Privacy Policy
Last updated: 5 August 2026
This policy explains what personal data Jack Stephen Tucker ("we", "us") collects through www.hijack.co.in ("Hijack"), why we collect it, and what rights you have over it.
We are the Data Fiduciary for this data under the Digital Personal Data Protection Act, 2023 (DPDP Act). Our contact details are at the end of this policy.
1. Our approach
Hijack is designed to collect as little personal data as possible. You do not need an account to use it. You do not need to give us your name, and we never see your payment credentials.
2. What we collect
Data you give us
| Data | When | Why |
|---|---|---|
| Song request details (song title, artist) | When you submit a request | To display and fulfil your request |
| Optional message | When you submit a request | To display alongside your request |
| Display name or nickname, if you choose to enter one | When you submit a request | To attribute your request publicly |
| Email address or mobile number, if you choose to enter one | When you submit a request | To confirm payment and notify you of the outcome |
| A photograph you take or upload, and any name(s) and comment you enter with it | Only if you choose to sign the Wall | To display publicly on the Wall, permanently and attributed to the name you give |
Data collected automatically
| Data | Why |
|---|---|
| Venue and performance session identifier (from the QR code you scanned) | To route your request to the correct performance |
| Device and browser type, approximate region derived from IP address | Security, fraud prevention, and diagnosing faults |
| Interaction logs (requests submitted, pages viewed, timestamps) | To operate the request queue and investigate problems |
Payment data we do not collect
Payments are processed by our payment provider, a payment aggregator authorised by the Reserve Bank of India. Your card number, UPI PIN, bank credentials and other authentication data are collected and processed by them directly. We never receive or store them. We receive only a transaction reference, the amount, and whether the payment succeeded, failed, or was refunded.
3. Consent
We process your personal data on the basis of your consent, which you give when you submit a request. Before you submit, you will see a clear notice describing what data is collected and for what purpose.
You may withdraw your consent at any time by contacting us using the details below. Withdrawing consent is as easy as giving it. Withdrawal does not affect processing carried out before withdrawal, and we may retain data where we are legally required to (see Retention below).
Where your data is needed to complete a payment or refund already in progress, we will complete that transaction before deleting the associated records.
4. Purposes — and what we will not do
We use your data only to:
- display and manage your song request;
- process your payment and any refund;
- notify you of the outcome of your request;
- prevent fraud and abuse;
- comply with legal and tax obligations.
We do not sell your personal data. We do not share it with advertisers. We do not use it for behavioural advertising or profiling. We do not use it to train machine learning models.
5. Photographs on the Wall
The Wall is an optional feature. You are never required to use it, and nothing else about your request depends on it.
A photograph you post to the Wall is public and permanent. It is visible to anyone who opens this site, including people who have never attended a performance and people who were not present. It is not limited to the night you posted it, and it stays up after the performance ends.
Before you post
- Only post a photograph you took yourself, or that you have the right to post.
- If other people appear in the photograph, ask them first. By posting, you confirm that everyone identifiable in it is aware and has agreed to it appearing publicly.
- Do not post a photograph of anyone under 18.
- Do not post anything you would not be comfortable being seen indefinitely, by anyone.
Review before publication
Every photograph is reviewed by Jack Stephen Tucker before it appears. Submitting one does not guarantee publication, and a photograph may be declined or removed at any time without notice — for example if it shows someone who has not agreed to appear, or is otherwise unsuitable. If you edit a published post, it returns to review and is hidden again until re-approved.
Removing a photograph
You can ask us to take your photograph down at any time, and we will remove it from public view. Write to info@hijack.co.in. You do not have to give a reason. If you appear in someone else's photograph and did not agree to it, contact the same address and we will remove it — you do not need to have used this service yourself to make that request.
What we cannot undo
Because the Wall is public, we cannot control copies made by others while a photograph was visible — for example screenshots, or copies cached or indexed by search engines. Removing a photograph stops us from displaying it and deletes it from our storage, but it cannot retrieve copies already taken by third parties. Please take this into account before posting.
6. Who we share data with
| Who | What | Why |
|---|---|---|
| our payment provider | Transaction amount, reference, contact detail if provided | To process payment and refunds |
| Supabase (database and file storage) | Data stored and served through their infrastructure | To host the Service |
| None | Aggregated usage data | To understand how the Service is used |
| Law enforcement or regulators | As legally required | To comply with a valid legal obligation |
Requests and display names you submit may be shown publicly on screens at the venue and in the request queue visible to other guests. Do not include anything in a request or message that you do not want to be public.
7. Where data is stored
Your data is stored on servers located in Singapore. This is outside India. Under the Digital Personal Data Protection Act, 2023, personal data may be transferred outside India except to territories the Central Government has notified as restricted, and Singapore is not currently notified as restricted. Your rights under this policy apply in full regardless of where your data is stored. We do not receive or store card, UPI or bank credentials at all — those are handled by our payment provider.
8. Retention
| Data | Retained for |
|---|---|
| Song requests and messages | 12 months after the performance |
| Contact detail provided for payment notification | 12 months after the transaction |
| Payment and refund records | 8 years, as required under Indian tax and accounting law |
| Wall photographs, names and comments | Until you or we remove them — these are published indefinitely by design |
| Security and access logs | 90 days |
After these periods, data is deleted or irreversibly anonymised.
9. Security
We protect your data with encryption in transit (HTTPS/TLS), encryption at rest, access controls limiting access to those who need it, and regular review of our systems. No system is perfectly secure, but we take reasonable safeguards as required under the DPDP Act. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by law.
10. Your rights
Under the DPDP Act, you have the right to:
- Access — obtain a summary of the personal data we hold about you and how it is processed;
- Correction — have inaccurate or incomplete data corrected or completed;
- Erasure — have your data deleted, unless we are legally required to retain it;
- Nominate — nominate another person to exercise these rights on your behalf in the event of your death or incapacity;
- Grievance redressal — raise a complaint with us and receive a response.
To exercise any of these rights, contact us at info@hijack.co.in. We will respond within 2 days.
If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India.
11. Children
The Service is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it. We do not carry out tracking, behavioural monitoring, or targeted advertising directed at children.
12. Cookies and similar technologies
We use only what is necessary to operate the Service: a session identifier to keep your request associated with your device during a performance. We do not use advertising or cross-site tracking cookies.
13. Changes to this policy
We may update this policy. The current version is always available at this page with the "Last updated" date above. Where changes are significant, we will make them prominent before they take effect.
14. Contact and Grievance Officer
Data Fiduciary: Jack Stephen Tucker
Address: 179, Lane 2A, Alto Bella Vista, Sangolda, Porvorim, Bardez, Goa 403511, India
Grievance Officer: Jack Stephen Tucker
Email: info@hijack.co.in
Phone: +91 70211 95951
We acknowledge privacy enquiries within 48 hours and respond substantively within 2 days.
For any other enquiry, see our Contact Us page.