historical legal document
privacy notice
what this service handles, why it handles it, where it goes and how long it stays.
who handles data
Prateek Panwar, trading as if this finds you; india operates this service and determines its purposes. privacy questions and requests go to the privacy contact through the report page.
the public record
submitted recordings, recipient names, cover marks and eligible transcripts are public. they can be listened to, searched, shared, grouped by recipient or theme, served internationally and indexed or cached by search engines. the submitter's account or profile is not displayed because the public service has none. that design does not make a voice or spoken details unidentifiable.
data inventory
| data | source and purpose | public? | where / processor |
|---|---|---|---|
| recording | made with the browser microphone; validated, repackaged, moderated and played | yes, if published | private supabase storage; short signed playback links |
| recipient name and cover strokes | submitted by the recorder; display, search and archive organisation | yes, if published | postgres database and public pages |
| transcript and language | automated processing for moderation, privacy screening, search and eligible readable pages | only when its state permits; pii-screen failures are withheld whole | postgres; configured transcription provider when active |
| moderation signals, decisions and jobs | rules, classifiers, reports and human actions used to protect the archive | no | postgres and configured providers |
| anonymous session cookie | random browser value used for abuse limits, duplicate actions and privacy-separated analytics | no | sam_sid cookie; keyed hashes in postgres |
| network address and user-agent headers | processed in memory for abuse limits, coarse device class and hosting security; the application stores a keyed address bucket, not raw address | no | application and hosting infrastructure |
| analytics event | meaningful archive actions, coarse route/device/referrer host/utm and privacy-folded recipient search | no | first-party postgres analytics schema; no third-party analytics sdk |
| report or grievance | category, target, necessary description, optional contact and case status | no | postgres and authorised administrators |
| withdrawal capability | issued once so one recording can be withdrawn | only if its holder shares the fragment | secret remains in the url fragment; only its hash is stored |
| admin and audit data | operator authentication, authorisation and accountability | no | isolated control-plane tables |
| support or legal correspondence | provided by the sender to answer and document a request | no | configured email provider and case record |
why processing happens
data is handled to provide the requested public archive, honour the submission agreement, moderate and secure the service, prevent duplicate or abusive actions, answer rights and legal requests, keep reliable records, and understand the service through bounded first-party analytics. where consent is the applicable basis, it can be withdrawn for future processing subject to other lawful grounds and the limits of public copies. legal basis and india's staged data-protection commencement require launch-counsel confirmation.
cookies and device storage
the service uses one necessary, http-only, same-site session cookie named sam_sid. it lasts up to one year and is not an account. it supports rate limits, duplicate-report protection and analytics using separate keyed-hash domains so analytics cannot be joined to authorship. no published note ids or withdrawal secrets are put in localstorage, sessionstorage or indexeddb. the site does not use an optional advertising cookie.
a browser, operating system, network intermediary or content-delivery layer may temporarily cache public pages, fonts and playable media for ordinary performance. their cache lifetime and deletion are not fully controlled by this service. global privacy control and do-not-track disable the first-party analytics emitter.
analytics
first-party analytics is active. raw events are retained for 90 days by default. analytics never receives audio, transcript text, report descriptions, raw addresses, full user agents or deletion secrets. a search name is folded to the same recipient slug used by the product; rare daily terms are grouped rather than retained as themselves. the analytics visitor hash uses a different key domain from the submission session hash and is not used to show a visitor “their” recordings.
automated processing
no external transcription provider is configured in this build, so recordings remain without provider-generated transcripts. transcription, personal-information screening, rule matching and any configured classifier run after storage in a background worker. a privacy-screen failure withholds the complete transcript rather than publishing a redacted fragment. automation produces signals; the moderation policy produces the action. submissions are not used to train unrelated general-purpose models or to clone voices.
processors and borders
the active service providers for this build are listed below. their infrastructure can process data outside india, and public recordings are intentionally available internationally. this notice does not claim that data stays only in india.
- the application host: serves the application and may process ordinary request and security logs
- supabase: private object storage for recordings and the postgres database
- google fonts: serves the google sans stylesheet and font files when the browser can reach it; provider infrastructure may be outside india
- cloudflare turnstile: bot and submission-abuse checks; provider infrastructure may be outside india
retention
| record | operational schedule |
|---|---|
| published recording, cover, recipient and permitted transcript | while published; then removal and preservation rules below |
| withdrawn, rejected or failed audio | scheduled for purge by the next maintenance sweep |
| withdrawn, rejected or failed note metadata and associated reports | 180 days by default after purge, then deleted unless preservation is required |
| pending reservation that never receives a recording | expires after about 5 minutes, then enters failed-note cleanup |
| moderation signals and decisions | kept with the note and for operational/legal accountability; launch retention requires counsel approval |
| reports and grievance records | 180 days after removal/resolution at minimum where intermediary preservation applies; longer only for an open case, legal hold or justified audit need |
| rate-limit counters | deleted after the longest active rate-limit window |
| raw analytics events and daily visitor keys | 90 days by default |
| aggregate analytics rollups | retained without audio, transcript, report text or a link to authorship; periodic necessity review |
| admin sessions | expired sessions deleted after 7 days |
| admin audit records | retained for security, moderation and legal accountability; launch schedule requires counsel approval |
| jobs and operational counters | completed jobs remain auditable; operational counters are pruned after 120 days |
| backups | protected until the provider backup cycle expires, or longer under a lawful preservation duty |
a lawful preservation request, dispute, security incident or statutory duty can pause deletion for the affected record. that exception is scoped and documented; it is not a reason to retain everything forever.
your choices and rights
a valid private withdrawal link is the strongest proof for removing the submitter's own note. anyone can file a privacy, safety, impersonation, unauthorised-recording or other grievance without an account. depending on applicable law, you may request access, correction, erasure, consent withdrawal or grievance review. because there are no accounts, we ask only for evidence reasonably needed to avoid giving private data to a person who merely claims a recording is theirs. difficult cases receive human review.
security and law
recordings are kept in a private bucket; playback uses short-lived signed links; received webm bytes are decomposed into individually checked audio packets and the service stores a file it wrote from those packets. access boundaries, keyed identifiers, request limits, audit records and restricted admin access reduce risk. no system is perfectly secure and these measures are not a guarantee against every incident.
for a court, government, emergency or preservation request, the operator verifies the requester, authority, scope and legal basis, preserves what is required, discloses only what law requires, and keeps an audit where permitted. we do not promise to disclose everything requested or to notify someone when law forbids notice.
changes
material changes to purpose, data use, operator or rights receive a new version, effective date and appropriate notice or acceptance. historical versions remain retrievable. a new notice does not silently grant new rights over an older recording. contact the privacy contact through the report pageor use the report page.