ஆவணம் வந்துகொண்டிருக்கிறது.
Version 1.3, in force from .
[not yet published: the operator's legal name], [not yet published: the operator's address], decides why and how personal data is used on Arasiyal.ai and is the Data Fiduciary under the Digital Personal Data Protection Act, 2023. Questions and requests go to the Grievance Officer: [not yet published: the Grievance Officer's name], [not yet published: the Grievance Officer's email address].
We do not ask who you are to read the site, and the site itself sets no cookies. It keeps a few things in your browser's own storage, on your device: your language; a random reader number made in your browser (see below); your Daily Five streak and the day you last read the brief; the seat you marked as yours; a copy of the site's public settings and of the member count it last showed, so that the next page opens faster; the first few names on the day's home page, so that the page "Who is carrying this" can suggest them; and, if you opened a member's invitation link, the member number that link carried, which stays until you join and is then removed. Some things are kept only while the tab is open and are forgotten when it closes: your sign-in, if you signed in; your member number, so that the home page can link to your card; anything you have started typing in a post or a comment; and the questions you asked Ask Arasiyal (/ask) with their answers. You can clear all of these at any time by clearing the site's data in your browser.
If your browser allows it, the site also keeps pictures, fonts and icons, and a copy of each public page without its data, so that pages open faster and a visit without a connection shows the site's own page. Pages that belong to an account (sign-in, account, member card) and the admin pages are never kept, and a kept copy of a page is not used once it is a week old.
The random reader number is sent with a tone, a guess or a quiz answer, so that one browser counts once. The server does not keep the number itself: it keeps a scrambled form of it, made with the server's secret, which cannot be linked to a name.
To know how many people read the site and how many come back, each page you open sends the server two things: the address of the page and the random reader number your browser keeps. For each day (India time) the server keeps a count of views for each public page and, to count different and returning browsers, a salted SHA-256 hash of the reader number with how many pages it opened that day. The salt comes from the server's secret, so the number itself is never stored and cannot be worked back from the hash. No network address, no browser details and no account is stored with it, and the server's own access log leaves these page views out, so that no address sits beside the moment a page was counted. The hashes are deleted after 35 days; the daily counts of pages are kept.
Nothing is sent from the admin pages, and nothing at all if your browser sends a Do Not Track or Global Privacy Control signal. There is no third-party analytics on the site and no advertising identifier.
Like every website, the server that sends you a page receives your network (IP) address, the kind of browser you use and the time. Our hosting provider keeps these in its logs for security and to find faults. We do not use them to follow what an identified person reads.
If you ask a question at /ask, we keep the question, the language you asked in, the answer and its sources, whether the record held the answer, and how much the AI call used, so that the owner can see what readers ask and how often the record answers it. Nothing that names you is kept with it: no name, no email address, no network address. To count the day's questions (20 for a browser, 60 for a member), a salted SHA-256 hash of your browser's random reader number, or of your account if you are a signed-in member, together with the day, is kept with the question; the salt comes from the server's secret, the hash changes every day, and it is cleared after two days. The same question asked again within ten minutes is answered from the stored answer. So that one sender cannot use up the whole site's questions for a day, the server also counts, in its memory only, how many questions came from each network address that day, under a salted hash of the address; the count is not written anywhere and is forgotten when the day turns.
We ask for and keep: your email address, to sign you in and to answer you; your password, kept only as a one-way scrambled value (scrypt with a salt) that we cannot read back; the name you want shown on your posts; your district, if you choose to give it, to show posts from your district; the time the account was made, the time you joined, the time you last signed in and the number of failed sign-in attempts, for security; and the edition of these documents you agreed to and when.
Each time you sign in we keep a record of that session: when it started, when it ends (12 hours later), and the network address and kind of browser it came from. A session's record is deleted when you sign out of it or close the account; a password reset deletes every session's record, and a password change every one but the session you changed it in. A session that simply ran out is kept until one of those happens.
When you join you are given a member number, in the order in which people joined, and we keep it with your account. It is shown to you, on your account page and on your card, and is not published anywhere on the site: there is no public page for a member and no way to look a member number up. Your member card (/card) is drawn in your own browser from your display name, your district if you gave one, your member number and the day you joined. We do not make, receive or store the picture. Other people see it only if you save it and share it yourself. A member number is never given to anyone else, even after the account is closed.
Invitations: the link your card's "Share" button sends carries your member number. If someone opens that link and later joins, we keep your member number on their account, as the number of the member whose link they arrived by. You are shown how many members joined from your link, never who they are; they are not shown who you are. If either account is closed, the number is removed from that record.
If you tick "Email me when the app is out" on the page /app, we keep that choice with your account and will use your email address once, to tell you that the phone app is out. You can take the tick back on that page at any time, and the choice is deleted within a day of the account being closed.
What you post on the floor and in comments is public. It is shown with your display name, and a floor post with your district if you gave one. Do not put personal data, yours or anyone's, in a post.
If you forget your password and ask for a new one, we send a link to the account's email address. The link works for 30 minutes and only once. We keep the time of the request and the network address it came from for one day, to limit misuse.
If you follow people, parties, seats or topics, we keep that list against your account. It is private to you: it is not shown to anyone else, and it is used only to show you what is new on each and, if you ask for them, to send you alerts. An item is deleted when you remove it, and the whole list within a day of the account being closed.
If you buy a plan we keep, for each order and payment: Razorpay's order and payment references, our receipt number, the plan, the amount, the period, whether it succeeded, failed or was refunded, and the times. If your plan includes the daily brief or alerts and you ask for them, we use your email address to send them, and you can stop them on your account page at any time. If you paid for a plan and the site can send email, we email you once when its end is near.
For staff accounts we also keep an authenticator secret in encrypted form and backup codes in scrambled form.
We do not collect your phone number, your precise location, your contacts, your government identity numbers, or your caste, religion or political affiliation. We do not build a profile of your political views. A tone you give is never shown with your name, and tones are shown only as totals.
We show no advertising, use no third-party analytics and no advertising identifier, and do not sell, rent or trade personal data.
We use account data only to run your account: to sign you in, to show your posts under your name, to apply the limits and rules of the floor, to keep the site secure, to answer you, and to meet legal duties. The basis is your consent, given by a clear action when you join, for these stated purposes. You can withdraw it at any time; when you do, we close the account.
Where a law requires us to keep or hand over information, the basis is that law.
Hosting: the site and its database run on Railway (Railway Corp., USA). At present the servers are in a data centre in the Netherlands. Your account data is therefore stored outside India. We will move or stop using any location that the Government of India restricts.
Google: every page loads its fonts from Google Fonts, and the home page loads videos' pictures from YouTube. When you play a video, YouTube's player loads, and the Troll page loads YouTube's player script. Each time, Google receives your network address and browser details, and when you play a video YouTube may set cookies, under Google's privacy policy.
AI providers: to write and read, the site sends public material to the providers of the AI models it uses, at present Anthropic and, when video reading is switched on, Google: headlines and video titles with their channels, the address of a public video, what was said in public, rows of the record, and public comments without their writers' names. The admin console also sends what a member of staff types into it and what its tools find (the site's settings and counts, and the record). A question typed into Ask Arasiyal (/ask) is sent with the rows of the record found for it, and nothing else about who asked. No reader's or member's account data, posts, comments or tones are sent to an AI provider: posts and comments are checked against a word list on our own server.
Email: when the site sends an email (a password-reset link, a renewal reminder, the daily brief or alerts), the email delivery service it uses receives the address and the message in order to deliver it.
Payments: if you buy a membership plan, Razorpay takes the payment in its own checkout under its own privacy policy. Razorpay receives from us the amount, our receipt number, our own number for the order and the plan, and your account's email address is filled into its checkout for you; it sends us back its order and payment references and whether the payment succeeded, failed or was refunded. If a "Support us" button is shown and you use it, you pay on the operator's own Razorpay payment page: Razorpay passes to the operator, in its dashboard, what you typed on that page, the amount and the time. The site's own database records nothing about a contribution, and never your card or bank details.
Sharing: a "Share" button opens WhatsApp with a message you can change. Nothing is sent unless you send it there.
Authorities: we disclose information to a court or a government agency only where a lawful order or the law requires it, and only what it requires.
No one else receives your personal data.
The site reports what public figures say and do in public, from what they or the media have made public. It does not report their private or family life.
Viewers' comments shown from under YouTube videos are public comments, shown without their writers' names or handles. If one of them is yours and you want it removed, write to the Grievance Officer.
While your account is open we keep its data. A floor post you take down leaves public view at once and is kept, out of view, with the account.
When an account is closed, whether you close it or withdraw your consent: at once, your posts and comments leave public view; your name, district, password, member number, the invitation number on your account, your tones, guesses and quiz answers, your sign-in sessions and your reset links are deleted, and your email address is replaced. Within a day, what you followed and your email choices are deleted. After 30 days, your posts and comments are deleted. After 180 days, the registration record is deleted: a scrambled form of your email address, which can be matched against an address named to us but cannot be read back, and the dates the account was made, last signed in, agreed to the terms and was closed. The 180 days are those set by rule 3(1)(h) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Anything a law or an order requires us to keep longer is kept for that time.
Payment records (the references, amount, plan, period, status and times listed above) are kept after the account is closed, because the law requires records of payments to be kept for some years; nothing deletes them automatically. A closed account that has one keeps an empty line, with no name, email address or password, so that the record can stand.
The scrambled reader numbers used to count readers are deleted after 35 days. Tones, guesses and quiz answers given without an account are kept with their own scrambled form of the reader number; nothing deletes them. Requests for a password-reset link are deleted after one day.
Server logs are kept by our hosting provider for the period it sets and by us for no longer than one year. Backups, where they are kept, are overwritten within 35 days.
Records of complaints and of what was done about them are kept for at least three years.
You may ask us: for a summary of the personal data we hold about you and what we do with it; to correct, complete or update it; to erase it; and for the names of anyone it has been shared with. You may withdraw your consent, which closes the account. You may name another person to exercise these rights if you die or lose capacity.
You can correct your name and your district, change your password and close your account yourself, at any time, on the "My account" page.
Write to the Grievance Officer from the email address of the account. We answer within 7 days. If you are not satisfied with the answer you may complain to the Data Protection Board of India.
You also have duties under the Act, including not to give false details and not to make false or frivolous complaints.
Making an account and joining are for people aged 18 or over; joining asks you to confirm your age. We do not knowingly collect personal data of anyone under 18, do not track or watch the behaviour of children, and direct no advertising at them. If you believe a child has an account, tell the Grievance Officer and we will close the account and delete its data.
Passwords are stored only as scrambled values, and staff authenticator secrets are encrypted. An account is locked for 15 minutes after five failed sign-ins. A session ends after 12 hours. Staff must use an authenticator code. Connections to the site are encrypted.
No system is perfectly secure. If personal data we hold is breached, we will tell each affected person without delay what happened, what it may mean for them and what we are doing, and will report it to the Data Protection Board of India within the time the law sets.
The edition in force and its date are shown at the top of this page, with a list of what changed. How a change is announced is set out in the Terms of use, under "Changes to these terms".
இந்தத் தளம் கட்டுமானத்தில் உள்ளது: சில பகுதிகள் மாறலாம் அல்லது வேலை செய்யாமல் போகலாம். AI தவறு செய்யக்கூடும்.தளம் கட்டுமானத்தில் · AI தவறு செய்யக்கூடும் மேலும்
ஆவணம் வந்துகொண்டிருக்கிறது.