Privacy Policy

Rising Hat (“Rising Hat”, “we”, “us”) is a community website for readers and authors at risinghat.com, operated by Surabhi Gupta, an individual based in India. This policy explains what personal data we collect, why, who we share it with, and the rights you have. For data protection purposes we are the “data controller” (GDPR) / “data fiduciary” (India's Digital Personal Data Protection Act, 2023) for your data.

Questions or requests: hello@risinghat.com.

1. What we collect

Information you give us

• Account details: username, email address and password. Passwords are stored only as a secure hash by our authentication provider; we never see them in plain text.
• Sign-up confirmations: that you agreed to these policies, the version you agreed to, and your age confirmation (including, for users aged 13–17, your confirmation that a parent or guardian agrees).
• Profile: bio, the avatar you choose, and whether you identify as an author.
• Reading activity: your reading list and statuses, reading start/finish dates, ratings and scores, and your Top 10 recommendations.
• Content you post: reviews, comments, forum threads and replies, and reports you file about other content.
• Submissions and claims: books you list for review (title, authors, description, cover links and similar) and author-claim requests, including the verification link you provide.
• Messages to us: anything you send to our contact email.

Information collected automatically

• Technical data: IP address, browser and device type, pages requested and timestamps, kept in our hosting and database providers' logs for security and troubleshooting.
• Abuse prevention: your IP address and the email address used in a login attempt are stored in short-lived counters to limit repeated login and sign-up attempts. These are deleted within about a day.
• Cookies and local storage: see Cookies below.

We do not collect payment information, precise location, contacts, or any special-category data (such as health or religious beliefs). Please don't include such information in public posts.

2. How we use it, and our legal bases

Under India's DPDP Act, we process your personal data on the basis of the consent you give at sign-up and for the legitimate uses the Act permits. We do not sell your personal data, we do not use it for advertising, and we do not make automated decisions that have legal or similarly significant effects on you.

3. What is public

Your username, bio, avatar, author status, join date, reviews, ratings (in aggregate), comments, forum posts and Top 10 recommendations are visible to anyone, including people who are not logged in, and may be indexed by search engines. Your email address, reading list, reading history, submissions and author claims are private to you (and to administrators where needed to review them).

4. Who we share it with

We share personal data only with service providers that help us run Rising Hat, under contracts that limit their use of it:

• Supabase — database and user authentication (stores your account and content).
• Vercel — website hosting (processes requests, including IP addresses, and keeps request logs). Our application servers run in Singapore.
• Email delivery — account emails are sent through our authentication provider.
• Google Analytics — planned. If we add it, it will only run after you accept analytics cookies, and this policy will be updated first.

Book cover images are loaded directly from third-party image hosts (such as Open Library at covers.openlibrary.org, or a link a submitter provided). When your browser loads a cover, that host receives your IP address and browser details, as with any image on the web.

We may also disclose information if required by law, to respond to valid legal process, to protect the rights, safety or property of our users or the public, or as part of a transfer of the service to a new operator (in which case this policy will continue to apply to your data).

5. International transfers

Rising Hat is run from India and our providers process data in other countries, including Singapore and the United States. Where data from the EU/UK is transferred to countries without an adequacy decision, we rely on our providers' Standard Contractual Clauses or equivalent safeguards. Transfers out of India are made in line with the DPDP Act.

6. How long we keep it

• Account and content: for as long as your account exists. When you delete your account, your profile, reading data, ratings, reviews, comments, forum posts, submissions and claims are deleted immediately. Deleting a forum thread you started also removes replies within it.
• Backups: deleted data may remain in encrypted backups for up to 30 days before being overwritten.
• Rate-limit counters: about one day.
• Server and security logs: kept by our providers for a limited period (typically up to 30 days) unless needed to investigate abuse.
• Emails to us: as long as needed to handle your request, and up to 3 years for records of legal or grievance requests.

7. Your rights and choices

Depending on where you live, you have some or all of these rights:

• Access and portability: download a copy of your data at any time from your profile (“Download my data”).
• Correction: edit your profile, reviews and posts, or ask us to correct other data.
• Deletion / erasure: delete your account from your profile (“Delete account”), or ask us to delete specific content.
• Withdraw consent: where we rely on consent (for example analytics cookies), you can withdraw it at any time; this doesn't affect processing before withdrawal.
• Objection and restriction (EU/UK): object to processing based on legitimate interests, or ask us to restrict processing.
• Nominate (India): nominate another person to exercise your rights in the event of your death or incapacity.
• California residents: rights to know, delete and correct, and to not be discriminated against for exercising them. We do not sell or “share” personal information for cross-context behavioural advertising.
• Complain: to our Grievance Officer (below), and to your local data protection authority — for example the Data Protection Board of India, an EU supervisory authority, or the UK Information Commissioner's Office.

To exercise a right, email hello@risinghat.com from the address on your account. We will respond within 30 days (or sooner where the law requires) and may need to verify your identity.

8. Children

You must be at least 13 years old to create an account. If you are under 18, you may use Rising Hat only with the consent of your parent or legal guardian, and you confirm this when you sign up. We do not knowingly collect personal data from children under 13, and we do not track or target advertising at anyone under 18. If you believe a child under 13 has created an account, or that a minor has signed up without parental consent, please contact us and we will delete the account.

9. Security

We use HTTPS everywhere, hashed passwords, database access controls, rate limiting and the security features of our providers. No system is perfectly secure; if we become aware of a breach affecting your personal data we will notify you and the relevant authorities as the law requires. Please use a unique password for Rising Hat.

10. Cookies

Cookies are small files stored by your browser. Rising Hat currently uses only what is strictly necessary to run the site, which does not require consent:

Analytics (planned): we intend to add Google Analytics to understand how the site is used. Before we do, we will update this section with the exact cookies and ask for your consent through a cookie banner. Analytics cookies will not be set unless you accept them, and you will be able to change your choice at any time.

You can also block or delete cookies in your browser settings; if you block the login cookie you won't be able to stay logged in.

11. Grievance Officer

In accordance with India's Information Technology Act, 2000, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act, 2023, our Grievance Officer is:

Surabhi Gupta
Email: hello@risinghat.com

We acknowledge complaints within 24 hours and aim to resolve them within 15 days.

12. Changes to this policy

We may update this policy. We'll change the effective date above and, for material changes, notify you by email or on the site before they take effect.