Privacy
Last updated
dernote is built to know as little about you as it can. No account, no name, no phone number. This page lists exactly what we keep and why, as required by the Digital Personal Data Protection Act, 2023.
What we collect
A device ID — a random number stored in a cookie for one year, so your links page works without a login.
Your city, roughly, from your IP address when you pay or write. We store the city, not the IP. It appears next to your link number (“#4,372 · Gurgaon”).
Payment references from the payment gateway: order ID, payment ID, amount, status. The gateway handles your UPI details; we never see your bank or UPI PIN. We may keep a one-way hash of your UPI ID to stop abuse — never the ID itself.
What you write — the text, and any voice note or photo you attach — and who read it (by link number and city, not by identity).
A push subscription, only if you turn on “Tell me when it’s read”. You can turn it off in your browser at any time.
Basic usage events (page viewed, paid, wrote, shared) tied to the device ID, to keep the product working and to count how the chain moves.
What we don't collect
No name, email, phone number, contacts, precise location, or advertising identifiers. We don’t sell data and we don’t run third-party ads.
Who sees what
The person (or people) the chain reveals your link to see your text and any media. Your text — never your media — becomes public on the chain’s unsealed page after the chain moves the stated number of links past yours. Everyone sees link numbers, cities and read counts. Nobody sees your device ID.
Service providers that process data for us: the payment gateway ([Razorpay/Cashfree]), hosting ([hosting provider]), media storage ([Cloudflare R2]), and the push-notification service of your browser. They process it only to provide the service.
How long
Links stay as long as the chain exists. Removed links are kept for up to 180 days for lawful requests, then deleted. Payment records are kept as long as tax and payment rules require. Devices inactive for two years are deleted.
Your rights
You can ask us what we hold against your device ID, ask us to correct or delete it, and withdraw consent for push notifications. Because we don’t know who you are, requests must come from the device or include your payment ID. Write to the grievance contact; we answer within the time the law requires.
Cookies
One cookie: the device ID. No tracking cookies. Clearing it disconnects your links page from your links; the links themselves remain in the chain. There are no accounts and no password resets — keep your link page.
Children
The site is not for anyone under 18. We don’t knowingly collect data from children.
Contact
Data requests and questions: [grievance email].