Privacy Policy

1. Who is responsible for your data

ProofStack is operated by [Your full legal name], sole proprietor, trading as ProofStack, [Postal address in India: city, state, PIN] ("we", "us"). We are the Data Fiduciary for the personal data described here. Questions about this policy or your data go to our Grievance Officer, [Grievance Officer full name], at [grievance email]. See also Contact and grievances.

2. What we collect

• Account details: email address, phone number (if you add one), whether each is verified, your date of birth, and your account role and status. Your password is handled by our sign-in provider and is never stored by ProofStack.
• Sign-in through another service (such as Google or GitHub): the email address and name that service shares with us.
• Profile: display name, handle, profile type (developer or recruiter), photo, bio, location and skills.
• Content you create: posts, comments, reactions, projects, portfolio entries, uploaded images, organizations and teams, follows and bookmarks.
• Careers: your career profile (headline, roles, availability, whether recruiters can discover you), job applications and notes, messages with employers, and jobs you post.
• Skill checks: the questions you were given, your answers and your results.
• Security records: sign-in sessions with a simple device label (for example "Chrome on Windows"), and logs of security events such as sign-ins, MFA changes and account changes. For rate limiting and lockouts we keep only a one-way hash of your network address, never the address itself.
• Your consent: which version of these terms you accepted and when.
• GitHub connection (only if you connect it in the code editor): your GitHub username and an access token that lets ProofStack read and commit to repositories on your behalf. The token is encrypted, never shown in your browser, and deleted when you disconnect GitHub or delete your account. Code you open in the editor is fetched from GitHub when you open it and is not stored by ProofStack.

We do not collect financial information, government ID numbers, biometric data or health data. Please do not put such information in your profile or content.

3. Why we use it

• To run your account and the features you choose: your profile, community, projects, careers and skill checks. We rely on the consent you give when you create your account.
• To keep ProofStack secure: verifying sign-ins, multi-factor authentication, preventing abuse, fraud and spam, and investigating incidents.
• To send messages you need: verification codes, sign-in alerts and notifications about activity on your account. We do not send marketing messages.
• To check that you meet the minimum age of 18.
• To meet legal duties, such as answering lawful requests from authorities and keeping records the law requires.

Skill checks use your earlier results to choose the topics of your next question set. This happens only inside the skill-check feature and is not used for advertising or shared with anyone.

4. AI-assisted features

Two optional features use an AI model provider. The writing assistant sends the text you submit, and nothing else, when you ask it to. The career plan sends only your self-reported skills and the skill topics of jobs, and only after you tick the consent box. We do not send your name, email or contact details with these requests.

5. What other people can see

• Your public profile, public posts, comments and public projects can be seen by anyone, including people who are not signed in.
• Organization-only and private content is visible only to the people it is shared with.
• If you make your career profile discoverable, recruiters on ProofStack can find it. Employers see the applications and messages you send them.
• Your email, phone number and date of birth are never shown to other users. Platform moderators see a masked email address only.

6. Who processes data for us

We use these kinds of service providers to run ProofStack. We can tell you which company fills each role on request. Each processes data only to provide its service to us.

We may also disclose data when Indian law requires it, for example on a lawful order from a court or government agency, or to protect people from harm.

7. Data stored outside India

Our providers store data in the countries listed above. The DPDP Act allows this, except to countries the Government of India restricts; we will move data if a country we use is restricted. For users in the European Union or United Kingdom, transfers rely on the providers' standard contractual clauses.

8. How long we keep data

• While your account is open, we keep your data so the service works.
• When you delete your account, your profile, content, applications, messages, skill-check results and images are deleted immediately. Your email, phone number and registration date are kept for 180 days, as rule 3(1)(h) of the IT (Intermediary Guidelines) Rules, 2021 requires, and then erased.
• Ended sign-in sessions are deleted after 180 days.
• Security logs and notifications are deleted after one year.
• Encrypted database backups are deleted after 30 days, so deleted data can remain in a backup for up to 30 days.

9. Your rights

Under the DPDP Act you can:

• Get a copy of your personal data: use Download my data under Settings → Privacy & data page.
• Correct or update it: edit your profile and account details at any time.
• Erase it and withdraw consent: use Delete my account on your account page. Withdrawing consent does not affect what was done before.
• Nominate someone to act for you if you die or cannot act: email the Grievance Officer.
• Complain: contact our Grievance Officer first. If you are not satisfied, you can complain to the Data Protection Board of India.

If you are in the European Union or United Kingdom, you also have rights under the GDPR, including to object to processing and to complain to your local data protection authority. Contact us to use them.

10. Age requirement

ProofStack is for people aged 18 or over. We ask for your date of birth when you sign up. If you are under 18, we do not create an account and we delete what you entered. If we learn that an account belongs to someone under 18, we delete it.

11. How we protect data

All connections use HTTPS. Sign-in credentials are encrypted, network addresses are hashed, access inside ProofStack is checked on every request, and you can turn on authenticator-app MFA. If a personal data breach happens, we will tell affected users and the Data Protection Board of India as the DPDP Act requires, and report it to CERT-In within 6 hours.

12. Cookies and browser storage

We use only cookies that are strictly necessary for ProofStack to work, so we do not ask for cookie consent. We use no advertising, analytics or tracking cookies.

Your browser also stores your light or dark theme choice and, during sign-in, the page to return to. These never leave your device.

13. Changes to this policy

If we change this policy materially, we will show the new version and ask you to accept it before you continue using ProofStack. The date at the top shows the current version.

14. Contact

Grievance Officer: [Grievance Officer full name], [grievance email], [Postal address in India: city, state, PIN]. General enquiries: [contact email].