Puthiverse

Legal

Privacy Policy

Effective date: 15 July 2026

This policy explains what personal data Puthiverse collects, why we collect it, how we protect it and what choices you have. We aim for plain language over legalese. If anything is unclear, please write to us.

1. Who is responsible

For the purposes of the Digital Personal Data Protection Act, 2023 (India) and the EU General Data Protection Regulation, the data controller is the Puthiverse team, reachable at puthiverse@gmail.com.

2. Data we collect

  • Account data — the name and email address you supply at sign-up, plus a bcrypt-hashed password. We never see, store or transmit your password in plain text.
  • Profile data — optional bio, location, avatar URL and structured social links you choose to add.
  • Reading activity — books added to shelves, star ratings, written reviews, follows and reactions.
  • Technical data — short-lived server logs containing IP address, user-agent, timestamp and request path, used only for debugging, security and abuse prevention.
  • Contact-form data — the name, email and message you send via /contact.

3. Data we do not collect

  • We never sell personal data.
  • We do not use third-party ad networks, behavioural advertising or cross-site tracking pixels.
  • We do not read your reviews to build advertising profiles.
  • We do not collect precise geolocation.
  • We do not knowingly collect data from children under 13 (see §10).

4. Why we process this data

  • To operate the Service — shelves, reviews, recommendations, follows.
  • To let readers discover your public profile, reviews and shelves.
  • To send transactional email — verification and password reset — via our email delivery partner (Resend).
  • To reply to your contact-form submissions.
  • To keep the platform secure and free of abuse.

5. Legal basis

We rely on: (a) Contract — necessary to deliver the Service you signed up for; (b) Legitimate interests — securing the platform, product improvement; (c) Consent — for optional communications you explicitly opt into.

6. Cookies

We use two secure, HTTP-only cookies — access_token and refresh_token — to keep you signed in. They contain a cryptographically signed session identifier and no personal data. We do not use analytics, marketing or advertising cookies, which is why you do not see a cookie banner.

7. Storage and security

  • Data is stored in an encrypted-at-rest MongoDB cluster on managed cloud infrastructure.
  • Traffic is served exclusively over HTTPS (TLS 1.2+).
  • Passwords are hashed with bcrypt using a per-user salt.
  • Verification tokens expire within 24 hours; password-reset tokens within 1 hour, and are single-use.
  • Access to production is limited to a small number of maintainers with audit logging.

8. Data sharing

We share personal data only in narrow circumstances:

  • Service providers — our hosting, database and email-delivery vendors (currently Resend) process data on our behalf under strict confidentiality obligations.
  • Legal requirements — where required by law, court order, or to protect the rights, property or safety of Puthiverse, our users, or the public.
  • Business transfers — in the unlikely event of a merger, sale or wind-down; users will be given the option to delete their data first.

9. Your rights

Under the DPDP Act, GDPR and analogous laws you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — correct inaccurate or incomplete data.
  • Erasure — delete your account and all associated reviews, ratings, shelves and follows.
  • Portability — receive your data in a machine-readable format (JSON).
  • Withdraw consent — for any processing that relies on consent.
  • Complain — to your national data-protection authority.

To exercise any right, write to puthiverse@gmail.com. We action deletion requests within 30 days.

10. Children's privacy

Puthiverse is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided data to us, please contact us and we will delete it promptly.

11. Retention

Account data is kept for as long as your account is active. If you delete your account, we permanently remove personal identifiers within 30 days. Anonymised aggregate statistics (for example, "the average rating of Miri Jiyori is 4.6") may be retained indefinitely.

12. International transfers

Our servers may be located outside your country of residence. Wherever your data is stored, it remains protected by the safeguards described in this policy.

13. Changes to this policy

We may update this policy from time to time. Material changes will be announced on the site and, where possible, notified to registered users by email. The effective date at the top always reflects the most recent version. Continued use after the effective date constitutes acceptance.

14. Contact

Questions, requests or complaints about privacy? Write to us at puthiverse@gmail.com or via our contact form.