Privacy Policy

DS Colony · Last updated 1 October 2026

[Beta draft — flagged for legal counsel review. This document honestly describes what the product actually does with data today. It maps to the Digital Personal Data Protection framework and the IT Rules as we understand them, but it is not legal advice and counsel review is scheduled before public launch beyond closed beta.]

1. Plain-language summary

Your email, name, and learning data are private. Nothing about you is public unless you explicitly turn a public toggle on — and those toggles are off by default. Your community posts and comments are publicly readable by design (that is what a discussion board is); your direct messages are readable only by the two people in the conversation. You can delete your account yourself, at any time, from Settings.

2. What we store, and who can see it

• Account data (private): email address, name, password (scrypt hash — never plain text), sign-in provider, verification state. Your email is never shown to other users.
• Profile data (private until you opt in): headline, bio, target role, location, GitHub/LinkedIn links, username. A username by itself never publishes anything — your public portfolio page and recruiter visibility are separate, off-by-default switches.
• Learning data (private): skill levels, assessments, practice attempts, projects, experiments, research workspaces, evidence records, certificates (including verification codes), notes and web clips.
• Community content (public): posts and comments are readable by anyone, including signed-out visitors. The author name, username (if public), and headline appear with your content.
• Direct messages (member-only): 1-to-1, text-only. Only the two conversation members can read them. The single exception: a reported message can be reviewed by the human moderation queue — that review path is role-gated and logged.
• Notifications (private): your notification list is visible only to you. Message notifications reference the conversation; they do not copy message content.
• Technical/security data (private): session tokens (30 days), login events, rate-limit counters (in-memory, never persisted). We keep security logs for protecting accounts.
• Usage analytics (internal): event records of actions you take on the platform (e.g. "lesson completed"), and AI-usage metadata (the AI features are not active in closed beta). These are used to understand and improve the product, not for advertising. We do not run third-party trackers or advertising pixels.
• Google sign-in: if you use Google to sign in, Google shares your email and name with us via OAuth; we store only those two fields. Google is a recipient in your sign-in flow.

3. Your consent toggles

Two switches control everything that could expose you publicly, and both are off by default for every account, new and old:

• Public portfolio — when on, anyone with your /p/<username> link can see your headline, bio, skills, evidence, experiments, and certificates. When off, that link returns "not found".
• Recruiter discovery — when on, recruiters using the company console can find you in talent search (headline, skills, evidence titles, portfolio link). When off, you are invisible to talent search.

Existing accounts are never silently switched on. Find these toggles in Profile → Edit profile, and in Settings → Privacy. Turning them off again is immediate.

4. Your rights

• Access: most of your data is visible to you directly in the product. For a copy of what we hold, email the contact below.
• Correction: profile fields, username, goal, and interests are self-service. For anything not editable in the product, email us and we will correct it.
• Erasure: Settings → Delete account removes your account and learning history immediately and by yourself (details in §5). No email, no waiting period.
• Withdraw consent: turning off the public/recruiter toggles stops public processing of those fields immediately. Withdrawing consent for the account itself is account deletion.
• Grievance: Ankush Jha is our Grievance Officer and personal-data contact point: [email protected]. Complaints are acknowledged within 24 hours and resolved within 15 days.

5. Account deletion — exactly what happens

When you delete your account (Settings → Delete account, with confirmation):

• Deleted: your account row (email, name, credentials), learning history (skills, assessments, evidence, projects, experiments, research), sessions, notifications, votes, and every 1-to-1 conversation you were part of — both sides of it, including the other person's copy of those messages.
• Survives anonymously: your community posts and comments stay (the discussion belongs to the community) but with the author identity removed — they display as "Member".
• Moderation records survive without identity: if you filed or were the subject of reports, those records remain as the audit trail for safety and legal obligations, with your identity stripped from them.
• Deletion is immediate and irreversible. Email-address re-registration after deletion creates a fresh, empty account.

6. Children

DS Colony is an education and professional-development platform and is not directed at children. We do not knowingly collect personal data from children (in India, where DS Colony operates, a child is anyone under 18). We do not collect date-of-birth, and we do not run targeted advertising or behavioral ad tracking of any kind. If we learn of an account belonging to someone under 18, we will remove it.

7. Retention

Account and learning data are retained while your account exists. Community content survives account deletion anonymously. Direct messages are retained while either party keeps the conversation, and are removed for both parties on either party's account deletion. Notifications are retained while your account exists (we may prune very old notification rows). Security logs are kept for a limited period for account protection. Moderation records (reports, actions) are retained as the audit trail with identities stripped after account deletion. We do not apply fixed TTL deletion jobs to messages or notifications today — an honest limitation we plan to address in a later phase.

8. Security

Passwords are stored as scrypt hashes with login-timing equalization; session tokens are random 256-bit values revocable in one action (sign-out everywhere / password reset / suspension); direct-message and account routes are access-controlled server-side; user-generated markdown is rendered with sanitization and no raw HTML; transport is HTTPS. Security is never perfect — if we ever suffer a breach affecting personal data, we will notify affected users and the Data Protection Board without undue delay (our internal target is within 72 hours of confirming it).

9. Where your data lives, and who processes it

The platform runs on infrastructure in India/cloud regions operated by our hosting and database providers (Railway, Supabase), with transactional email sent through an SMTP provider. These are processors working on our instructions. Where cross-border processing is involved, it is carried out under contractual protection. We do not sell, rent, or share personal data with advertisers or data brokers, ever.

10. Changes

This policy carries a "last updated" date. Material changes are emailed to your account address before they take effect. Continued use after that means you accept the updated policy.