1. Data Fiduciary
LexStreak is an independent legal technology platform operating under the Digital Personal Data Protection Act 2023. Contact: grievance@lexstreak.in
2. Data collected and purposes
Email address (account identification), full name (display), State and district (personalised coverage), subject matter preferences (curate daily headnote feed), reading progress and streak data (gamification), bookmarked cases (personal library), and voluntarily: leaderboard participation, usage analytics, and connecting with another user as a friend (only your display name, streak count, total XP and the broad subject-matter categories you read most — for example “Criminal Law”, never a specific judgment title — become visible to a friend, only after you both explicitly accept the connection; how many judgments you've read per category is hidden by default and only shared if you switch it on yourself from Profile → Privacy; either of you can remove the connection at any time from Progress → Friends). You may also choose to share a saved judgment or folder directly with a friend, optionally including your personal highlights and notes; a shared item appears in the recipient's own Saved tab tagged with who shared it, and either of you can remove it independently at any time. Usage analytics, where consented, includes coarse technical information — device type and model, operating system, browser, and approximate location (country, state and city derived from your network connection; never precise GPS location) — used only in aggregated form to understand how the app is used and improve it. It is never sold or shared for advertising. On our public pages (the landing page, publicly shared judgment pages and the sign-in page) we also record cookieless, aggregate visit counts to understand how many people view the site and which pages they read. This uses no cookies and no persistent identifier, involves no personally identifiable information, and stores only a page name, referrer, coarse device type and approximate country; the data stays in India (ap-south-1). We also use your own in-app activity — which judgments you read, open, save and are shown — to personalise the order of your feed and Q&A (fewer repeats, more of what is relevant to your practice); this uses only your first-party activity, stays in India (ap-south-1), is never sold or shared, and you can switch it off anytime from Profile → Personalisation.
3. Lawful basis
Consent (DPDPA Section 6). You may withdraw consent at any time. Withdrawal will result in account closure and data erasure within 30 days.
4. Data storage and security
All data is stored on AWS Mumbai (ap-south-1) infrastructure via Supabase. Data does not leave India. Supabase provides encryption at rest and in transit (TLS 1.3). Row-level security ensures no user can access another user's data.
5. Retention
Account and profile data: retained until erasure request. Reading progress: anonymised after 24 months. Consent audit logs: retained for 7 years per legal obligation.
6. Third-party processors
Supabase Inc. (database and authentication — contractually bound). Razorpay (payments when activated — PCI-DSS compliant). No advertising networks. No data brokers.
7. Children
LexStreak is intended for advocates, judges, law students and legal professionals. We do not knowingly process data of persons under 18.
8. Your rights
Under DPDPA 2023: Right to access (Section 11), right to correction and erasure (Section 12), right to grievance redressal within 30 days (Section 13), right to nominate a representative. Exercise via Profile → Data Rights or email grievance@lexstreak.in.
9. Grievance Redressal
Grievance Officer: LexStreak. Email: grievance@lexstreak.in. All grievances will be acknowledged within 72 hours and resolved within 30 days. If unsatisfied, you may approach the Data Protection Board of India.
10. Breach notification
In the event of a personal data breach, affected data principals and the Data Protection Board of India will be notified within 72 hours per DPDP Rule 7.