What the desk collects, why, and how to ask for it back.

1. What the desk collects

The desk collects the data the desk needs to publish, in three named categories:

• Newsletter subscription: email address and the date the address was added.
• Editorial correspondence: name (if given), email address, the message, and the date the message was received.
• Source submissions: the source's contact channel (encrypted email or Signal handle), the date of the submission, and the desk's note on what was submitted.

The desk does not collect IP addresses beyond the standard server log. The desk does not use third-party analytics. The desk does not load advertising trackers.

2. Why the desk collects it

The desk collects the data above to send the newsletter, to reply to editorial correspondence, and to receive source submissions. The legal basis under the DPDP Act is consent for the newsletter and legitimate use for the editorial correspondence.

3. Who the desk shares it with

The desk shares data with one processor only: the email service provider that delivers the newsletter. The provider is named on the subscribe page and the desk publishes the provider's data-handling policy as a footnote. The desk does not share data with advertising networks, analytics vendors, or social platforms.

4. How long the desk holds it

Newsletter subscriptions are held until the subscriber unsubscribes. Editorial correspondence is held for two years from the last exchange, then deleted. Source submissions are held for the duration of the editorial project they relate to, then archived in a sealed offline store.

5. Your rights under the DPDP Act

Under the Digital Personal Data Protection Act, 2023, you may ask for a summary of the data the desk holds on you, the purpose of processing, and the categories of recipients. You may ask for the data to be erased subject to the desk's editorial-archive retention rules. Erasure requests are answered in 15 days.

Send the request to [email protected]. The desk will reply with the data held and the erasure timeline.

6. Changes to this policy

The desk publishes a corrections note on this page when the policy changes. The "Updated" date at the top of the page is the date of the most recent change. The desk does not email subscribers about policy changes; subscribers may check the page directly.

Cookies

The desk uses one functional cookie: the session cookie that holds the editor's authentication state while the editor is logged in. The cookie expires when the editor closes the browser. The desk does not use third-party cookies, advertising cookies, or analytics cookies. The desk does not set tracking pixels from social media platforms.

The desk does not use cookies to identify anonymous readers. The desk does not use cookies to retarget readers with advertising. The desk does not use cookies to attribute conversions to a paid source. The desk's editorial site is funded by editorial work and modest display-ad revenue on long-form chapters; the desk does not use reader-level tracking to size the ad inventory.

Server logs

The desk's server logs the IP address of every request, the time of the request, the URL of the request, the user agent of the request, and the response code. The logs are kept for 30 days for security and debugging, then deleted. The logs are not used to identify anonymous readers. The logs are not shared with third parties. The logs are not used for advertising or marketing.

The desk's server logs are not used to build a profile of reader behaviour. The desk does not run a content-recommendation engine that uses the logs. The desk does not run a comment system that uses the logs. The desk's editorial site is read-only for readers; the desk does not solicit accounts from readers.

Email service provider

The desk's newsletter is delivered by a named email service provider. The provider processes the email address and the date of subscription for the purpose of delivering the newsletter. The provider does not process the email address for advertising or marketing. The provider publishes a data-handling policy at its own URL; the desk links the provider's policy on the subscribe page.

The desk uses the provider's unsubscribe link to honour opt-out requests. The desk does not use the provider's marketing tools to retarget subscribers with non-newsletter messaging. The provider is the only third party the desk shares data with; the desk does not share data with analytics vendors, advertising networks, or social platforms.

No collection from minors

The desk does not knowingly collect data from readers under the age of 18. The desk does not run copy, imagery, or placement that would appeal to a reader under the legal playing age. The desk's newsletter subscription form requires the subscriber to confirm they are 18 or older. The desk's editorial correspondence channel requires the sender to confirm they are 18 or older.

Reporting a minor's data

If the desk receives data from a reader under 18, the desk erases the data on receipt of the report. The desk replies to the reporter with the date of erasure and the data categories erased. The desk does not retain a copy of the data while the erasure is pending. The desk publishes a quarterly corrections note on the newsroom page if the desk has received and erased data from a minor.

Hosting

The desk's editorial site is hosted by a named hosting provider with data centres in India. The provider processes the IP address of every request for the purpose of serving the response. The provider does not process the IP address for advertising or marketing. The provider publishes a data-handling policy at its own URL; the desk links the provider's policy on the privacy page.

Email service provider

The desk's newsletter is delivered by a named email service provider whose data centres are in India. The provider processes the email address and the date of subscription for the purpose of delivering the newsletter. The provider does not transfer data outside India. The provider publishes a data-handling policy at its own URL; the desk links the provider's policy on the subscribe page.

Government and law enforcement

The desk responds to lawful requests from Indian government and law enforcement agencies. The desk publishes the categories of requests received, the number of requests honoured, and the number of requests rejected on the newsroom page at the end of each quarter. The desk does not publish the names of the requesters or the names of the readers whose data was requested.

Archive contents

The archive contains the original text of every chapter, the original review, the original newsroom brief, and the original corrections note. The archive does not contain reader correspondence. The archive does not contain source submissions. The archive does not contain reader IP addresses. The archive is held in a sealed offline store with no network access.

Archive retention

The archive is retained for the lifetime of the desk. The archive is not transferred if the desk is acquired. The archive is not transferred to a third party under any circumstance. The archive is destroyed when the desk is closed. The desk publishes a notice on the home page 30 days before the archive is destroyed.

Reader access to the archive

Readers may not request a copy of the archive. Readers may request a copy of a specific page the desk has published; the desk will provide the URL and the date of publication. The desk does not provide the original text of the page in a different format. The desk does not provide the original review text in a different format.