Privacy Policy

1. Who we are

LowkeyAsk is run by [Operator legal name] (“we”, “us”), [registered address], India. We decide how and why your personal data is used, which makes us the “Data Fiduciary” under the DPDP Act.

Questions, requests and complaints: [privacy contact email]. Grievance Officer: [name], [email], [phone or postal address].

2. The short version

• You can send messages as a guest without giving us any personal details.
• If you sign in, we use your email only to sign you in and to send you emails about your account (sign-in codes, reveal requests and messages being ready). Creators never see it.
• Creators see the text of a message and nothing about who sent it, unless the sender later chooses to reveal themselves.
• To stop spam and abuse we keep salted one-way hashes of your device cookie and network, never your raw IP address.
• No ads, no tracking across other sites, no selling data, and nobody can pay to find out who you are.
• You can delete your account at any time from your account page.

3. What we collect and why

If you sign in

• Email address, to sign you in with a one-time code (or with Google) and to email you about your account. We don’t use it for marketing.
• Handle and optional name that you choose. Your handle appears on your links. It and your name are shown to a creator only if you accept their request to reveal yourself. Handles are self-declared; we don’t check them against Instagram.
• Age confirmation: the date you confirmed you meet our minimum age.
• Sign-in codes: each code is stored only as a keyed hash, with your email, its expiry, the number of wrong guesses, and a salted hash of the network it was requested from (to limit how many codes one network can request).
• Google sign-in (optional): Google tells us your email address and that Google has verified it. We ask for nothing else: no name, photo, contacts or other Google data.

If you create links

• The prompt, how long the link stays open, and whether it accepts guests.
• The messages sent to it, which reveal requests you made and their outcome, and the senders you blocked or messages you reported. You never learn who a blocked or reported sender is.

If you send a message

• The message and when it was sent. If you were signed in, it’s linked to your account (so you can see it on your Sent page and answer reveal requests) along with whether you allowed reveal requests. Creators can’t see that link; guest messages have none.
• A device hash: the first time you send, we set a cookie holding a random code and store only a salted hash of it. It limits everyone to one message per link and lets creators block a sender without learning who they are.
• A network hash: a salted hash of your IP address and browser type, used only to rate-limit floods of messages.
• Age confirmation: if you aren’t signed in, a cookie remembers that you confirmed your age.

Reveals

A creator can ask the sender of a message to reveal themselves only if the sender was signed in and allowed it. We record the request and your answer. If you accept, the creator sees your handle and name (never your email). If you decline, they see only that you chose to stay anonymous. Your answer is final.

Reports and safety

When a creator reports a message, we keep a copy of it together with the sender’s account (if any) and device hash, so we can review it and act on it even if the message or link is later deleted. Before a message is sent, its text is automatically checked against our community rules (see section 5).

Cookies

• lowkeyask_session: keeps you signed in, for up to 30 days. Sealed and encrypted.
• lowkeyask_device: the random device code described above, for up to 2 years.
• lowkeyask_age_ok: remembers that you confirmed your age, for up to 2 years.
• lowkeyask_google: used for 10 minutes while you sign in with Google, then deleted.
• Cloudflare Turnstile may set its own cookies to tell people from bots.

These are all needed for LowkeyAsk to work. We don’t use analytics, advertising or tracking cookies.

What we don’t collect

We don’t store your IP address, location, contacts or phone number, and we don’t read anything from your Instagram account. Our hosting provider may keep standard server logs, including IP addresses, for a short time for security and debugging.

4. The legal basis

We process your personal data with your consent, which you give when you sign up or send a message, and for the legitimate uses the DPDP Act allows, such as complying with the law, responding to legal requests, and keeping the service safe. You can withdraw consent at any time by deleting your account; this doesn’t affect anything we did before.

5. Who we share data with

We don’t sell personal data or share it for advertising. We use these service providers (“Data Processors”) to run LowkeyAsk, each only for the purpose listed:

• Vercel, to host the app and serve pages.
• Neon, our Postgres database, which stores the data described above.
• Resend, to deliver emails (your email address and the email’s contents).
• Cloudflare Turnstile, to check that sign-ins and messages come from people, not bots. Cloudflare receives your IP address and browser signals for this check.
• Google, only if you choose “Continue with Google”.
• Anthropic, whose Claude AI model checks each message’s text against our community rules before it’s sent. Only the message text is sent, not who wrote it. Under its commercial terms, Anthropic doesn’t use this data to train its models.

We may also disclose data if the law requires it, for example in response to a valid order from a court or a government agency authorised under Indian law, or to protect someone from serious harm. Anonymity on LowkeyAsk means anonymity from creators and other users; it doesn’t put anyone beyond the law.

6. Where your data is stored

Our providers may store and process data outside India, including in [database region, e.g. Singapore or the United States]. We only transfer data to countries the Government of India hasn’t restricted under section 16 of the DPDP Act, and we choose providers that protect it with reasonable security safeguards.

7. How long we keep it

• Your account (email, handle, name): until you delete it.
• Links and their messages: until the creator deletes their account. [Owner to decide whether messages are deleted automatically, e.g. 90 days after a link closes.]
• Messages you sent: if you delete your account, they stay in the creator’s inbox but are no longer linked to you and can never be revealed. Pending reveal requests count as declined.
• Sign-in codes: deleted with your account. [Owner to decide an automatic deletion period, e.g. 30 days.]
• Reports: [e.g. 1 year] after we review them, or longer if needed for a legal process.
• Blocks: until the creator who made them deletes their account. If a blocked sender deletes their account, the block on their device stays.

8. Your rights

Under the DPDP Act (and similar laws elsewhere) you can:

• Access a summary of the personal data we hold about you and how we use it.
• Correct or update your handle and name on your account page, or ask us to correct anything else.
• Erase your data by deleting your account on your account page.
• Withdraw consent, by deleting your account.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Complain to our Grievance Officer, and if you aren’t satisfied, to the Data Protection Board of India.

Email [privacy contact email] from the address on your account. We’ll reply within [e.g. 7 days] and resolve requests within [e.g. 30 days]. Guests don’t have an account we can match to them; if you sent a message as a guest and want it removed, tell us which link and message and we’ll do our best.

9. Children

You must be 18 or older to use LowkeyAsk. We ask everyone to confirm this when they sign up or send their first message. We don’t track, profile or target advertising at anyone. If you believe someone under 18 is using LowkeyAsk, contact us and we’ll remove their data.

10. Security

All traffic uses HTTPS. Session cookies are sealed and encrypted, sign-in codes are stored only as keyed hashes, and device and network identifiers only as salted one-way hashes. Access to production data is limited to the people who run LowkeyAsk. No system is perfectly secure; if a breach affects your personal data, we’ll tell you and the Data Protection Board as the law requires.

11. Changes

If we change this policy we’ll update the date at the top, and tell you by email or in the app before any significant change takes effect.

12. Contact

[Operator legal name], [registered address]. Email [privacy contact email]. Grievance Officer: [name], [email].