Privacy Policy & Personal Data Notice
Effective Date: September 28, 2026 • Version 1.0 (Staging Audit Draft)
info Notice under Section 5 of the Digital Personal Data Protection Act, 2023 (India)
This Privacy Policy explains how WatchRoom ("we", "us", or "our"), operated by the entity responsible for orivellixengine.in as Data Fiduciary, processes digital personal data when you access or use our real-time synchronized video party platform. Please read this notice before creating an account or using the service.
1. Data Fiduciary Identity & Contact
The Data Fiduciary responsible for processing your personal data is the operator of WatchRoom (orivellixengine.in). For any questions or to exercise your rights under Indian law, contact our designated Grievance Officer:
2. Personal Data We Actually Collect
We believe in strict data minimization. We only collect data necessary to provide synchronized playback and account security:
- Account Data: Email address, cryptographically hashed passwords (using salted bcrypt, cost factor 10), and your chosen Display Name. We never see or store your plaintext password.
- Session Identifiers: A randomly generated 32-byte session token stored in an HttpOnly, secure cookie (`watchroom_session`), hashed via SHA-256 for database storage.
- Party Participation & Communication: Room creation timestamps, room membership records, timestamped chat messages you post inside a room, and coarse watch progress checkpoints (position in seconds).
- Ephemeral Interactions: Real-time playback status (play, pause, seek offsets) and live emoji reactions. Emoji reactions are broadcast in RAM only and are not stored in a database.
- Network & Rate-Limiting Telemetry: IP addresses processed in memory and transient Redis counters solely for abusive rate-limiting mitigation (expiring in 60 seconds).
We do NOT collect government identifiers, biometric data, financial payment credentials, or continuous geolocation tracking.
3. Purposes and Lawful Grounds of Processing
Under Section 4 and Section 6 of the DPDP Act 2023, we process personal data under the following grounds:
- Service Delivery (Contractual Performance): Authenticating your user identity, establishing room host playback authority, and delivering synchronized video timestamps.
- Specific Consent: Voluntarily creating an account and participating in public or private watch parties.
- Security & Incident Prevention (Legitimate Use): Detecting denial-of-service attempts, preventing cross-site WebSocket hijacking, and enforcing rate limits.
4. Age Policy: Strictly 18+ for Staging
In accordance with Section 9 of the DPDP Act, 2023 (Processing of personal data of children), WatchRoom requires users to be at least 18 years of age to register or host rooms during this staging rollout. We do not knowingly collect personal data from individuals under 18 years of age without verifiable parental consent. If we learn that personal data of a minor has been collected without parental consent, we will take immediate steps to erase such data.
5. Third-Party Infrastructure Processors
To operate our real-time synchronized cloud service, we partner with specialized cloud infrastructure processors:
Neon Inc. (Database)
Serverless PostgreSQL (AWS us-east-2). Stores encrypted user accounts, room tables, chat messages, and watch history.
Redis Ltd. (Memory Cache)
Distributed memory layer (AWS us-east-1). Stores ephemeral participant rosters, real-time lock coordination, and rate-limiting keys.
Vercel Inc. (Frontend Hosting)
Global edge delivery (including Mumbai edge). Delivers static HTML, CSS, and client-side JavaScript assets.
Cloud Container Host (Render)
Persistent compute node handling authoritative synchronization calculations and WebSocket connections.
All cross-border data transfers comply with Section 16 of the DPDP Act, 2023, utilizing industry-standard TLS encryption in transit.
6. Data Retention & Erasure
- Active Sessions: Automatically expire 7 days after creation. Expired session records are purged every 60 minutes.
- Account & Room Data: Retained while your account remains active. Upon verified deletion request, account records and associated room memberships are deleted within 30 days.
- Watch History: You can clear your watch history at any time through the authenticated dashboard.
7. Your Rights under the DPDP Act, 2023
Under Chapter III (Rights and Duties of Data Principal), you have the right to:
- Right to Access (Section 11): Request a summary of your personal data being processed and the identities of data processors with whom it has been shared.
- Right to Correction & Erasure (Section 12): Request correction of inaccurate data, updating of incomplete data, or erasure of personal data that is no longer necessary for service delivery.
- Right to Grievance Redressal (Section 13): File a grievance regarding our data processing practices with our Grievance Officer.
- Right to Nominate (Section 14): Nominate an individual who shall exercise your data rights in the event of death or incapacity.
To exercise any of these rights, email grievance@orivellixengine.in from your registered email address.
8. Grievance Redressal & Escalation
We are committed to addressing your concerns promptly. If you submit a grievance, our Grievance Officer will acknowledge receipt within 48 hours and provide a substantive resolution within 30 days as prescribed under the DPDP Rules. If you remain dissatisfied with our resolution, you have the statutory right under Section 13(3) to file a complaint before the Data Protection Board of India.