Privacy Policy

Effective 11 September 2026 · TheTuningChoice, operated by Ajit Sahu (an individual). Short, plain-language, honest.

1. Who is responsible

The Site is run by one person, Ajit Sahu, who is the data handler ("Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) for everything collected here. Any question, request or complaint: hello@thetuningchoice.in.

2. What is collected, and only that

• Page views: each page load records the page path and a pseudonymous daily hash of the visitor's IP address. The raw IP is never stored and the hash changes every day, so it cannot track a person across days.
• Outbound clicks: when a buy link is used, the Site records which store and product was clicked, with the same pseudonymous daily hash.
• Email address: only if a visitor chooses to receive watchlist/price-drop notifications or the weekly digest. The alert threshold a visitor picks is stored alongside it. Nothing else - no name, no phone number, no address.
• Account (optional): an account stores the email address, an optional display name, and a salted hash of the password - never the password itself. Signing in with Google stores only the Google account id and email address. The wishlist, price alerts, star ratings and suggestions attach to the account; without one, the wishlist stays in an anonymous browser cookie and rating, alerting and suggesting are simply not available.

Payment details never touch this Site: nothing is ever sold here.

Store catalog data is not personal data. The prices, stock states and store ratings shown on the Site are read from each store's own public catalog feed - most tracked stores run on Shopify, which publishes that feed publicly at every store's /products.json and auto-generates robots.txt rules that allow catalogs to be read. No store accounts, no credentials and no store customer data are involved at any point; a store that asks to be removed is muted immediately.

3. Consent (India's DPDP Act, 2023)

Email subscriptions are processed on the basis of consent given freely, specifically, informedly and unambiguously, as Section 6 of the DPDP Act expects: the box is never pre-ticked, the signup form states exactly what will be sent and how often, and this policy is linked right beside it. Consent can be withdrawn as easily as it was given - the unsubscribe link in every email, or one email to the address above - and withdrawal takes effect immediately. Browsing the Site needs no account, no email and no consent at all. An account exists only for visitors who want the permanent wishlist, price alerts, or the ability to rate products - and is created by that visitor, on purpose.

4. Purpose limitation

Data is used only for the purpose it was given for: sending the notifications or digest a visitor asked for, and counting page views and clicks in aggregate to keep the catalog healthy. There is no profiling, no automated decision-making, no advertising of any kind, and personal data is never sold, rented or traded - to anyone, ever.

5. Who else touches the data (processors)

The Site runs on a small number of service providers, each receiving only what it needs: Vercel (hosting and its first-party, cookieless analytics), Turso (database storage) and Resend (email delivery, for subscribers only). No processor is authorized to use this data for anything else. If a provider ever changes, this page is updated.

6. How long data is kept

Page-view and click records contain no direct identifier and are kept as aggregate statistics. A subscriber's email address is kept while the subscription is active and deleted within 30 days of unsubscribing. Account data (email, optional name, wishlist, alerts, ratings) is kept while the account exists; one email to the address above deletes the account and everything attached to it. Consent records (signup date, source form) are kept to be able to demonstrate that consent existed.

7. Cookies

The Site sets no advertising or analytics cookies. The essential cookies it does set: the administrator's login session; a long-lived anonymous id for the wishlist (no account involved); an account login session, only when someone signs in; and a ten-minute handshake cookie, only while a Google sign-in is in flight.

8. Emails

Every notification and digest email states who sent it and why, and carries an unsubscribe link. Unsubscribing stops all non-essential email immediately.

9. Children

The Site is not directed at children, and knowingly collecting a child's personal data is not done. Under the DPDP Act, verifiable parental consent is required before processing a child's data - if a parent or guardian believes a child subscribed, one email removes the address completely.

10. Rights and grievance redressal

Under the DPDP Act a visitor can ask to see what data is associated with an email address, have it corrected, have it erased, or have their consent withdrawn. Email hello@thetuningchoice.in and it is done within 7 days. If the answer is not satisfactory, the same address escalates the complaint, and the Data Protection Board of India remains available as the last resort.

11. Security and breach notice

Secrets live in environment variables, never in code. Every database query is parameter-bound, raw IP addresses are never written to disk, and admin access is password-gated. One person runs the Site, which means one person is accountable for all of the above. If a breach of personal data ever happens, everyone affected - and the Data Protection Board of India, as India's DPDP Rules require - will be told what happened, what data was involved, and what is being done about it.