Privacy Policy

1. Who we are and what this covers

PunjabiClub ("we", "us", "our") builds software for Punjab and its diaspora. For the purposes of the EU/UK General Data Protection Regulation ("GDPR") and India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), PunjabiClub is the data controller (or "data fiduciary") for the personal data described here.

This policy covers:

• punjabi.club — our public landing site at punjabi.club.
• PunjabiClub ID — our shared sign-in and account service at auth.punjabi.club, used by every PunjabiClub project.
• punjabi.markets — our livestock marketplace at punjabi.markets.
• punjabi.social — our community space at punjabi.social.
• punjabi.wiki — our community dictionary of words, idioms, proverbs and affixes at punjabi.wiki.
• Future services. any new PunjabiClub product we launch. Where a new service needs to collect data not described here, we will update this policy (see Changes) before or when we launch it.

This policy does not apply to third-party sites or services you reach from ours; those have their own privacy policies.

2. What we collect

We collect different data depending on which service you use. You choose how much to share: you can browse punjabi.club and much of punjabi.markets without an account.

Account and identity data (PunjabiClub ID)

When you create or use a PunjabiClub ID, we process the data needed to run an account and sign you in:

• Identifiers such as your email address, a username or display name, and your account ID.
• Credentials such as a password hash and any authentication factors you enable — passkeys, time-based one-time passwords (TOTP), and other two-factor methods. We store cryptographic material, never your raw biometrics or the secret behind your passkey.
• Optional profile data you add, such as a photo, bio, or locale.
• Security and session data such as session tokens, sign-in timestamps, IP address, and basic device/browser information used to keep your session valid and to detect suspicious sign-ins.

Marketplace data (punjabi.markets)

If you buy, sell, or list livestock on punjabi.markets, we collect:

• Listing content you publish — animal details, descriptions, photos, prices, and location (typically district or area, not a precise address).
• Contact details you choose to publish so buyers and sellers can reach each other directly, such as a phone number or messaging handle.
• Activity data such as saved listings, searches, and reports you make.

Social data (punjabi.social)

If you use punjabi.social, we collect:

• Content you post — posts, comments, and reactions — together with when you posted them.
• Social graph data — who you follow and who follows you.
• Signals you give us such as reports, blocks, and feedback.

Dictionary data (punjabi.wiki)

If you contribute to punjabi.wiki, we collect:

• Entries you submit — words, idioms, proverbs and affixes, along with meanings, examples, and the language or script variant you assign.
• Attribution you choose such as a display name or contributor handle shown with your entry.
• Review and activity data such as edits, moderation status, and reviewer decisions, used to keep the dictionary accurate and to prevent abuse.

Technical and usage data

Across our services we automatically process limited technical data needed to serve pages and keep things secure: IP address, a user-agent string, requested URL, and timestamp. Our servers keep standard access logs, which we use for security, debugging, and aggregate traffic understanding. We do not build advertising profiles.

Communications

If you email us or contact us through a service, we keep the message and our correspondence so we can help and keep a record.

3. How and why we use it

We use personal data to:

• create, authenticate, and secure your account and sessions;
• provide the features you ask for — listing livestock, posting, following, messaging, saving, and contributing dictionary entries;
• keep the services safe: prevent fraud and abuse, rate-limit attacks, and investigate reports;
• respond to support requests and communicate service notices;
• operate, fix, and improve the services, using aggregated or de-identified information where possible;
• comply with legal obligations and enforce our terms.

We do not sell your personal data, and we do not use it for third-party advertising. We do not make decisions that produce legal effects about you through automated processing without human involvement.

4. Our legal bases

Where the GDPR applies, we rely on the following legal bases. Under the DPDP Act we rely on your consent and on legitimate uses permitted by law.

5. Cookies and local storage

We aim to be cookie-light. We use cookies and similar browser storage that are strictly necessary to keep you signed in and to protect your session — for example, an authentication session cookie and a CSRF/anti-forgery token. These are essential to the service and are not used to track you across other sites.

We do not use advertising or cross-site tracking cookies. If we ever add optional analytics, we will describe it here and ask for consent where required.

6. Sharing and third parties

We do not sell personal data. We share it only in these limited cases:

• With other users, by your choice. Content you publish on punjabi.markets, punjabi.social, or punjabi.wiki is visible to others. Contact details you add to a listing are shared so buyers can reach you. Please only publish what you are comfortable sharing.
• Providers that help us run the services. These may include hosting and network providers that process data on our instructions under contracts requiring confidentiality and security.
• Legal and safety. When required by law, or to protect the rights, safety, and security of our users or the public, we may disclose data — after assessing the request.
• Business changes. If PunjabiClub is ever reorganised, we may transfer data to a successor, which will remain bound by this policy.

7. International transfers

PunjabiClub serves a global diaspora, so your data may be processed in a country other than your own — for example, on the servers where we host the services, or by a provider's network edge. Where the GDPR applies to a transfer, we rely on lawful transfer mechanisms (such as standard contractual clauses) and take steps to protect your data.

8. How long we keep data

We keep personal data only as long as we need it for the purposes above:

• Account data is kept while your account is active. If you delete your account, we delete or de-identify the associated personal data within a reasonable period, except where we must keep it for legal or security reasons.
• Content you posted remains until you delete it, your account is deleted, or a service removes it under its rules.
• Server access logs are kept for a short period for security and then rotated out.

9. How we protect data

• Transport encryption (HTTPS/TLS) for data in transit.
• Authentication built around modern factors — passkeys and TOTP — with support for strong two-factor authentication.
• Access controls and least-privilege access to our systems.
• Regular updates and backups so we can recover from incidents.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

10. Children

Our services are not directed at children. Under the GDPR we do not knowingly process the data of children below the age required for valid consent in their country; under the DPDP Act we do not knowingly process children's data without verifiable parental consent. If you believe a child has given us personal data, contact us and we will remove it.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or restrict use of your personal data, to object to certain processing, and to withdraw consent at any time. Under the DPDP Act you also have the right to nominate someone to exercise your rights in the event of death or incapacity, and the right to a grievance remedy.

You can exercise many of these directly in your account settings — including deleting your account (see Account and data deletion) — or by emailing us (see Contact). We will respond within the time allowed by law. You may also complain to your local data protection authority — or, in India, the Data Protection Board of India.

12. Account and data deletion

You can delete your PunjabiClub ID and the personal data associated with it at any time. Deleting your account signs you out of every PunjabiClub service and removes your profile, credentials, and authentication factors.

To delete your account, either:

• open your account settings at auth.punjabi.club and choose the delete-account option; or
• email [email protected] with the subject "Delete my account", from the address linked to your account.

You may also ask us to export a copy of your personal data, or to delete specific content. We action verified requests within a reasonable period and no later than the time required by law.

When your account is deleted we delete or de-identify the personal data associated with it, except where we must keep some of it to comply with the law, resolve disputes, prevent fraud or abuse, or as described in How long we keep data. Content you posted publicly — such as marketplace listings, social posts, or dictionary entries — may remain visible if you have not deleted it, and may be retained in backups for a limited period.

13. Changes to this policy

We expect PunjabiClub to grow, so we may update this policy as we add or change services, or as the law changes. When we make a material change we will update the date at the top of this page and, where appropriate, tell you through the service or by email. We recommend checking back occasionally.

14. Contact us

Questions about this policy or your personal data? Email us at [email protected] with "Privacy" in the subject, and we will get back to you.