Privacy Policy

1. Who this policy covers

DevInHyderabad ("this website", available at www.devinhyderabad.com) is a free educational website run by me — Sai Kiran Nain, an individual developer based in Hyderabad, Telangana, India. There is no company or registered entity behind it. This policy explains what personal data the site collects, why, who processes it, and what rights you have under Indian law — the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 with its Reasonable Security Practices & Procedures and Sensitive Personal Data or Information Rules, 2011 ("SPDI Rules") — and, where applicable to visitors from the EU/EEA, the General Data Protection Regulation ("GDPR").

Note: India's DPDP Act is being brought into force in phases along with the DPDP Rules; until its provisions are fully operative, the IT Act / SPDI framework continues to apply alongside it. This policy is written to satisfy both regimes as they stand today.

2. What data is collected, why, and on what basis

a) Account data (only if you create an account — optional)

• Collected: email address and name; if you sign up with Google, your Google account profile (name, email, profile picture identifier).
• Purpose: to create and identify your account so your course progress can be saved across devices. Accounts exist purely for progress tracking — all content is free without an account.
• Lawful basis: your consent, given when you register (DPDP Act s.6; GDPR Art. 6(1)(a)). You can use the entire site without giving this.

b) Course progress data

• Collected: which chapters you have completed, per course.
• Purpose: showing you your own progress, streaks and completion badges.
• Lawful basis: consent (same registration consent); processing is necessary to provide the feature you asked for.

c) Analytics data (Google Analytics 4)

• Collected: pseudonymised usage events — pages viewed, approximate location (city/country derived from IP), device/browser type, referring page. The property ID is G-CQBXWPT9W5.
• Purpose: understanding which courses and error guides are useful so I know what to write next.
• Lawful basis: legitimate interest in measuring aggregate site usage (GDPR Art. 6(1)(f)); under the DPDP Act analytics of this kind is not aimed at identifying you personally. You can opt out completely — see §7.

d) Server logs (Vercel)

• Collected: IP address, user agent and request metadata, recorded automatically by our hosting provider for every request.
• Purpose: security, abuse prevention and troubleshooting.
• Lawful basis: legitimate interest in operating a secure service. I do not use these logs to build profiles.

I do not sell your personal data, and there are no advertisements or trackers beyond the analytics described above.

3. Third-party processors (named)

These companies process data on my behalf. Each is used only for the function listed:

• Supabase (Supabase Inc.) — account storage, authentication (email + Google sign-in), database hosting for progress data.
• Vercel Inc. — website hosting, CDN, server logs.
• Google Ireland/LLC — Google Analytics 4 (usage measurement) and Google OAuth (if you choose "Sign up with Google").
• Resend (Resend Inc., a US-based provider) — delivers transactional authentication emails (signup confirmation, one-time codes, password reset) as the custom SMTP sender configured for my Supabase auth project, from otp@mail.devinhyderabad.com. I do not send marketing email.

Each processor is bound by contract to process data only on documented instructions (GDPR Art. 28 equivalents; DPDP Act s.8(2)). Links to their own privacy policies: supabase.com/privacy · vercel.com/legal/privacy · policies.google.com/privacy · resend.com/legal/privacy-policy.

4. Cross-border transfers

Personal data collected by this website is processed and stored outside India. This transfer is permitted under s.16 of the Digital Personal Data Protection Act, 2023 read with Rule 15 of the DPDP Rules, subject to any countries the Central Government may notify as restricted — and it is disclosed here specifically, per provider:

• Supabase (accounts, authentication, course-progress database): hosted in region ap-southeast-2 — Sydney, Australia.
• Vercel (website hosting): this website is fully pre-rendered, so pages are delivered as static files from Vercel's global CDN edge — including edge locations in India. Dynamic serverless compute, where ever used, is configured for region iad1 (Washington D.C., USA); ordinary page visits do not pass through US servers.
• Google (Google Analytics 4 measurement and Google sign-in): processed on Google's global infrastructure, primarily in the United States.
• Resend (transactional authentication email): processed in the United States.

Where required — for EU/EEA visitors — such transfers rely on the European Commission's Standard Contractual Clauses offered by these providers.

5. Retention and security

• Account + progress data: kept while your account exists. Deleted within 30 days of an erasure request.
• Analytics data: retained per GA4's default event-data retention (2 months) and then auto-deleted by Google.
• Server logs: retained by Vercel per their standard rotation window (days, not months).

Security measures include: transport encryption everywhere (HTTPS), authentication and password handling delegated entirely to Supabase (bcrypt hashing, OAuth tokens — passwords never touch my servers), row-level access rules so accounts can only read their own progress, and no payment or government-ID data collected at all. As a solo operator I keep the data footprint deliberately minimal — the strongest protection.

6. Your rights

Under the DPDP Act (and mirrored under GDPR for EU/EEA visitors) you may:

• Access a summary of your personal data and processing activity;
• Correct inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Withdraw consent at any time (withdrawing account consent deletes the account — see below);
• Grievance redressal — raise a complaint that must be addressed per §9;
• (EU/EEA additionally: data portability, objection to processing, complaint to your supervisory authority.)

To exercise any right, email saikiran20172021@gmail.com from your account email. Account deletion is also self-service where available in the UI; deleting your account removes your profile and progress data.

7. Cookies and analytics opt-out

• Essential: Supabase auth session cookies/localStorage tokens — required only if you log in; without an account nothing essential is stored.
• Theme preference: one localStorage entry remembering dark/light mode.
• Google Analytics 4 (G-CQBXWPT9W5): sets first-party cookies (_ga, _ga_*) to distinguish visits, plus device/region signals described in §2c.

To opt out of analytics: use Google's official opt-out browser add-on, block third-party scripts in your browser settings, or browse logged-out with JavaScript restrictions — every part of the content works without analytics.

8. Children

This website is not directed at children under 18, and I do not knowingly process the personal data of anyone under 18. Under s.9 of the DPDP Act, processing children's data requires verifiable parental consent, which this site does not seek and is not designed to obtain. If you believe a minor has created an account, contact me and it will be deleted promptly upon verification.

9. Grievance Officer

Under the IT Act framework (including the Consumer Protection E-Commerce Rules, 2020 where applicable) and in line with DPDP good practice, the designated Grievance Officer is the operator himself:

• Name: Sai Kiran Nain
• Email:saikiran20172021@gmail.com
• Acknowledgement: within 48 hours of receipt
• Resolution: within 1 month of receipt

10. Changes and contact

Material changes to this policy will be reflected in the "last updated" date above and, where the change affects registered users materially, announced on the site itself. Questions about anything here: saikiran20172021@gmail.com.