Privacy notice

This site is run by an individual, not a company. It is a personal blog at kothari.info, published by Sunny Kothari from Mumbai, India. For the purposes of the DPDP Act I am the Data Fiduciary and you are the Data Principal. Contact for anything on this page: hello@kothari.info.

Only what a stated purpose needs, and nothing kept “just in case”.

Your account and everything attached to it stay until you delete it, which you can do yourself from the account page at any time. Newsletter details until you unsubscribe, then deleted rather than flagged. Unconfirmed sign-ups are cleared after thirty days. Comments stay while the piece stays published; deleted comments are recoverable for thirty days and then purged. Messages sent through the contact form are kept for a year; grievance records for three, because the IT Rules require the resolution to be evidenced. Aggregate counts are kept indefinitely because they hold no personal data.

Under the DPDP Act you may, at any time and free of charge:

Every one of these is on the account page, or by writing to hello@kothari.info. Requests are acknowledged within 48 hours and completed within 30 days.

The notice shown on your first visit lists each purpose separately and defaults everything optional to off. Reopen it from the footer at any time to change or withdraw a choice. Withdrawal stops future processing; it does not undo what was lawfully done before.

Signing in is optional. You can read everything here without an account; an account exists so that a comment has somebody’s name on it and so you can take it down again. Google is the only way to sign in, which means there is no password here to lose.

What Google gives me. The sign-in asks Google for three basic permissions —openid, email and profile — and nothing else. From those I receive:

What Google does not give me. No Gmail, no Drive, no Calendar, no Contacts, no Photos and no Google data of any other kind: those permissions are never requested, so they cannot be granted. I never see your Google password. Nothing is read from your Google account after the moment you sign in, and no Google API is called on your behalf.

What is done with it. Your name and picture are stored so your comments have an identity; your email address and account identifier are stored so the account can be recognised and reached. Your name and picture are public, because a comment carries them. Nothing received from Google is used to advertise to you, is sold or traded, is given to a data broker, or is used to train a machine-learning model — mine or anyone else’s.

Where it sits. In this site’s own database, run for me by Supabase and reachable only over TLS, with access limited to me. It is shared with no one except the providers named in clause 07, each of which acts on my instructions and may not use it for its own purposes. It is disclosed further only if a law or a court in India requires it.

How to end it. Delete your account from the account page and your profile, comments, likes, saved pieces and reactions go with it — completed within 30 days and usually the same day. You can separately withdraw this site’s access from your Google account at myaccount.google.com/permissions; that stops future sign-ins, and to remove what is already here use the account page or write to hello@kothari.info.

This site’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

A one-person site still runs on other people’s machines. Each provider below receives only the data its function needs, acts on my instructions under its own contract, and may not use what it receives for its own purposes.

Some of these operate outside India. Where that happens the transfer follows the restrictions notified under the DPDP Act, and no transfer is made to a territory the Central Government has restricted.

There is no advertising cookie here and no cross-site tracker of any kind. What the browser stores is short: the cookies that keep you signed in after you choose Google, which are cleared when you sign out; your consent choices and your light-or-dark preference, which stay in your own browser and are never sent anywhere. Page counts are taken without a cookie.

Stated plainly, because “we may share your data with partners” is the sentence this clause exists to refuse. Nothing collected here — from Google or from anywhere else — is sold, rented, traded or given to a data broker. None of it is used for advertising, ad targeting or ad measurement. None of it is used to build a profile of you, on this site or across others. None of it is used to train a machine-learning model, mine or anyone else’s, and none of it is passed to a human to read except me, and only where a purpose in clause 02 requires it.

This site is not directed at children, and I do not knowingly process the personal data of anyone under eighteen. I do not carry out tracking, behavioural monitoring or targeted advertising at all. If you believe a child’s data has been submitted, write to me and it will be deleted.

Data sits on managed infrastructure with access limited to me, served over TLS, with row-level rules in the database so one reader cannot reach another’s. If a personal data breach occurs I will notify every affected person and the Data Protection Board without delay, describing what happened, what it affects and what to do about it.

Grievance Officer: hello@kothari.info. Complaints are acknowledged within 24 hours and resolved within 15 days, in line with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. If you remain dissatisfied you may approach the Data Protection Board of India. The full process is on the grievance page.

Material changes are announced here and in the newsletter before they take effect, with the previous version linked. The version and date above always describe what is currently in force.