side AI key or production usage controls are configured. If enabled in a future release, it will require an explicit choice identifying the selected files and provider before anything is sent. Cloud providers may retain data under their policies; a no-storage API setting is not a zero-retention guarantee.
• Selecting a file does not authenticate its origin. Any source label records what the citizen says about the copy; it is not government verification.
• Opening a selected PDF creates a separate browser-local tab. Quick exit cannot close or erase that tab; close the PDF tab yourself, especially on a shared device.
• During review, answers and selected-file references stay in page memory. They are not uploaded or saved automatically. Choosing Save this case separately stores the displayed readings and edited request; original documents and file previews are not saved.
• Pressing the Dark mode toggle stores one device display preference in this browser: a single word, dark or light. Nothing is stored before you press it, it never contains case information, and it stays until you change it or clear browser site data.
• Reloading, closing the app tab, or Quick exit clears only the in-app copy. Shared-device mode disables this app’s summary copy, download, and formatted-print controls and attempts to leave after inactivity; close any separately opened PDF tab, then use Quick exit when finished.

Saved mobility cases and optional accounts

When you explicitly save a case on a private device, this browser keeps the readings, optional source-file fingerprints and their review status, edited request, chosen dates, reference, preparation steps and local or citizen-reported timeline. Optional profile details include your chosen name, address and vehicles. This storage is not encrypted and anyone using this browser can open it. Cases and profiles expire 90 days after their last local change and are removed when next accessed. Delete individual cases or all mobility data from the workspace. Keep original attachments yourself.

Account access is available only when configured. Google handles sign-in; we receive basic identity details. A server session cookie expires after one day. A reviewed account-save action sends the selected case or reusable profile to Cloudflare storage, without original documents. Account copies expire 90 days after their last account save and are removed on the next access. Your Google identity remains until you delete your account. Deleting account data does not delete device copies or downloads. Account sign-in does not connect any government service.

Your display-language choice is saved as en or hi in this browser. It contains no case details. Clear site data to remove it.

Optional follow-up notes store what you entered from your own record, its source label and date, reference, short note and an optional local file fingerprint. The original file is not stored. Failed checks keep the previous observation. These notes are unencrypted on this device, expire after 90 days without a save or when their case expires, and are removed on the next access. Deleting a case also removes its follow-up notes. Calendar files are personal reminders; your calendar provider may retain an imported copy.

Document reminders, linked plans and clearing a session

The document expiry organiser saves only the document type, optional document and vehicle labels, expiry date, source label, date you checked it, chosen reminder date and save metadata. Linked plans save the plan type, selected case links, dates and revision; they do not copy case facts. Both require private-device save consent, stay unencrypted in this browser and are not synced to an account. Reminders expire 90 days after their last explicit save; plans expire 90 days after a changed plan is saved. Reading them does not extend retention. Expired records are removed when the tools next check storage.

Use Delete reminder, Delete plan or the clear control in the relevant panel, or Clear all mobility data on this device in the workspace. Deleting a plan or reminder keeps its cases. Personal calendar files contain only the preview you approve; imported entries and notifications are managed by your calendar. Clearing browser records cannot remove those copies.

Clear this session removes working forms, unsaved edits and reviews from the mobility tab. It leaves saved device data, other tabs, account sign-in, downloads and clipboard copies in place. A non-personal marker in this tab’s session storage keeps saved details covered on reload until you choose Start a new session; it contains no case details. If the marker cannot be stored, the cleared screen warns that a reload may show saved data again. Use the separate deletion controls to remove saved records.

Checking retained original-file fingerprints

If a saved case includes document fingerprints, you can choose an original file to compare locally. This check computes SHA-256 and compares it with the retained fingerprints. It does not upload or store the file, run OCR, or change case facts or their confirmation. The result and selected filename stay in page memory until you close, leave or change the case. Matching bytes do not establish authenticity, truth, independent evidence or an official outcome. A different fingerprint can result from a different file or a re-export; it is not a finding of tampering. Older cases may have no retained fingerprint.

Optional effort measurement and portable copies

Effort measurement starts only when you choose it. It estimates recent activity on the visible, focused case page, excludes pauses and idle time after 30 seconds, and records only the counts and outcome you report. It does not record text, key values, case details or browsing history. Nothing is uploaded or saved automatically. Leaving the case, reloading or clearing the measurement removes its page state. A reviewed JSON download contains only a random session ID, service, counted duration, two reported counts and your reported outcome. It cannot establish time saved or official completion.

A portable case file encrypts the exact case preview locally using your passphrase. It includes the case details and document-source references shown in that preview; original document bytes, your separate reusable profile and separate source-follow-up notes are excluded. The passphrase is not sent to us or saved by the app and cannot be recovered by us. The file stays until you delete it. Opening a file requires the passphrase, local validation and your review; it creates a separate unsaved case copy and preserves the original retention date. Case storage in the browser remains unencrypted after you explicitly save. Encryption does not verify the source or truth of an imported case.

Optional helpers and AI suggestions

When account helper access is available, you choose a trusted sign-in email and preview one selected case snapshot. Only its title, service, authority, selected details and optional draft are shared. Access lasts one to twenty-four hours and can be revoked; changing the account case ends access to the old snapshot. The helper can suggest wording, and only you can apply it. No invitation message is sent automatically. Shared snapshots and proposals remain with the retained account case until deletion or expiry cleanup. You can separately delete ended invitation history; the saved case and any applied wording remain. Up to 100 invitations are retained per account, with at most 10 active. Revocation cannot erase copies the helper already kept.

The on-device case team uses local rules. Optional cloud AI is off by default. When configured, one explicit request sends only the previewed minimal case context to Cloudflare Workers AI for a writer and critic pass. Original files and your account identity are not included; selected text can still contain personal information. Detected identity numbers and credentials are excluded, but this is not a guarantee of complete anonymisation. The critic is another AI pass, not independent verification. Suggestions do not change your case or perform official actions. Provider processing follows its policies; we do not promise zero provider retention.

The AI request ledger stores a random request ID, account link, UTC date and outcome, without prompts or suggestions. It counts failed or stopped requests to enforce limits. Entries older than two days are deleted on the next adviser request; deleting an account removes its link while anonymous site counts remain until expiry.

The assistance lab uses a fictional portal and a made-up practice word in an isolated screen. Only a completion signal returns to the parent page. Its synthetic checkpoint stays in this tab’s session storage until you reset, exit or close the tab. No real credential or official service is connected.

Saving a reply follow-up

After reviewing a reply, you can choose a private device and separately save the complete prepared note as a new mobility case. Choosing a related saved case explicitly opens your saved-case list for this optional reuse. That optional choice copies its service, state, reference and facts into a full preview; copied facts require a fresh review. The original case and its history are not changed. The new case remains preparation, regardless of words such as approved or disposed in the reply. Saving requires separate consent to unencrypted storage for up to 90 days. Clear text and Quick exit clear the reply page, but do not delete a case you explicitly saved; delete it from the mobility workspace.

Optional private-device checklist and local tools

The mobility checklist opens only after you choose a private device. It saves task type, your selected status, follow-up date and creation/update times in this browser. It does not save documents, registration numbers, case identifiers, messages, replies or review contents. Anyone with this browser can open it; it is not encrypted or protected by a login. There is no account or cross-device sync.

Exit and Hide close the checklist view but retain explicitly saved tasks. Delete saved checklist removes its browser entry; clearing site data also removes it. It expires 90 days after the last change and is removed the next time the checklist is opened. Other tabs lock when this storage changes. Dates and statuses are citizen-reported; the checklist performs no official lookup, renewal or background notification.

Message checking and authority-reply review run on this device. Pasted links are displayed as text and are not opened or fetched. Photo crops are temporary inspection views; the original is preserved. Reply passages and photo readings remain citizen-selected observations. Their page state clears on exit, page hide or inactivity. Saved downloads remain outside the app’s deletion control.

On a private device, you may download the checklist as an unencrypted JSON backup or a task as a calendar file. These contain only the checklist metadata. Restore validates the file locally, previews it and requires your explicit choice to replace the saved checklist; the original expiry is preserved. Files remain until you delete them. Your calendar or device may sync imported files under its own settings. Deleting or expiring the browser checklist does not delete exported copies or calendar entries; manage notifications in your calendar.

Print or save as PDF is available only after a private-device choice for a prepared document or reply note. The print preview contains that note, not the rest of the form. Your browser, printer or saved PDF controls any further copies; clearing this page cannot remove them.

Hosting and technical request data

Ordinary page requests still reach the infrastructure provider. To deliver and protect the site, that provider can receive technical data such as IP address, requested path, time, and browser or device information. ChallanSakshi does not guarantee how long the infrastructure provider retains technical logs.

The prototype embeds no third-party analytics, advertising pixels, chat widget, or social tracker.

Copies outside the app’s clear action

Downloads, screenshots, clipboard contents, print-to-PDF files, browser history, and device backups are outside ChallanSakshi’s deletion control. The app cannot erase copies created by the browser, operating system, another app, or the person using the device.

Synthetic demo storage

The separate /demo walkthrough stores only its bundled fictional case state and reading preferences in this browser so judges and learners can resume it. Use its Reset control to remove that synthetic demo state. Never type real information into the synthetic Resolution Desk. The public /demo/test-lab custom-image workbench keeps selected image bytes in the current tab and does not send them to the server or an AI model; observations are entered manually. Its ten bundled cases are fictional. A custom input is user-selected, must be synthetic, and ChallanSakshi cannot verify its provenance. A policy-limited model adapter exists for controlled local or separately access-protected testing, but both enabling switches are off in public production. Feature flags are not authentication. If deliberately enabled elsewhere, the two supplied texts and original image bytes—including embedded metadata—would pass through the Worker to OpenAI; store:false is not a promise of zero provider retention. TollSakshi’s three fictional fixtures stay in page memory and are persistently watermarked.

Information we intentionally refuse

Document review displays the registration and challan identifiers needed to check the selected record; a saved review note includes those fields. Correct only the requested field. Names, addresses, contact details, chassis/engine numbers and payment credentials are not requested or extracted as fields. Manual and FASTag forms continue to request masked or minimum values.

ChallanSakshi never requests a CAPTCHA, OTP, Aadhaar or VID, a government, bank, or FASTag password, or card or payment credentials. Complete any login, identity check, CAPTCHA, OTP, or payment only on the independently opened official service.

Capability and legal limits

ChallanSakshi does not make a payment or submit a grievance, contest, court response, FASTag dispute, or other case action. Authorised government API access is not implemented. Results organise citizen-provided information; they do not authenticate a record, decide a case, or provide a legal guarantee.

Maintainer, correction, and release status

ChallanSakshi is a free, independent civic project built and maintained by Shourya Banda (sh1rs). For a broken link, accessibility issue, incorrect guidance or a security concern, use the product contact on our About page. Describe the page and the problem without sending notices, registrations, identity documents, passwords or other personal case details.

About the project and contact the maintainer

This is a public self-service tool with best-effort maintenance, not an official grievance or emergency channel. A response time or case outcome is not guaranteed. Independent privacy, legal and full accessibility reviews have not been completed. If guidance appears outdated, confirm it with the issuing authority before relying on it.

Language status

The real e-Challan and FASTag reviews, message and reply tools, checklist, source pages and flagship synthetic walkthrough offer English and Hindi. Hindi wording has not received independent language review. The FASTag synthetic examples and Evidence Test Lab remain in English. If translated wording is unclear, compare the English text and the original official record before acting.