Loading the wire…
0days24-hour wire · IST · Bureaucracy
Search the wire, jump between pages, or change your reading mode.
Privacy
Reading this site needs no account. There is no advertising, no third-party analytics, no tracking pixel, and nothing is sold. This page lists every piece of data the deployment actually stores.
Last updated 25 October 2026
The Bureaucracy is an independent reading room run by Muditya Raghav. For the purposes of India's Digital Personal Data Protection Act, 2023 (DPDP Act), the editor is the Data Fiduciary for the data described here. Contact: 0xmudit@gmail.com.
| Data | What it contains | Kept |
|---|---|---|
| Page views | Path, referrer, a random visitor id, and your account id only if you are signed in. No IP address is written to this table. | 90 days |
| Account | Email, display name, password hash (handled by Supabase Auth), verification state, role and suspension status. Passwords are never visible to the editor. | Until deleted |
| Sign-in events | Email, the kind of event (sign-up, login, logout) and the time. Used to spot abuse and answer support questions. | 180 days |
| Reactions and saves | A random reader id (web cookie) or a random device id from the native app, the story, and whether it was a like, dislike or save. Likes and dislikes are mutually exclusive. There is no public list of who reacted and no leaderboard. | With the story |
| Comments | Display name, body, timestamp, optional edit time, and the account link if you were signed in. Comments are public and stay with the story in the archive. | With the story |
| Notifications and push | In-app notification rows (type, title, link, read time) and, if you allow push, a browser push endpoint with its public keys. The endpoint is removed when you unsubscribe. | Until read + 180 days |
| Location preference | Only the state and district you choose, for local alerts. Raw coordinates are used once to reverse-geocode and then discarded; they are never stored. | Until you change it |
| Reports | The comment reported, a reason, an optional note, and a salted hash of the reporter's address or account id. One report per person per comment. | Open, then 180 days |
| Rate limits | A salted SHA-256 hash of the address or device id, the window start and a counter. The raw address is never stored. | 1 day |
| Error reports | Only when error monitoring is enabled: the error and stack trace, the route, and browser/runtime details. Configured not to send IP addresses, cookies or authorisation headers. | 90 days |
Reading progress, saved stories, streaks and revealed prelims answers are kept in your browser's local storage, on your device. They are not sent to the server. Clearing site data removes them.
Our host (Vercel) and database provider (Supabase) process request metadata, including IP addresses, in their own operational logs for routing, security and abuse prevention. We do not export those logs into our database.
We do not use your data for advertising, profiling, automated decision-making with legal effect, or sale to anyone. There is no newsletter unless you separately ask for the digest.
tb_visitor — a random id that lets the visit counter distinguish a returning reader from a new one. HttpOnly, one year.tb_voter — a random reader id used to keep one reaction per browser. HttpOnly, one year.tb_desk and tb_desk_skip — the exam track and optional subject you chose, so the feed can be tilted without an account. One year.sb-* — Supabase session cookies, present only after you sign in. They keep you signed in and are removed when you sign out.There are no advertising or analytics cookies. The only storage in your browser beyond these cookies is local storage beginning tb_, which stays on your device.
Data is processed by the infrastructure needed to run the site: Vercel (hosting and request logs), Supabase (database, authentication and email delivery), and the SMTP provider configured for confirmation mail. If error monitoring is enabled, Sentry receives the error report described above. These providers act on our instructions and have their own privacy terms.
We may disclose data if required by law or to protect someone from harm, and we will tell you unless prohibited. We do not sell data, share it with advertisers, or publish a public profile of readers.
Some providers process data outside India. Where that happens, the transfer is covered by the provider's contractual safeguards and the restrictions notified under the DPDP Act.
Under the DPDP Act you can ask for a summary of your data, correction of inaccurate data, erasure, and withdrawal of consent. You can delete your account yourself from account settings; deleting it removes the profile and the authentication record, and signs you out everywhere.
To exercise any other right, email 0xmudit@gmail.com with the address you used. We aim to respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
The site is served over TLS. Database access is server-side only, row-level security is enabled on every table, browser sessions are HttpOnly, and rate-limit keys are salted hashes. No system is perfect; if you find a problem, report it privately to the address above rather than posting it.
The site is written for adults preparing for civil-services examinations and is not directed to anyone under 18. We do not knowingly collect data from children. If a child has created an account, write to us and it will be removed.
If this policy changes in a way that affects what is collected or how long it is kept, the date at the top changes and a note appears on the wire. Continuing to use the site after a change means the updated policy applies.
See also the terms of use and how the wire works.