Privacy notice

This notice explains what personal data India in Nutshell ("we") collects, why, and your rights under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The operator's legal name and address will be added here before launch.

What we collect, and why

• Mobile number (or Google email): to sign you in, prevent fake accounts, and allow one vote per person. Never shown publicly.
• Profile: username, display name, identity badge (self-declared), state/city or country. Used to show your posts and to split results. Your location is shown only at city or state level.
• What you post and how you vote: shown publicly, except your individual votes, which are private and only counted in totals.
• Optional details (urban/rural, age group, gender, occupation): only with your separate consent, used only in totals of 30 or more people, and withdrawable at any time.
• Security logs (IP address, device information, actions): to protect the service and meet legal duties. Kept for 180 days in India as required by CERT-In directions.
• Consent records: when you agreed to which notice version.

Who processes it

• Our hosting and database providers (Supabase; region: Mumbai, India) and our website host.
• Cloudflare, for security and bot protection (Turnstile).
• Anthropic (Claude), when AI moderation is enabled: the text of a post is sent to check it against our rules. Your phone number and identity are not sent.
• Your SMS provider, to deliver one-time codes.

We do not sell personal data, and we do not use it for advertising.

Your rights

• Access: download all your data from your profile.
• Correction: edit your profile at any time.
• Erasure: delete your account from your profile. Your votes and personal data are deleted. Your posts are deleted or kept as "Deleted user", as you choose.
• Withdraw consent for optional details at any time.
• Grievance: contact us via the Grievances page. If you are not satisfied, you may complain to the Data Protection Board of India.
• Nominate someone to exercise your rights in case of death or incapacity (contact us).

Children

This service is only for people aged 18 and over.

Data breaches

If a personal data breach occurs, we will inform affected users and the Data Protection Board as the law requires.

Retention

We keep your data while your account is active. Removed content and related logs are kept for up to 180 days for lawful investigations, then deleted. Long-inactive accounts will be deleted after notice.