Privacy policy

What this policy covers

This policy explains what personal information UniSphere collects, why, who can see it, who else handles it, how long it is kept and how you can use your rights. It applies to the UniSphere website and apps.

It is written to follow India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. Some of the Rules' duties are not yet in force: the main ones begin eighteen months after the Rules were published (about May 2027). UniSphere has built its tools ahead of that date. Nothing here is legal advice, and nothing in it says a lawyer or regulator has approved UniSphere.

A shorter, itemised version is the privacy notice. Every page about your privacy rights is listed in the privacy centre.

Who is responsible

UniSphere is run by the UniSphere team. UniSphere decides why and how your personal information is used, which makes it the “Data Fiduciary” under the law. The name and registered address of the operating organisation are published here once the owner has supplied them.

Privacy questions, requests and grievances are answered by Aditya Kumar Gupta. Write to hello@unispheres.in, use the contact form, or use the grievance form.

UniSphere has not appointed a Data Protection Officer. The person above answers instead.

Information we collect

The full, itemised list is in the privacy notice. In short:

• To make an account: your name, username, email address and a password (kept only as a one-way hash), and a statement that you are 18 or older.
• What you add: profile details, photos, posts, comments, projects, events, messages, attachments, connections, Daily Challenge answers and Orbits.
• What helps run and protect the service: IP address and device details of requests, rate-limit counters, security logs, and a push notification address if you switch notifications on.
• If you apply for the blue tick: a masked identity document, and the order and payment reference from Razorpay.
• If you write to us: the name, email address and message you send.

Why we use it, and what we ask your consent for

UniSphere asks for your consent for each purpose separately. Accepting the Terms of Service is a separate step and is never treated as privacy consent.

Required to have an account: using the information you give us to run your account and the features you use, and confirming that you are an adult. Without these we cannot offer an account.

Everything else is optional and off until you turn it on. None of it is a condition of using UniSphere:

• Use AI features on the text I submit: When I use an AI feature (writing help, idea discovery, summaries), send the text I submit for that request to the AI provider UniSphere uses, to get a result.
• Let AI index my public posts and profile for discovery: Convert my public or college-visible posts, projects and profile summary into numeric embeddings with an AI provider, so related ideas and people can be found.
• Review my identity document for the blue tick: Let UniSphere reviewers open the identity document I upload, only to compare my name and photo with my profile for the blue tick.

Changing your mind (withdrawing consent)

You can withdraw an optional consent at any time in Settings → Privacy, as easily as you gave it. Withdrawing one purpose does not affect the others or your account.

Withdrawing the consent your account rests on means leaving UniSphere, so that is done by deleting your account. The privacy notice explains what each withdrawal switches off. Processing done before you withdraw stays lawful.

What is visible to others

Your email address is never shown on your profile. Your profile and posts are visible according to the settings you choose (all members, your college, connections or only you). UniSphere is open to anyone who signs up, but nothing on it is visible to people who are not signed in, and none of it is indexed by search engines. Choosing a college on your profile does not prove you belong to it. Your year and semester are hidden unless you turn on “show my class”.

Profile photos and cover images are stored in public image storage under random addresses. Anyone who has the exact address can open the image, even if your profile is hidden from them. Message attachments, post attachments and identity documents are in private storage and open only through short-lived links given to people allowed to see them.

AI features

AI features are off until you allow them. When you use one (writing help, idea discovery, summaries) the text you submit for that request is sent to an AI provider, with obvious email addresses, phone numbers and ID-like numbers masked first, to get a result. A summary of a post or discussion sends only content that is already visible to the whole platform or to your college (and only if the college setting allows it), plus the question you asked.

UniSphere does not send private messages, private posts, connections-only posts or identity documents to any AI provider. UniSphere does not use your content to train or fine-tune any model of its own. The AI providers are listed in the privacy notice; they handle the text under their own terms, which UniSphere does not control, so it sends as little as it can.

If you also allow AI indexing, your public or college-visible posts, projects and profile summary are turned into numeric embeddings by an embedding provider so related work can be found. This only happens when an embedding provider is configured, and only after you allow it. Turning it off deletes the embeddings made from your content.

AI output is a suggestion. You approve anything before it is published. If AI is unavailable, the rest of UniSphere keeps working.

Cookies and similar technologies

UniSphere uses a small number of cookies and browser storage entries to keep you signed in, remember your appearance setting and keep unsent drafts. It does not use analytics, advertising or tracking cookies, so there is no cookie banner and nothing to switch off. On the one page where you pay for a blue tick, Razorpay's checkout loads and may set its own cookies; it is not loaded anywhere else. The full list is on the cookies page.

Who else handles your information

UniSphere uses service providers (“Data Processors”) who handle information only on UniSphere's behalf, for the purposes in this policy: a database and sign-in service, file storage, a transactional email service, a hosting platform, a rate-limiting cache, AI providers (only if you allow AI), and the payment provider (blue tick only). The privacy notice lists the ones switched on for this site right now, what each receives and why.

Some of these providers process information outside India. The law allows this, subject to restrictions the Government may set for particular countries. UniSphere will follow them.

UniSphere does not sell personal information. It may disclose information where a law, court or authority requires it, and says so in the record it keeps.

Blue tick payments and identity documents

If you buy the optional blue tick, Razorpay takes the payment. UniSphere never receives your card, UPI or bank details. It keeps the order and payment reference, amount, date and status so it can give you the blue tick, handle refunds and meet accounting and tax duties. Those records are kept even after you delete your account.

To confirm who you are, you send an identity document (a masked Aadhaar with the first 8 digits hidden is enough). It is stored in private storage that only blue tick reviewers can open, used only to compare your name and photo with your profile, and deleted when a decision is made. UniSphere does not record your Aadhaar number. You consent to this separately when you apply, and the decision, who made it and when stay in the audit log.

Advertising

UniSphere does not currently show advertising and does not share your information with advertisers. If that changes, this policy and the cookies page will be updated, and anything that needs your consent will ask for it, before any advertisement appears.

Children

UniSphere is for people aged 18 and over. The law treats anyone under 18 as a child and requires a parent's verifiable consent before a child's information is processed; UniSphere has not built that process, so it does not offer accounts to under-18s. When you sign up, you declare that you are 18 or older. That is a declaration, not a check: UniSphere does not ask for a date of birth or an identity document to test it.

If someone tells UniSphere, or it becomes clear, that an account belongs to someone under 18, the account is restricted and the person is offered deletion. UniSphere does not track or monitor children's behaviour and does not aim advertising at them.

How long we keep information

UniSphere keeps information only as long as it is needed for the purpose it was collected for. There is no single period; it depends on the kind of record. The privacy notice lists each kind and how it ends.

• Your account, profile, posts, messages and files: while your account is active.
• When you delete your account: a 14-day grace period in which you can change your mind, then erasure. Your files are removed from storage and your account and the content you own are deleted.
• Kept after deletion, because another law or someone else's safety requires it: payment records (accounting and tax law), reports made about the account with the content they quoted (community safety), messages already delivered to other people if you chose to keep them (they no longer show your name), and entries in the audit log, which carry only an anonymous id.
• Support messages and closed requests: removed or anonymised after a retention window the privacy team sets and publishes in the privacy notice. These windows are being reviewed and may change; changes are announced in the notice.
• Logs: UniSphere's own audit log is kept, and the Rules ask for logs of processing to be kept for at least a year once they apply.
• Backups kept by the database provider expire on the provider's schedule. A record of erased accounts is kept so an erased account cannot come back if a backup is restored. See the privacy notice.

How we protect information

What is in place today:

• Encrypted connections (HTTPS) between you and UniSphere.
• Access rules enforced inside the database, not only in the interface, so one member cannot read another's private data.
• Passwords stored only as one-way hashes. Sign-in, password and request attempts are rate limited.
• Private storage with short-lived links for attachments and identity documents.
• Staff access is limited by role. Privacy records are open only to named privacy staff, not to every administrator, and staff actions are written to an audit log that cannot be edited.
• A written process for handling a personal data breach, including telling affected people and the Data Protection Board.

What is not in place

UniSphere has not had an independent security audit and holds no security or privacy certification. No system is perfectly secure; please use a strong, unique password. If you find a weakness, tell us through the contact form.

Your rights and how to use them

Under the law you can ask UniSphere to give you a summary of your information and how it is used, correct or complete it, erase it, and withdraw consent; you can have a grievance heard; and you can nominate someone to exercise your rights if you die or cannot. Signed-in members can do each of these themselves:

• Get a copy of your data: Settings → Privacy requests (you must be signed in). The privacy centre explains each step.
• Correct your data: edit your profile in Settings, or send a correction request for what you cannot edit yourself.
• Delete your account and data: Settings → Privacy requests → Delete account. You confirm with your password.
• Withdraw a consent: Settings → Privacy.
• Nominate someone: Settings → Privacy requests.
• Raise a grievance: the grievance form, open to everyone, including people without an account. You get a reference number and can follow its progress. We aim to reply within 14 days and commit to resolving it within 90 days.

If you are not satisfied

If your grievance is not resolved, you can complain to the Data Protection Board of India. The law expects you to use UniSphere's grievance process first. The Board publishes how to file a complaint; UniSphere does not control that process.

If there is a data breach

If personal information held by UniSphere is breached, UniSphere will tell each affected person, in plain language and without delay, what happened, what it may mean for them, what has been done and what they can do, and will report to the Data Protection Board within the times the Rules set. UniSphere does not publish incident details on public pages.

Changes to this policy

Every version of this policy and the privacy notice is kept, with its date, so you can see what applied when. When a change affects what you have agreed to, UniSphere tells you in the app and asks for your consent again only where the law requires it. It never changes a choice you made without asking you.

Contact

Questions about this policy, or a request about your information? Use the contact form, the grievance form, or email hello@unispheres.in. Say which account or email address it concerns so we can find it. We may need to confirm that you are the person the information is about before we act. We will not give one person another person's information.