Privacy Policy

Last updated: 28 June 2026 · Effective: 28 June 2026

This Privacy Policy explains how The Animesh ("we", "us", the "Site") collects, uses, stores, shares and protects your personal data when you use the Site, and the rights you have over that data. We are committed to handling your data in line with the EU/UK General Data Protection Regulation (GDPR) and India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Who we are (data controller)

The Animesh is the controller responsible for your personal data. For any privacy question, request, or complaint, contact us at: xob23011@astra.xlri.ac.in.

2. What data we collect

• Account data you provide: username, email address, password (stored only as a salted bcrypt hash — never in plain text), preferred name, and optionally your organisation and designation.
• Sign-up context: how you heard about the Site (e.g. LinkedIn, WhatsApp, search engine), if you choose to tell us.
• Content you create: blog posts (if you are granted writer access), comments, reactions, follows, and reading-list entries.
• Technical data: a sign-in session cookie, a consent acknowledgement stored in your browser, and — for our aggregate visitor counter — a one-way hashed, non-reversible token derived from your IP address and browser type. We do not store your raw IP address against your identity for analytics.
• Google sign-in (optional): if you choose "Continue with Google", we receive your Google account email address and display name to create or sign you into your account. We never receive your Google password.
• Email subscription (optional): if you subscribe to new-post emails, we store your email address together with your confirmation and unsubscribe status.
• Browser push (optional): if you enable browser notifications, we store the push subscription your browser provides (an endpoint URL and keys) so we can send you new-post alerts. You can turn this off at any time in your browser.

3. How and why we use your data (purposes & legal bases)

4. Cookies and similar technologies

We use a strictly-necessary, HTTP-only, Secure, SameSite=Strict sign-in cookie to keep you logged in, and a companion CSRF-protection cookie. We store a small consent flag and your theme choice in your browser's local storage. We do not use third-party advertising or cross-site tracking cookies.

5. Content moderation

To keep the Site safe, posts and comments are automatically screened for adult, obscene, derogatory or otherwise prohibited language before publication. This screening uses an automated word filter and, where enabled, an automated AI moderation service. No fully-automated decision produces legal or similarly significant effects on you; you may edit and resubmit content, and you may contact us to contest a moderation outcome.

6. Who we share data with

We do not sell your personal data, and we do not share it for advertising. We share data only with infrastructure providers that operate the Site on our behalf (processors), under appropriate contractual safeguards:

• Managed database hosting (e.g. Neon) — stores the Site's data.
• Server/hosting provider (e.g. DigitalOcean) — runs the application.
• Transactional email delivery (e.g. Resend) — sends password-reset and account emails.
• Newsletter email delivery (Brevo) — sends the new-post emails you subscribed to. Brevo processes subscriber email addresses on our behalf.
• Authentication (Google) — if you use "Continue with Google", Google processes your sign-in; see Google's own privacy policy for how it handles your data.
• Browser push services (e.g. Google, Mozilla, Microsoft, Apple) — deliver the push notifications you enabled to your device.
• Optional AI moderation provider — receives the text of submitted content solely to assess it, when that feature is enabled.

We may also disclose data where required by law or to protect our legal rights.

7. International transfers

Our providers may process data outside your country. Where data is transferred internationally, we rely on appropriate safeguards such as the provider's standard contractual clauses and equivalent protections.

8. How long we keep your data

We keep account data for as long as your account exists. If you delete your account, your account record and associated comments, reactions, follows and reading-list entries are deleted. Aggregate visitor counts are non-identifying and retained indefinitely. Password-reset tokens expire within 30 minutes. Backups are rotated periodically.

9. Your rights

Subject to applicable law, you have the right to: access your data; correct it; delete it ("right to erasure"); receive a portable copy; restrict or object to certain processing; and withdraw consent at any time. You can exercise the core rights directly: export a machine-readable copy of your data and delete your account from the Privacy & data page when signed in. For any other request, email xob23011@astra.xlri.ac.in. You also have the right to lodge a complaint with your local data-protection authority (in the EU/UK) or the Data Protection Board of India.

10. Security

We protect your data with industry-standard measures: passwords hashed with bcrypt, encrypted (TLS/HTTPS) connections, HTTP-only Secure cookies, CSRF protection, a strict Content-Security-Policy, input sanitisation, parameterised database queries and rate limiting. No system is perfectly secure, but we work to safeguard your information.

11. Children

We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above and, for material changes, take reasonable steps to notify you.

13. Contact

Questions or requests: xob23011@astra.xlri.ac.in.

See also our Terms of Use.