chronolipi
Privacy policy
Written to be read. Plain sentences, no cross-references to nowhere, and every obligation we have chosen to take on is in the body — not in a portal you have to ask for.
Version 2026-09-01 · supersedes nothing before it. Not legal advice; have your own counsel read anything that binds you.
What we collect about you
Two categories, and we would rather be specific than broad. Account data: workspace name, the email and phone of each invited member, hashed credentials for login, role assignments, and your recovery-kit hash. Operational data: which workspace, which user, which action, which timestamp, and the byte size and hash of files you touch. We do not receive — and structurally cannot derive — your documents' contents, your passphrase or any unwrapped file key. The one exception is a page you explicitly send for “AI read”: a sandboxed reader process sees that page in memory while reading it, returns the text sealed to you, and keeps nothing; each such request is recorded, without content, in your audit trail.
Contact-form submissions open in your own mail app; nothing is stored on this site, and this page sets no analytics cookies. Font, layout and interaction code is served from our own origin, so a visit to chronolipi.com does not tell a third party that you visited chronolipi.com.
Why we are allowed to
For an individual user, the basis is contract: you ask us to store and index files, we process exactly the metadata needed to do that. For your records, you are the data fiduciary under the DPDP Act and we are your data processor under a written agreement; we act on your documented purpose and nothing else. That is also why we cannot approve your erasure requests directly against your tenants' data — we action yours, immediately, and the log proves it happened.
Selling, sharing, advertising
We do not sell or rent personal data, and we do not put advertising trackers on this site or in the app. Disclosure happens in exactly three situations: with your instruction, to the sub-processors named on the security page under data-processing addenda, or when legally compelled — in which case we hand over what we actually can (ciphertext and metadata) and tell you unless prohibited.
Retention
Live workspace data is kept while your account is active. On cancellation, ciphertext and metadata are deleted within 30 days, including as backups roll off. SHA-256 receipts for deleted files are retained for 7 years on Enterprise workspaces where a records-integrity obligation exists, and for 12 months otherwise: a hash discloses nothing about content and is the evidence that deletion occurred when promised. Billing records are kept for the statutory 8 years under Indian tax law.
Your rights, and how to use them
Access, correction, erasure, transfer, and grievance escalation apply to your account data. The practical route is the app: Settings → Privacy → export or delete, which produces a signed receipt. Or write to privacy@chronolipi.com; we respond within 30 days, and 15 for anything a member of the public has a statutory clock on. Grievance officer: Sneha Ranjan Mishra, Bhubaneswar, contact as above.
Children
The app is not directed at children. Where an institutional customer's records contain minors' personal data — school admissions, paediatric notes — the customer holds the consent obligation, and the platform's verifiable-consent fields, tighter default retention and restricted-access document classes exist to help them meet it.
Changes to this policy
Material changes get 30 days' notice in-app and by email before taking effect; the previous versions stay reachable at this address with their dates. Minor clarifications are noted in the version line at the top.