Who we are
This policy is published by Anandians Connections (OPC) Private Limited, registered office: C/O Alka Anand, VILL-Rajpur, Panchrajpur, Dehri-on-Sone, Rajpur (Rohtas), Bihar – 802219, India. Our postal address for notices: C/O Alka Anand, VILL-Rajpur, Panchrajpur, Dehri-on-Sone, Rajpur (Rohtas), Bihar – 802219, IndiaProposed · to be confirmed.
For any question about how we process your personal data, write to Pratyush Anand, who answers on our behalf, at [email protected] with the subject “Data question”. We are not required to appoint a Data Protection Officer unless we are notified as a Significant Data Fiduciary; if that happens, this section will name one.
What this covers
- This website, anandians.com. It sets no cookies, runs no analytics and loads no third-party scripts. Its fonts are served from our own domain. If you choose a colour theme, that choice is kept in your own browser (local storage) and never sent to us.
- Our apps, starting with Chat — on the web at anandians.com and, when it is published, on Android.
What we collect, and why
We list each kind of data, what we use it for, and the part of the service it makes possible. This is the same list a copy of your data contains: in the app, Account › Download your data gives you an archive with one file per kind and a checksum for each. Live
| Data | Why we use it | Basis |
|---|---|---|
| Your account: email address, phone number (if you add one) and whether each is confirmed; how you signed up; whether two-step sign-in is on; the terms you accepted | To create your account, let you sign in, and keep it secure | Providing the service; your consent to the terms |
| Accounts you sign in with, such as Google | To let you sign in without a new password | Your consent |
| Sessions and devices: when you signed in, from which address (IP address), and the browser or app you used (its user agent) | To keep your account secure and let you sign out other devices | Providing the service; security |
| Profile and username | So the people you talk to know who you are | Providing the service |
| Organisations you belong to | To show you what you are a member of | Providing the service |
| Conversations, the messages you send, and your reactions | To deliver them to the people you choose | Providing the service |
| Files and photos you upload, and their details | To store them and show them to the people you share them with | Providing the service |
| Photos and Social: your photo posts and their captions, your posts in groups, your comments and likes, the people you follow, and the groups you create or are added to | To show them to the people they are shared with, and — only when you choose For you — to order your feed by your own recent posts in your groups | Providing the service |
| Notification settings, registered devices, and the notices in your inbox | To notify you the way you chose, and not otherwise | Providing the service; your choices |
| The Android app’s notification token: a code from Google’s Firebase Cloud Messaging that lets a notification reach the app on this phone. The app sends it to us the first time it opens, before you sign in; it is linked to your account while you are signed in, and stays with us, linked to no one, after you sign out | So notifications can reach the app on this phone; while you are signed in, only your own | Providing the service |
| Crash reports (Android app), only if you turn on “Share crash reports” in About and privacy — it is off until you do: what failed and where in the app’s code, the device model, operating system, processor, memory and storage, the app version, and random identifiers for the app install. We attach no account, name or message to a report | To find and fix crashes. Reports go to Google (Firebase Crashlytics), which keeps them for 90 days. Turning the switch off stops reports and deletes any not yet sent from the phone; crashes from before you turned it on are never sent | Your consent (the switch) |
| A record of the actions you take | Security, investigating misuse, and our duties under the law | Legal duty; security |
We do not sell personal data, and we show no advertising.
Who helps us
We use a small number of providers to run the service, each for its own part:
Hostinger (our server) · Cloudflare (network, file storage and email routing) · Resend (sending email) · Backblaze B2 (encrypted backups) · Google (sign in with Google, and push notifications)Proposed · to be confirmedWhere each provider stores data: To be confirmed. Our own production server is in India. Live
If you turn on crash reports in the Android app, they go to Google (Firebase Crashlytics) — see what we collect.
We share data with a government agency only when the law requires it — under the IT Rules, within 72 hours of a lawful written order.
How we protect it
- Every connection to this site and to our apps is encrypted (HTTPS). Live
- Checking every upload for malware before it becomes a file: proven on our test environment, not yet confirmed on production. In development
- Who is calling, and from which app, is checked by our own gateway on every request; a forged identity is refused.
- Messages are not end-to-end encrypted. Planned
- No independent security audit has been done yet. Planned
More in our security policy.
How long we keep it
- When you delete your account: Your profile, settings and memberships, your sign-in, and every device you are signed in on. Your files and photos are hidden at once and erased for good after 7 days. They stay in the other people’s conversations, without your name.
- A security record of actions on an account is kept, to protect people and meet the law.
- Sign-up information is kept for 180 days after an account is closed, where the IT Rules (rule 3(1)(h)) require it.
- Content we remove, and the records about it, are kept for 180 days for investigation, as rule 3(1)(g) requires.
- The Android app’s notification token is deleted when Google answers a notification by telling us the app was removed or the token no longer works. Tokens that are simply unused are not yet removed on a schedule.
- Encrypted backups roll over and are gone within 6 months. Server logs are kept for 14 days.
The full steps are on delete your account.
Your rights
The rights in sections 11 to 14 of the Digital Personal Data Protection Act, 2023 apply from 13 May 2027. We honour them now. You can:
- ask for a summary of the personal data we hold about you and who we have shared it with;
- correct or update it;
- have it erased — see delete your account;
- withdraw your consent as easily as you gave it;
- nominate someone to act for you.
To make a request, write to [email protected] from the email address on your account. We identify you by that address or by your username (rule 14(1)(b) of the DPDP Rules).
Complaints
- First, write to our grievance officer. We acknowledge a complaint within 24 hours and resolve it within 7 days — the IT Rules limit, which is stricter than the ninety days the DPDP Rules allow.
- Once the DPDP Act is in force, you may complain to the Data Protection Board of India after using our process (section 13(3)).
- You may also appeal to the Grievance Appellate Committee within 30 days of our decision (rule 3A of the IT Rules).
Children
The DPDP Act treats anyone who has not turned eighteen as a child, and requires verifiable parental consent before a child’s data is processed. Until we have a way to collect that consent, our apps are for people aged 18 and overProposed · to be confirmed.
Changes to this policy
When this policy changes, its version and dates change at the top of this page, and we tell people who use our apps in the app and by email. We also remind users of our rules, privacy policy and terms every three months, as the IT Rules require (rule 3(1)(c)).
Privacy policy · Version 1.2 · effective · last reviewed · not yet reviewed by counsel. Questions: contact us. Back to the Trust centre.