Privacy Policy

This Privacy Policy explains what personal data CreatorDiary collects, why, and the choices you have. It should be read with our Terms of Use. We follow India's Digital Personal Data Protection Act, 2023 and apply the same care to users in other countries.

1. What we collect

• Account details: full name, username, password (stored only as a one-way argon2id hash), phone number (stored encrypted), city, state or region, country and time zone.
• Facebook sign-in (if you use it): your Facebook user ID, name, profile photo link and, if you allow it, your email address. We request only the public_profile and email permissions.
• Your answers in the app: your bio and about text, links, goals, audience, available time, posting times, groups you list, calendar choices, languages and notification choices.
• Your plan: the posts we suggest, their status (planned, done or skipped), caption drafts and notes.
• Notifications: if you turn them on, the push address your browser gives us (an endpoint URL and keys). It does not include your phone number.
• Security records: sign-in sessions with IP address, browser type and times, failed sign-in attempts, your acceptance of these policies, and an audit log of account actions.

We do not collect your Facebook password, posts, insights, Pages, groups, friends or messages, and we do not use tracking or advertising cookies.

2. Why we use it

• To create and secure your account and sign you in.
• To build your posting plan, checklists and captions from your answers, in your languages and time zone.
• To send the reminders you ask for.
• To help you when you contact support, for example to check it is you before we set a temporary password. Our administrators can see your account details and plan only for support, safety and content quality.
• To prevent abuse, such as rate-limiting sign-in attempts and locking accounts after repeated wrong passwords.
• To meet legal obligations and respond to lawful requests.

We use your data on the basis of your consent and to provide the service you asked for. We never sell your personal data or use it for advertising.

3. Who we share it with

We share data only with service providers that run the app for us, under their data protection terms:

• Vercel Inc. (app hosting).
• Neon (database hosting; data stored in the AWS Asia Pacific, Singapore region).
• Your browser's push service (for example Google, Apple or Mozilla), only to deliver notifications you turned on. The message content is encrypted.
• Meta Platforms, Inc., only when you choose to sign in with Facebook.

We may also disclose data if the law requires it. Some providers store data outside India; we use them only with appropriate safeguards.

4. Cookies

We use only essential cookies: a secure session cookie that keeps you signed in, short-lived cookies used during sign-in, and a cookie that remembers your language. We do not use analytics or advertising cookies.

5. How long we keep it

We keep your data while your account is active. Sign-in sessions expire after 30 days of inactivity. When you delete your account, we delete your personal data within 30 days, except records we must keep by law, such as security logs, which we keep for no longer than necessary.

6. Security

Data is encrypted in transit (HTTPS). Phone numbers are encrypted at rest, passwords are hashed with argon2id, and database access is restricted so that each user can reach only their own records. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

7. Your rights and choices

• See and correct most of your details yourself in Settings.
• Ask for a copy of your data, or ask us to correct or erase it.
• Withdraw consent, for example by turning off notifications. Withdrawing consent does not affect processing that already happened.
• Nominate another person to exercise your rights if you die or become unable to do so.
• Complain to us, and if you are not satisfied, to the Data Protection Board of India or your local authority.

8. Deleting your account and data

To delete your account and all data linked to it, including data received through Facebook Login, email us at sarkarsantanu69@gmail.com with your username and the phone number on your account, and write "Delete my CreatorDiary account". We will confirm and complete the deletion within 30 days. You can also remove CreatorDiary from Facebook at any time in Facebook Settings, then Apps and Websites.

9. Children

CreatorDiary is meant for adults aged 18 or over. We do not knowingly collect data from children. If you believe a child has signed up, please contact us and we will delete the account.

10. Changes

We may update this policy. If a change is significant, we will tell you in the app before it takes effect.

11. Contact

For privacy questions or requests, email us at sarkarsantanu69@gmail.com.