Privacy Policy

1. Who we are

This policy applies to thindi.appand the Thindi service (the “Service”). For the personal data we handle, Thindi is the data fiduciary(the equivalent of a data controller) under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”). If you’re outside India and other laws apply to you, we aim to honour their core principles too.

2. The data we collect

Information you give us

• Account data — when you sign in with Google, your name, email address, and profile photo from your Google account; or when you sign in by phone, your mobile number.
• Profile data — a handle, display name, bio, and avatar you choose to set.
• Your content — verdicts, ratings, written notes, photos you upload, lists you build, and who you follow.
• Messages — anything you send us when you contact us for support or to raise a grievance.

Information we collect automatically

• Usage & device data — basic, largely aggregated analytics about how the Service is used (pages viewed, broad interactions), plus technical data such as IP address, browser type, and device information collected through standard server logs.
• Local storage & cookies — small amounts of data stored in your browser to keep you signed in and remember preferences (see section 7).

We do not intentionally collect sensitive personal data, and we don’t ask for payment information (the Service is free to use).

3. How we use your data

• to operate the Service — show rankings, save your verdicts and lists, and run your profile;
• to compute fair, aggregated dish scores and keep rankings honest (including detecting manipulation);
• to authenticate you and keep your account secure;
• to respond to your messages, support requests, and grievances;
• to understand and improve how the Service is used, and to fix and prevent problems;
• to comply with legal obligations and enforce our Terms of Use.

4. Our legal basis

We process your data on the basis of your consent, which you give when you create an account and post content, and for certain legitimate usespermitted under the DPDP Act (such as keeping the Service secure and meeting legal obligations). You can withdraw consent at any time (section 8); doing so won’t affect processing already carried out.

5. What’s public

Thindi is a community platform, so some things are public by design: your handle, display name, avatar, bio, your verdicts and ratings, and any public lists you create. Please don’t include anything in your content or profile that you wouldn’t want shown publicly. Your email address and phone number are not shown publicly.

6. Sharing & disclosure

We do not sell your personal data. We share it only:

• with service providers (data processors) who run our infrastructure under contract — for example Supabase (database, authentication and file storage), Vercel (hosting and privacy-friendly analytics), and Google (sign-in). They process data on our instructions only;
• when required by law — to comply with a valid legal request, or to protect the rights, safety, and security of Thindi, our users, or the public;
• in a business transfer — if Thindi is ever involved in a merger, acquisition, or asset sale, with notice to you.

7. Cookies & local storage

We use a small number of cookies and browser storage that are essential to sign-in and preferences, plus privacy-friendly, largely aggregated analytics to understand usage. We don’t use advertising or cross-site tracking cookies. You can clear or block browser storage in your settings, though some features (like staying signed in) may stop working.

8. Your rights

Subject to applicable law, you can:

• Access — get a summary of the personal data we hold about you;
• Correct — fix inaccurate or incomplete data (you can edit most profile and content data in the app);
• Erase — ask us to delete your account and personal data;
• Withdraw consent — stop further processing based on consent;
• Nominate — nominate another person to exercise your rights in the event of death or incapacity, as provided under the DPDP Act;
• Grievance redressal — raise a complaint with our Grievance Officer (section 12), and escalate to the Data Protection Board of India if unresolved.

To exercise any of these, contact us using the details below. We may need to verify your identity first. Note that deleting your account removes your profile and personal data; verdicts may be retained in an anonymised, aggregated form so rankings stay accurate.

9. Data retention

We keep your personal data for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain information to comply with law, resolve disputes, or enforce our agreements.

10. Security

We take reasonable technical and organisational measures to protect your data — including access controls, database row-level security, and encryption in transit. No method of transmission or storage is perfectly secure, but we work to safeguard your information and will notify you and the authorities of a significant personal data breach as required by law.

11. International transfers & children

Our service providers may store and process data on servers located outside India. Where they do, we rely on those providers’ safeguards and applicable legal protections. The Service is intended for users aged 18 and over; we don’t knowingly collect data from children. If you believe a child has provided us data, contact us and we’ll delete it.

12. Contact & Grievance Officer

For any privacy question, request, or complaint, contact our Grievance Officer on Telegram at t.me/koshikraj or via Instagram @thindi.app. We’ll acknowledge your request promptly and respond within the timelines required by law.

13. Changes to this policy

We may update this policy as the Service evolves or the law changes. We will revise the “Last updated” date above and, for material changes, give notice in the app. Please check back from time to time.

Thindi is an early-stage, independent project. This policy is written to be clear and honest; we’ll keep improving it as we grow and as data protection rules in India are finalised.