Who we are

ingrid.fyi is operated by Gridilytic Pvt. Ltd., based in Bangalore, India ("Ingrid", "we", "us"). This policy explains what personal data we collect, why, how we handle it, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

What we collect

We collect only what the service needs:

• Account data. When you sign in with Google, we receive your name, email address and profile picture, and Google's identifier for your account. We never see your Google password, and we keep nothing else from Google.
• Reading data. For each account, when your current free reading window started, when your pass ends, and the days on which you visited while signed in. We do not link the pages you read to your account.
• Payment data. When you buy a pass, Razorpay takes the payment. We receive a confirmation and Razorpay's references, and we keep a record of each purchase: the pass, the amount, its status and when it happened. We never receive or store your card, UPI or bank details.
• Technical data. Our servers keep basic logs to run and secure the service. The logs do not include your IP address.
• Usage data. We use Google Analytics to count visits and see which pages are read. It records the address of the page, where you came from, your browser and device type, your approximate location, and a random identifier kept in a cookie on your device. It does not receive your name, email address or account details, and we do not connect it to your account.

We use no advertising tools, and we do not follow you across other sites.

How we use your data

We use your data to:

• Sign you in and keep your session.
• Decide what you can read: your free reading window, or your pass.
• Take payment for a pass, start it, and email you the receipt.
• Operate, secure, debug and improve the service.
• Count visits and see which pages are read, so we know what to improve.
• Respond to your requests.

We do not sell your personal data.

Cookies and browser storage

We use a small number of cookies. Most are our own, for signing in and for security, and none of them is for advertising:

• Session cookie. Set when you sign in, so we know it is you on each request. It lasts 30 days from your last visit. Signing out ends the session at once.
• Signed-in flag. Tells the page to show the header as signed in. It carries no data, and it starts and ends with the session cookie.
• Reading cookie. A short-lived cookie, valid for 15 minutes at most, that lets pages load quickly while you are signed in.
• Security cookies. These protect sign-in and signed-in actions against forged requests. Most last between ten minutes and a day; one lasts 30 days.
• Analytics cookies. Google Analytics sets two cookies, one named _ga and one whose name starts with _ga_. They hold a random identifier so it can tell visits apart, and they last up to two years. They are set on every page, whether or not you are signed in.

You can stop Google Analytics by blocking its cookies in your browser or by installing Google's opt-out add-on. The pages work the same either way.

Your browser also keeps two small notes for us: your name and picture, so the header can show them before the page finishes loading, for 29 days at most; and a note that you signed out, so the sign-in prompt does not sign you straight back in. Neither is used to decide what you can read, and you can clear both at any time.

The pages work without signing in. Signed-out readers see Google's sign-in prompt, which is loaded from Google and covered by Google's own privacy policy.

Consent and legal basis

We process your personal data on the basis of the consent you give when you sign in and use the service, and where applicable for legitimate uses permitted under the DPDP Act, such as security and meeting legal obligations. You may withdraw consent at any time, as described under "Your rights" below. Withdrawing consent may mean parts of the service can no longer work for you.

Who processes your data

We use a small number of service providers (data processors) to run Ingrid. They process your data only on our instructions:

• Cloud hosting and storage: Amazon Web Services. Your account, your sessions and your purchase records are stored in the AWS Mumbai region, in India.
• Sign-in: Google, when you sign in with your Google account.
• Analytics: Google, through Google Analytics, which counts visits to the pages.
• Payments: Razorpay, when you buy a pass.
• Email: Amazon Web Services, which sends your receipts.

Where a provider processes data outside India, we rely on the transfer mechanisms permitted under applicable law.

How long we keep it

We keep your account data for as long as your account exists. A session ends 30 days after your last visit, or when you sign out. The days you visited while signed in are kept for up to 400 days. Server logs are kept for one month. Records of purchases are kept even after an account is deleted, because tax and audit rules require it. You can ask us to delete your account and your data, subject to those obligations, using the grievance contact below.

Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Ask us to correct or update inaccurate or incomplete data.
• Ask us to erase your personal data, subject to legal retention requirements.
• Withdraw consent.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Raise a grievance with us, and escalate to the Data Protection Board of India if it is not resolved.

To exercise any of these, contact our Grievance Officer below.

Security

We take reasonable technical and organisational measures to protect your data against unauthorised access, loss or misuse. No system is perfectly secure, and we cannot guarantee absolute security, but we work to keep your data protected and to address issues promptly.

Children

Ingrid is intended for people who can lawfully enter into a contract. It is not directed at children. We do not knowingly collect personal data from children in a manner that requires verifiable parental consent.

Grievance Officer

If you have any question, request or complaint about your personal data, contact our Grievance Officer:

Name: Aunindo Shankar
Email: support@ingrid.fyi

We will acknowledge and respond to grievances within the timelines required under the DPDP Act.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the "last updated" date above and, where the change is significant, take reasonable steps to tell you.