Who this applies to
CHOSN is operated from India and primarily serves users in India, so this policy is written against the Digital Personal Data Protection Act, 2023 (DPDP Act). If you are in the EU/UK, the rights described below are broadly equivalent to those under GDPR, but CHOSN has not yet completed a separate GDPR compliance review.
What we collect, why, and for how long
| Data | Why | Retention |
|---|---|---|
| Email address (waitlist) | To tell you when access opens | Until you ask us to remove it, or 24 months after launch if you never create an account |
| Waitlist interests (brands, alert types) | To tell you about the things you said you cared about | Same as the waitlist email it belongs to |
| Account: email, password hash, display name, avatar seed | To create and secure your account | Until you delete your account |
| Two-factor secret (if you enable 2FA) | To verify your authenticator codes at login | Until you disable 2FA or delete your account. Encrypted at rest. |
| Google account identifiers (if you sign in with Google) | To link your Google sign-in to your CHOSN account | Until you delete your account |
| Notification subscriptions (brands/models you follow) | To send the drop and price alerts you asked for | Until you unsubscribe or delete your account |
| Web push subscription (browser endpoint and keys) | To deliver push notifications to that browser | Until you turn push off, or the browser invalidates it |
| Reports and blocks you create | To operate moderation and keep an audit trail of decisions | Reports are kept as a moderation record; see Community Guidelines |
| Analytics events (only if you allow analytics) | To understand which parts of CHOSN are used | Per PostHog's retention settings; not collected at all unless you consent |
Legal basis
Under the DPDP Act, we process your personal data on the basis of your consent, given when you join the waitlist, create an account, subscribe to notifications, or accept analytics. For account security data (password hashes, 2FA secrets, session records) we also rely on the legitimate use of delivering the service you signed up for.
You can withdraw consent at any time — by unsubscribing, declining analytics, or deleting your account.
Your rights
Under the DPDP Act you have the right to:
- Access — ask what personal data we hold about you.
- Correction — have inaccurate data corrected. Your display name and avatar are editable directly in account settings.
- Erasure — have your data deleted. You can do this yourself, immediately, from account settings; it removes your account, subscriptions, push registrations, and blocks. You can also email us and we will do it within 30 days.
- Grievance redressal — raise a complaint about how we handle your data (see below), and escalate to the Data Protection Board of India if unsatisfied.
- Nominate — nominate another person to exercise these rights on your behalf in the event of death or incapacity. Email us to do this.
Children
CHOSN is not intended for anyone under 13, and we do not knowingly collect data from children under 13. Under the DPDP Act, processing a child's data requires verifiable parental consent; CHOSN does not currently offer accounts to under-13s for that reason. If you believe a child has created an account, email us and we will delete it.
Security
Passwords are hashed with bcrypt and never stored in plain text. Two-factor secrets are encrypted at rest. Sessions use signed, httpOnly, secure cookies. Login, signup, and password-reset endpoints are rate-limited against credential-stuffing.
Grievance officer
The DPDP Act requires a named contact for data complaints. For now this is the founder, reachable at privacy@chosn.app. We aim to respond within 7 days and resolve within 30.
Changes
We'll date any material change here and notify registered users by email where the change meaningfully affects them.