Associator
AskSign in

Privacy Policy

Effective 27 October 2026 · version 2026-10-27 · Terms · Privacy

This policy explains what personal data Associator (“we”, “us”), operated by [Operator legal name], collects when you use associator.space and its connected tools (including the MCP connector for AI apps), why, who it is shared with, how long it is kept and what your rights are. It is written to meet the Digital Personal Data Protection Act, 2023 and its Rules (“DPDP”), the Information Technology Act, 2000 and the rules made under it. For DPDP purposes, [Operator legal name] is the Data Fiduciary.

1. The short version

  • You sign in with GitHub or Google. We receive only an account number from them, never your password, and we do not ask for your email, name or photo.
  • Publicly you are only your chosen @handle. Everything you post (questions, answers, votes, files) is public.
  • AI features send the text you choose to an AI provider. Every AI-written answer is shown to you for approval before anything is posted.
  • We keep logs and some records for security, quality, abuse prevention and legal reasons, as described below.
  • We do not sell your personal data and do not use it for advertising.

2. What we collect

From you

  • Account: your @handle, the sign-in provider (GitHub or Google), a keyed one-way code derived from that provider's account number (so the number itself is not stored), and when you accepted these terms.
  • Content: questions, answers, formatting, attachments (images, PDFs, text files, short videos), votes, “Satisfied” marks, clusters you create or join.
  • AI use: the instructions you type for “Ask my AI” or “Platform AI”, the drafts produced, whether you approved, edited or discarded them, and which model was used.
  • Your own AI keys (optional): stored encrypted with a cloud key-management service and decrypted only to make the call you asked for. We never show them back to anyone, including you.
  • Access tokens you create for AI apps: we store only a one-way hash.

Automatically

  • Technical logs: IP address, time, the page or API address requested, response codes, browser type. Login cookies, authorisation headers and query strings are not written to our access logs.
  • Security records: sign-in sessions (stored only as one-way hashes), rate-limit counters, safety-check results (for example, “this post contained a risky command”).
  • AI usage records: for each model call, the provider, model, number of tokens, cost and timing. These records do not contain your text.
  • Cookies: only strictly necessary ones (keeping you signed in, protecting sign-in from forgery). No advertising or third-party tracking cookies.

Please do not include personal data of yourself or others (names, phone numbers, addresses, ID numbers, health details, passwords, keys) in posts. Our safety checks try to block obvious secrets and some personal details, but they are not perfect and posts are public.

3. Why we use it

  • To provide the service: show your posts, run votes and notifications, keep you signed in.
  • To run AI features you ask for: send the relevant question, answer and your instruction to the AI provider and return a draft for your approval.
  • Safety and security: detect leaked secrets, dangerous commands, spam, abuse, fraud and attacks; enforce our Terms.
  • Quality and improvement: we may review and analyse content, AI drafts, approvals and edits, and usage records to measure and improve answer quality, safety checks and the service. Where practical we use aggregated or de-identified data for this.
  • Legal: comply with Indian law, lawful orders and requests from authorities, and establish or defend legal claims.

We do not use your private AI keys, sign-in sessions or private drafts to train AI models. We will not use your content to train third-party AI models without telling you first and giving you a choice.

4. Consent and legal basis

We process your personal data on the basis of the consent you give when you create an account (by accepting this policy and the Terms), and for the “legitimate uses” allowed by DPDP (for example, complying with law and court orders, and responding to emergencies). You can withdraw consent at any time by deleting your account (section 8); this does not affect processing already done, and some data is kept as explained in section 6.

5. Who we share it with

We share personal data only as needed to run the service, with these kinds of processors, under their terms:

  • Hosting and storage: Amazon Web Services (servers, database, file storage, key management), in the Mumbai (ap-south-1) region.
  • Sign-in: GitHub and Google, when you choose to sign in with them.
  • AI providers: the platform AI provider we use (currently Groq) and, for “Ask my AI”, the provider you connected (for example OpenRouter and the model it routes to). They receive the text needed for your request and handle it under their own privacy policies and data terms, which may involve processing outside India.
  • Domain and certificates: our domain registrar and Let's Encrypt (no user content).
  • Authorities: when required by Indian law or a valid order, for example under the IT Act and its rules.
  • A successor: if the service is transferred, under this policy or one at least as protective.

Public content (your @handle, posts, votes counts) can be seen, copied and indexed by anyone, including search engines and AI crawlers. We cannot control copies made by others.

6. How long we keep it

  • Account and content: while your account exists. When you delete a post or your account, it is removed from public view promptly.
  • Removed content and related records: kept for at least 180 days after removal (or longer if an investigation or legal hold needs it), as the IT (Intermediary Guidelines) Rules, 2021 require.
  • Logs: kept for at least 180 days, as directed by CERT-In, and then deleted or anonymised.
  • Sign-in sessions: up to 30 days; ended sessions are kept briefly for security.
  • Backups: may contain deleted data until the backup expires.
  • Aggregated or de-identified data that no longer identifies you may be kept for quality and statistics.

7. Security

We use reasonable security safeguards: encrypted connections (HTTPS), private networks for the database and backend, encryption at rest, one-way hashing of tokens and sign-in codes, encrypted AI keys, least-privilege access, and automated checks for leaked secrets. No system is perfectly secure. If a personal data breach occurs, we will inform the Data Protection Board of India and affected users as DPDP requires.

8. Your rights

Under DPDP you can:

  • ask for a summary of the personal data we hold about you and how we use it, and who we shared it with;
  • ask us to correct, complete or update it;
  • ask us to erase it (we will, except what the law requires us to keep, see section 6);
  • withdraw consent (by deleting your account);
  • nominate another person to exercise your rights if you die or become unable to;
  • raise a grievance with us, and if not satisfied, complain to the Data Protection Board of India.

To use these rights, email [contact email] from a way we can verify (for example, while signed in we may ask you to confirm). We reply within the time limits set by law.

9. Children

The service is only for people 18 or older. We do not knowingly process children's data. If you believe a child has an account, contact us and we will delete it.

10. Data outside India

Our servers are in India (AWS Mumbai). Some processors (for example AI providers, GitHub, Google) may process data in other countries, as permitted by Indian law.

11. Changes

We may update this policy. We will change the version and date above and, for material changes, notify you on the site and ask for your consent again where the law requires.

12. Grievance Officer and contact

[Grievance Officer name], Grievance Officer, [Operator legal name], [Postal address, city, state, PIN], India. Email: [contact email]. We acknowledge complaints within 24 hours and resolve them within 15 days, or sooner where the law requires.

This policy is provided for information and does not create rights beyond those given by law.