Privacy Policy

whatsinit (“we”, “us”) operates the website at whatsinit.in and the food-information services available on it. We are the Data Fiduciary for the personal data collected through the site, in the sense defined by the India DPDPA, 2023.

We only collect what we need to run the service. Every category below is tied to a specific purpose, and we don't use any of it for anything else.

• We don't sell your data. Ever.
• We don't use third-party advertising cookies or trackers (Facebook Pixel, Google Ads, etc.).
• We don't profile you or build a behavioural ad target from your activity.
• We don't verify age — the site is open to anyone — but it is intended for a general audience. If you're a parent or guardian and want a child's account or data removed, write to the grievance officer below and we'll delete it.

We share data only with the service providers that help us run the site. We don't sell or rent personal data to anyone.

• Account data — as long as you have an active account. Sign out + email us, and we'll delete it.
• Analytics events — 12 months in PostHog, then rolled up into aggregates and the raw events are dropped.
• Error reports — 90 days in Sentry, then deleted.
• Contact messages — kept until the conversation is resolved + 6 months for audit, then deleted.

You have the right to:

• Know what personal data we hold about you.
• Ask us to correct anything that's wrong.
• Ask us to delete your data.
• Withdraw consent (we'll stop processing, with the limitation that we may still need to retain some data for legal / audit purposes).
• Nominate someone to exercise these rights on your behalf in the event of death or incapacity.
• Raise a grievance with our Grievance Officer (below). If unresolved, you can escalate to the Data Protection Board of India.

To exercise any of these rights, email support@whatsinit.in from the address associated with your account. We'll respond within 30 days.

We use a small number of first-party cookies and one third-party analytics provider:

• Authentication cookies (essential) — set by NextAuth so you stay signed in. Cannot be disabled if you want to use account features.
• Analytics (PostHog) — anonymous unless you sign in, in which case events are associated with your account id.

You'll see a one-time banner on your first visit explaining this. Continuing to use the site after dismissing the banner counts as acknowledgement.

We use industry-standard encryption in transit (HTTPS) and at rest (AWS RDS encryption). Account passwords are never collected — sign-in is delegated to Google. We run automated security monitoring and patch known vulnerabilities promptly.

We'll update the “Last updated” date at the top whenever this policy changes materially. If the change affects how we use your data, we'll notify you by email before it takes effect.

Under the DPDPA you can raise any privacy concern directly with our Grievance Officer:

We aim to acknowledge grievances within 7 days and resolve them within 30 days.