Privacy Policy

Written to be aware of India's Digital Personal Data Protection Act, 2023 (DPDP) and the EU/UK GDPR. [COUNSEL CHECK C1]

1. Who is responsible

[OPERATOR LEGAL NAME], [OPERATOR ADDRESS], is the data fiduciary / controller. Contact and Grievance Officer: [GRIEVANCE OFFICER NAME], [GRIEVANCE OFFICER EMAIL], [GRIEVANCE OFFICER ADDRESS]. We aim to respond within 7 days.

2. What we collect and why

We do not sell data, run ads, or use advertising trackers.

Email. If you sign up with an email address and a password, we send account emails from [AUTH SENDER ADDRESS]: to confirm your address, to reset your password, to change your email, and security notices (for example "your password was changed"). They are not marketing, and they cannot be turned off while the account exists. We do not send marketing or digest email. If we ever do, it will need your separate opt-in and this policy will be updated first. Your address and the message are handled by our email provider (see Processors); opening or clicking is not tracked.

Safeguards at sign-up. To keep fake accounts out, we refuse sign-up with an email address from a list of temporary (disposable) email domains, and we limit how often one network or one address can try to sign in or ask for an email. These checks use only the address you typed, which we already hold for the account. A new password is also checked against a list of leaked passwords (see Processors).

Cookies. We set only strictly necessary cookies: your signed-in session, and short-lived cookies that carry a half-finished email sign-up or password reset between pages (they hold your address or a reset marker, are encrypted or signed, and last from a few minutes up to an hour). None of them is used for analytics or advertising. [COUNSEL CHECK C3]

Searches with no results. When a search returns nothing, we keep the search text, without your identity and without any link to your account, for 90 days, so we can see what people look for and do not find. [OWNER APPROVAL NEEDED]

3. IP addresses

We do not store IP addresses by default. Our host and network edge necessarily process IP addresses to deliver pages and block abuse, and may keep transient logs under their own policies (see Processors). The one exception is the sign-up digest abuse limiter: digest_signup_attempts stores a salted SHA-256 hash of the IP address (not the address itself) for about 1 day, only to rate-limit abuse, then deletes it. Our sign-in limiter, which slows repeated sign-in, email and password-check attempts, stores only a salted one-way hash of the IP address, email address or account id, with a counter, and deletes it after 24 hours. No other application table persists IP addresses. Our authentication service (Supabase Auth) records sign-in and password events in its own audit log, which includes IP addresses, kept under Supabase's policy.

4. Analytics (cookieless)

We use PostHog for aggregate page-level analytics, configured so that:

• no cookies and no browser storage identifiers are set; nothing is persisted between visits;
• no person is identified, aliased or grouped, and IP is discarded;
• autocapture, session recording, heatmaps and surveys are off;
• only a fixed list of events with category-type values is sent (for example: page viewed by route pattern, search submitted with a result-count bucket, review started/submitted with a length bucket, app opened, save toggled), never review text, search text, URLs, slugs or ids;
• private areas (admin, my, settings, notifications, saved, sign-in, digest links, interview forms, seeker profiles) are never tracked;
• Do Not Track and Global Privacy Control switch analytics off entirely, and you can opt out any time from the footer "Analytics" link.

Event list (must match code; a test checks this): session_start (entry source and a new/returning bucket), page_view, review_started, review_submitted, standing_info_opened, maker_reply_started, maker_reply_submitted, search_submitted, app_try_it_clicked, save_toggled, filter_applied, interview_opened, interview_finished, digest_join_submitted, digest_confirmed, feedback_opened, feedback_submitted. If PostHog keys are not configured, no analytics run at all. We currently show no consent banner because nothing identifies you. [COUNSEL CHECK C3]

5. Who sees your data

• Public: your profile, reviews, comments, questions, Standing, apps and interview answers you publish.
• Makers see aggregates about their apps (groups under 3 are hidden). They never see who viewed, saved or clicked. They never learn who reported content.
• Staff (admins/moderators) see what is needed to moderate and run the service.
• Other members never see your email.

6. Processors and transfers

Data may be processed outside your country. [COUNSEL CHECK C2]

7. Retention

Content is "soft-deleted" in normal use (hidden but kept, with edit versions) so that threads, ratings and moderation stay accurate. Soft-deleted content is not erased until your account erasure or a guarded erasure request.

8. Your rights

Subject to law you can: access your data; correct it; erase it; receive a portable copy; withdraw consent; object to or restrict processing; nominate a representative (DPDP); and complain to us, then to the Data Protection Board of India or your local supervisory authority.

• Download: Settings, "Download my data" gives a JSON file of your own data, once per day, delivered as a short-lived download (not emailed).
• Delete: Settings, "Delete my account". You confirm by typing a phrase and signing in again. For 14 days the account is in a grace period: writes (posting, reviewing, commenting and so on) are disabled and content stays visible unless you chose to remove it; sign in to undo. Then erasure runs.
• Other requests: email [CONTACT EMAIL].

9. What deletion does

• Deleted: profile text and avatar, saves, notifications, preferences, mutes, check-in prompts, votes, reading state, suggestions, digest rows, collections, company membership rows, pending invites, feedback.
• Your reviews, replies, comments and questions: you choose at deletion. Default is "keep, shown as Former member" (text stays, identity removed). Or "Remove them": text is blanked, including in version history, and reviews leave the rating. Comments you wrote on behalf of a company (shown with the company's name) are detached from you and stay as the company's content; your other comments are removed per your choice. [OWNER APPROVAL NEEDED]
• Other members' notifications: a notification already delivered to another member may contain your name in its text; it is not rewritten and expires with the 90-day notification retention.
• Apps you own: transfer them or unlist them first (an admin can restore an unlisted app for 30 days; the app's images are kept for those 30 days and then deleted). Apps of yours that were never published (drafts and rejected submissions) are deleted outright.
• Interviews where you are the founder: unpublished and erased by default. [COUNSEL CHECK C5]
• Kept, pseudonymised: moderation and audit records, and reports you filed (your identity removed), for security and abuse defence.

10. Age

PrimeChapter is for people 18 and over. We do not knowingly collect children's data. If we learn an account belongs to someone under 18 we will delete it.

11. Demo data

Some content shown during the beta is demo data created by us, not real members. Demo apps are labelled "Sample app".

12. Security and breaches

We use access controls, row-level security, rate limits and encryption in transit. Passwords are stored only as a one-way hash, must be at least 12 characters, and are checked against known breaches (only the first 5 characters of a one-way hash of the password leave our server, never the password). When you change your password we sign out your other devices and email you a notice; you can also sign out everywhere from Settings. We never ask for your password by email. If a breach affects your data we will notify you and the authorities as the law requires. No system is perfectly secure.

13. Changes

We will post changes here and, for material changes, ask you to accept again.