Privacy Policy
In effect from August 29, 2026. Prachar is operated by CHANGE_ME Private Limited.
This describes what Prachar collects, why, and what you can ask us to do about it. It is written to be read, not to be survived. If anything here is unclear, write to privacy@dcrayons.app and we will explain it in plain words.
1. Who this covers
Two different groups, and the difference matters.
- People who use Prachar — business owners and the colleagues they invite. You gave us your details directly.
- People who contacted a business through a social platform — if a Prachar customer connects their Instagram or Facebook account, we may store comments and messages sent to that business, including the sender's name and handle. You did not give us anything. The business you wrote to decides what happens to it; we hold it on their behalf. Section 8 explains your rights.
2. What we collect
From you, because you typed it
- Your name, email address and, if you give one, your phone number
- Your password, stored only as a one-way hash — we cannot read it, and nor can anyone who takes a copy of our database
- Your timezone and language, so times and dates read correctly
- Your business details: name, category, city, contact email and phone, website, description and logo
- What you sell: product and service names, prices, descriptions and pictures
- Posts you write, pictures you upload, and figures you record about your own advertising
Automatically, when you use the service
- Your IP address and browser description, kept against each signed-in device so you can see and end sessions you do not recognise
- A record of significant actions in your workspace — who connected an account, who deleted a post — with the IP address it came from
- When you were last active
From a social platform, only if you connect one
- The connected account's username, display name, profile picture and platform identifier
- An access token, so we can act on your behalf. Tokens are encrypted at rest in a separate table and are never shown in the interface or written to our logs
- Which permissions you granted, so the interface never offers something the platform would refuse
- Comments, messages and reviews sent to your account, including the sender's name, handle and the text they wrote
We do not collect payment card details. If and when Prachar charges for anything, that is handled by a payment provider and card numbers never reach our servers.
3. Why we collect it
| What | Why |
|---|---|
| Name, email, password | To give you an account and let you sign back into it |
| Email address | To send you a link if you forget your password, to confirm the address is yours, and to tell you when a post went out or failed |
| Business details and catalog | To build content about the things you actually sell |
| IP address and browser | So you can recognise your own devices, and so we can slow down somebody guessing passwords |
| Social account tokens | To publish what you scheduled and read what people sent you |
| Comments and messages | To show you what people said to your business, in one place |
| Action records | So a change to your workspace can be explained afterwards |
4. What we never do
- We do not sell your data, or the data of people who message you, to anybody
- We do not use your content or your customers' messages to train models
- We do not post anything you did not schedule
- We do not read your messages except to display them back to you
5. Who else sees it
Only where the service cannot work otherwise, and only what is needed:
- The social platforms you connect — we send them what you asked us to publish. Their own policies then apply to it
- Our hosting provider — the servers your data sits on
- Our email provider — receives your address and the content of mail we send you
- Anyone you invite into your workspace — they see everything in it. That is what an invitation means, so invite carefully
- A lawful authority — if we are legally required to, and we will tell you unless we are forbidden from doing so
6. Where it is kept, and for how long
Data is stored on servers in India. We keep it while your account exists, with these exceptions:
- Sessions are deleted 30 days after they expire or are signed out
- Password reset links expire after two hours and can be used once
- Address confirmation links expire after three days
- Action records are kept for as long as the workspace exists, because their purpose is to explain what happened
When you delete your account we remove your data within 30 days, other than anything we are legally required to keep. See Delete my data.
7. How it is protected
- Everything travels over HTTPS. We refuse plain connections
- Passwords are hashed with bcrypt and cannot be reversed
- Social platform tokens are encrypted at rest
- Each workspace is isolated: a request for another workspace's data does not resolve, whatever address is typed
- Sign-in attempts are rate limited
- You can see every signed-in device and end any of them, including all at once
No system is perfectly secure. If we discover a breach affecting your data we will tell you and the Data Protection Board of India as the law requires.
8. Your rights
Under India's Digital Personal Data Protection Act, 2023, you may ask us to:
- Show you what we hold about you and who we have shared it with
- Correct anything wrong, incomplete or out of date
- Erase it, where we are not required to keep it
- Nominate somebody to exercise these rights if you die or become incapacitated
- Complain to us, and then to the Data Protection Board if our answer does not satisfy you
Most of this you can do yourself inside the app, without asking. For anything else, write to privacy@dcrayons.app.
If you messaged a business and did not sign up for Prachar
Your message is held on behalf of the business you wrote to, and they decide what happens to it. Ask them first. If you cannot reach them, write to privacy@dcrayons.app and we will pass your request on and tell you we have.
9. Children
Prachar is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will delete it.
10. Complaints
Our Grievance Officer is CHANGE_ME, reachable at grievance@dcrayons.app. We will respond within 30 days.
If our answer does not satisfy you, you may complain to the Data Protection Board of India.
11. Changes
If we change something that matters, we will email you before it takes effect rather than quietly updating this page. The date at the top always tells you which version you are reading.