Privacy Policy

Effective date: [to be set on publication]

This Privacy Policy explains how JG Commons ("we", "us") collects, uses and shares personal data when you use Capital Commons, our members' community website and Android app (the "Service"). We process personal data under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and its rules. By creating an account you give consent to the processing described here.

1. Who we are

The Service is operated by JG Commons, contact jgantony.fin@gmail.com, [postal address]. For the DPDP Act, JG Commons is the Data Fiduciary.

2. Data we collect

Category	What	Source
Account details	Full name, username, date of birth, email address, mobile number, password (stored only as a secure hash)	You, at sign-up
Profile	Display name, profile photo, bio, role, badges, contribution points	You and your activity
Content you share	Posts, photos, captions, comments, messages in channels and direct messages, reactions, questions, answers, campaign actions and stances, help requests, thank-you notes, skill listings	You
Learning activity	Lessons opened, quiz answers, practice notes, level tasks, streaks, certificates	Your use of the Service
Join requests	The note you send to an admin, and the admin's decision	You and our admins
Technical data	IP address, device and browser type, sign-in times, last-seen time, session cookie, push-notification subscription	Your device, automatically
Google sign-in (if used)	Your Google account name, email and profile ID	Google, with your permission

We do not collect payment card details, government ID numbers, precise location, or your contacts. Do not share anyone else's personal data, or your own financial account details, in posts or messages.

3. How we use it

To create and secure your account, sign you in, and keep you signed in.
To run the community: show your posts, messages, profile and contributions to other members.
To send service emails: password resets, verification codes and important notices.
To moderate content, enforce our Terms, and prevent fraud, spam and abuse, including keeping audit logs of sign-ins and admin actions.
To improve the Service, using aggregate statistics.
To comply with law and respond to lawful requests from authorities.

We do not sell your personal data and we do not show third-party advertising.

4. Who can see your data

Other members see your display name, username, photo, bio, role, posts, comments, public channel messages, Q&A, campaign activity and contribution points. Circle posts are visible only to that circle's members. Direct messages are visible to you and the other person.
Admins and moderators can see member details needed to approve, moderate and protect the community, including join-request notes, audit logs and reported content.
Service providers who process data for us under contract: Render (cloud hosting), MongoDB Atlas (database), Google (email delivery through Gmail, optional Google sign-in) and Cloudflare (network and security).
Authorities, when required by law, court order, or to protect the rights, safety or property of JG Commons, our members or the public.
A successor, if the Service is merged, sold or transferred, subject to this Policy.

Some providers store data outside India. We use providers with recognised security standards, and transfers are made as permitted under the DPDP Act.

5. How long we keep it

Account and profile data: while your account is active, then deleted within 30 days of a deletion request, except as below.
Content you posted: deleted with your account, except copies other members quoted or forwarded, and content we must keep for a legal reason.
Sign-in sessions: 30 days. Audit and security logs: the most recent 5,000 entries, or longer where needed to investigate abuse.
Data we must retain by law, or for an ongoing dispute or investigation, is kept until that obligation ends.

6. Security

Passwords are hashed, sessions use secure cookies, and the Service is served over HTTPS. No system is fully secure: keep your password private and tell us at once if you suspect misuse. We will notify affected members and the Data Protection Board of India of a personal data breach as the DPDP Act requires.

7. Your rights

Under the DPDP Act you can:

get a summary of the personal data we process about you and with whom it is shared;
correct, complete or update it (most of it directly in your profile);
ask us to erase it, by deleting your account (how to delete your account) or writing to us;
withdraw consent, which ends your use of the Service and leads to account deletion;
nominate someone to exercise your rights in case of death or incapacity;
raise a grievance with us, and then with the Data Protection Board of India.

To use any right, email jgantony.fin@gmail.com from your registered email address. We may need to verify your identity, and we respond within the time the law requires.

8. Grievance Officer

[Name], Grievance Officer, JG Commons, jgantony.fin@gmail.com, [postal address]. We acknowledge grievances within 24 hours and resolve them within 15 days, as the IT Rules require.

9. Children

The Service is only for people aged 18 and over. We do not knowingly collect data from children; if we learn that a child has an account, we delete it.

10. Cookies

We use one essential cookie to keep you signed in, plus a short-lived cookie during Google sign-in. We do not use advertising or third-party tracking cookies.

11. Changes to this Policy

We may update this Policy. We will post the new version with its effective date and, for material changes, notify you in the Service or by email. Continuing to use the Service after a change means you accept it; if you do not, you may delete your account.

12. Contact

JG Commons, jgantony.fin@gmail.com, [postal address].