Legal
Privacy Policy
This Policy explains what personal data we collect, why, and how you can control it, in line with India's Digital Personal Data Protection Act, 2023 and the IT Act, 2000.
Last updated 2026-09-26
1. Who We Are
PENDING — see SETUP_REQUIRED.md, operating as syndromes.xyz, is the data fiduciary responsible for the personal data described in this Policy.
2. Information We Collect
| Data | Purpose |
|---|---|
| Full name, email, college, year of study | Create and manage your account, personalise your profile |
| Email & password (or Google/Apple sign-in identifier) | Authenticate you and keep your account secure |
| Bookmarks and reading progress | Let you resume and track your study across sessions |
| Subscription status and payment provider IDs | Grant access to paid case content and manage billing |
| Device and usage data (via Vercel Analytics and Speed Insights) | Understand aggregate site usage and page performance |
3. Legal Basis & Consent
We process your personal data on the basis of your consent, given when you create an account, and to perform our contract with you (providing the subscription you purchased). You may withdraw consent at any time by closing your account, subject to Section 13.
4. How We Use Your Information
We use your data to operate your account, deliver the case and article content your plan entitles you to, remember your bookmarks and reading progress, process payments, and respond to support requests. We do not use your data for anything beyond operating the service.
5. Payment Data
We never see or store your card, UPI, or bank account details. Web payments are handled entirely by Razorpay; iOS purchases by the Apple App Store; Android purchases by Google Play Billing. We receive only your subscription status and the payment provider's own transaction/subscription identifiers, which we use to grant access via the entitlements records tied to your account.
6. Cookies
We use only the essential session cookies set by Supabase Auth to keep you signed in. These are necessary for the service to function and are not used for advertising.
7. Analytics
We use Vercel Analytics and Vercel Speed Insights to understand aggregate traffic and page performance. These do not identify you individually in any report we access.
8. Sharing & Processors
We share personal data only with the service providers needed to run syndromes.xyz: Supabase (database and authentication), Vercel (web hosting, analytics, and speed insights), and Razorpay, Apple, or Google (payment processing, as applicable to the platform you subscribe on). We do not sell personal data to anyone.
9. Data Location
Your account and content data is stored with Supabase in the ap-south-1 (Mumbai) AWS region, in India. Where a payment or hosting provider processes data outside India as part of its own infrastructure, it does so only to the extent necessary to provide that service to us.
10. Data Retention
We retain your account data for as long as your account is active. After you delete your account, we retain the minimum records required for legal, tax, and fraud-prevention purposes, and delete the rest.
11. Security
Access to case content is enforced at the database level through row-level security tied to your entitlements, so content you have not paid for cannot be fetched by any client. Payment status is written only by server-side functions, never by client apps.
12. Your Rights
Under the Digital Personal Data Protection Act, 2023, you have the right to access, correct, and request erasure of your personal data, to seek grievance redressal, and to nominate another individual to exercise your rights in the event of your death or incapacity. To exercise any of these, contact our Grievance Officer under Section 16.
13. How to Delete Your Account
To delete your account and associated personal data, email privacy@syndromes.xyz from your registered email address. We will confirm once your data has been deleted, subject to the retention described in Section 10.
14. Children
syndromes.xyz is intended for users aged 18 and over; we do not knowingly collect personal data from children.
15. Changes to This Policy
We may update this Policy from time to time. The date at the top of this page reflects the last revision; continued use of the service after an update means you accept the revised Policy.
16. Grievance Officer
For any privacy question or complaint, contact our Grievance Officer at privacy@syndromes.xyz. We aim to acknowledge and resolve grievances within 30 days. See also our Terms & Conditions and Contact Us page.