What we hold

Last updated 26 August 2026.

What we store

• Your name, learner email and section — the name and section are shown to other verified students on the roster. Your email address is not.
• Who you picked, and when. Never shown to anyone unless it becomes a mutual match.
• The person you picked, by name and section, when they do not have a maheblr account yet. That is all that is stored about them — no email, no contact details, nothing that could be used to reach them.
• Your matches — a match only exists once two people have each picked the other, so both already made their choice before it appears. When one forms, the two of them are emailed each other's details. Nobody else ever sees it.
• A password, if you set one — stored as a bcrypt hash. It cannot be read back, by us or anyone else.

If somebody picked you before you joined

Everybody at MIT and TAPMI Bengaluru is on the student list, so somebody can pick you before you have ever opened maheblr. When they do, a pick pointing at your name and section is stored and waits. It is worth being straightforward about what that does and does not mean:

• It is a name and a section, and nothing else. We hold no email address, phone number or any other way to contact you, and we never try to find one.
• Being on the student list is not a maheblr account, and a pick never turns it into one. The pick is visible only to the person who made it, and to them it looks like exactly what it is — someone they picked. No other student can see it, and you are never shown it.
• You are never contacted because of it. Signing up is the only thing that brings you in, and signing up tells you nothing about it.
• If you never sign up, it stays inert forever and nothing ever comes of it.
• You can have it removed. Email us from your learner address with your name and section and we will delete every pick naming you, whether or not you have an account.

What we never do

• Show a one-sided pick to another student, or to the person picked. The one exception is the person who operates maheblr, on an internal screen — stated plainly on the safety page.
• Sell, rent or share your data with anyone.
• Ask for your email password. We send you a link; we never sign in as you.
• Run third-party advertising or analytics trackers, or load anyone else's scripts on this site.

Garba

The garba page adds three things, and each one shares a different amount. It is worth spelling out.

• Garba picks work like crush picks — three each, and permanent: stored privately, never shown to the person picked, and only turned into anything if they pick you too. The operator can see them, the same as crush picks.
• The garba board is opt-in, and it is the one place on maheblr where interest can be one-way. If you list yourself, verified students on the other list see your name, section, photo and the line you wrote. If you ask someone, they see that you asked. If they say no, you see that it did not work out. Nothing else.
• Your email and Instagram handle are only given to someone after you have both said yes — by request, by picking each other, or by both pressing "Go to garba together" in a Blind chat.
• Board photos are re-saved on upload, which strips location and camera data. They are stored privately and shown only to signed-in students. The maheblr team can see every listing and photo, read reports, and take either down.
• Leaving the board deletes your listing and photo straight away.

Counting visits

We keep a rough count of how many different people open the site, so we know whether it is being used. It is done without a cookie and without any outside service: each visit is turned into a one-way scrambled code made from your network address and browser, and only that code is kept. It cannot be turned back into you, it is never linked to your account, and all it is ever used for is counting.

Emails we send

Two, both triggered by you: the login link you asked for, and a match notification when someone you picked picked you back. There is no newsletter and no marketing email.

Notifications, if you turn them on

Turning notifications on in Settings stores one record per device: an address your browser's own push service gave us, and the two keys needed to encrypt a message to it. That is the whole record — it is not a phone number, it cannot be used to reach you anywhere else, and it is deleted when you turn notifications off, when you delete your account, or when your browser tells us it has stopped working.

The notification itself deliberately says very little. A Blind notification carries the alias for that conversation and the fact that a message arrived — never the message, and never anybody's real name — because a notification is shown on a locked screen that other people can see. The Android app receives these same notifications; it is this website in an app, and it collects nothing your browser does not.

Deleting your account

Go to Settings and delete it. That immediately removes your roster entry, every pick you made, every pick that pointed at you, every match you were part of, your garba listing, photo, picks and requests, and any devices you had turned notifications on for. It is not recoverable, and it does not wait for anyone to approve it. If you cannot get into your account — or never made one and want the picks naming you gone — email noreply@maheblr.fun from your learner address.

Cookies

One session cookie, so you stay logged in. No tracking or advertising cookies. Your light or dark theme preference is kept in your own browser's local storage and never reaches the server.

Your rights

Under India's Digital Personal Data Protection Act you can ask what we hold about you, ask for it to be corrected, and ask for it to be erased. Your name and section are editable in Settings, and erasure is the delete button on the same page. For anything else, email us.