Privacy policy

We collect the minimum needed to run the site, and we do not sell personal data to anyone. You can read every verdict on SortedChoice without an account, without logging in, and without telling us who you are.

SortedChoice is operated by Jayesh Gavit, an individual operating as a sole proprietor in India, trading as SortedChoice. For the purposes of the Digital Personal Data Protection Act, 2023 we are the data fiduciary for the data described here; under the UK and EU GDPR, where those apply to you, we are the controller.

• Contact for privacy matters: gavitjayesh08@gmail.com
• Grievance Officer: Jayesh Gavit — see grievance redressal for the process and the deadlines we hold ourselves to.

If you never make an account

Standard server and security logs — IP address, browser user agent, the pages requested, and timestamps. These exist to keep the service running and to detect abuse.

If you make an account

• Email address, and a password stored only as a cryptographic hash — we never hold your password itself. If you sign in with a provider such as Google, we receive your email address and basic profile from them, not your provider password.
• Things you choose to save — saved products, category preferences, and notification settings.
• Reviews and ratings you submit, including any images you attach. These are published, so treat their contents as public.

If you contact us or subscribe

Your email address and whatever you write in the message. Newsletter subscription is double opt-in: we record the confirmation so we can prove consent.

• To provide the service you asked for — your account, your saved items, your reviews. Without this data those features cannot exist.
• Because you consented — the newsletter. Withdrawable at any time, and withdrawing is as easy as giving it.
• Because we have a legitimate interest — keeping the site up, preventing fraud and review manipulation, and understanding in aggregate which pages are useful. Our own readership counters and Google Analytics both sit here: they measure which pages are read, not who read them, and we do not use either to build a profile of you or share either with advertisers. Google Analytics is on by default and you can switch it off at any time in your settings; our own counters store no identifier of any kind, so there is nothing in them to switch off.
• Because the law requires it — records we are obliged to keep.

We use service providers to operate the site. They process data on our instructions and may not use it for their own purposes:

• Supabase — database, authentication, and file storage.
• Our hosting and CDN provider — serving the site and absorbing attacks.
• Our email provider — account emails and, if you asked for it, the newsletter.

We do not sell your data. When you follow a link to a retailer you leave our site and that retailer’s own privacy policy applies — we do not pass them your account details, and we do not receive your order contents back. See the affiliate disclosure.

The site runs on infrastructure operated by providers whose servers may sit outside India — our database and authentication provider, our host and CDN, and our email provider all operate globally. Your data may therefore be stored or processed in another country.

Where that happens we rely on the transfer safeguards those providers offer — contractual protections including, where relevant, the European Commission’s standard contractual clauses — and we do not transfer data to any country the Indian government has restricted under the DPDP Act.

Want to know the current list of providers and where they process? Ask us at gavitjayesh08@gmail.com and we will tell you.

• Account data — until you delete your account, then removed within 30 days except where we must retain something by law.
• Published reviews — these survive account deletion in anonymised form, because removing them would silently rewrite a product’s rating history. Ask us and we will remove them outright.
• Server logs — a rolling window, typically 30 days.
• Contact messages — up to 24 months, so we can follow up.

You can ask us to:

• show you a copy of everything we hold about you;
• correct anything that is wrong;
• delete your data, and your account with it;
• stop using it for a particular purpose, or restrict it while we investigate;
• hand it over in a portable, machine-readable format.

Most of this you can do yourself from your account settings. For anything else, ask us or write to gavitjayesh08@gmail.com, and we will respond within 30 days. We will not make the site worse for you because you exercised a right.

Where you gave consent — the newsletter — you can withdraw it at any time, and withdrawing is as easy as giving it was. Where we rely on legitimate interest, you can object: for analytics that objection is the switch in your settings, which takes effect immediately and needs no request to us. If we handle a request badly, take it to our Grievance Officer through grievance redressal; if that does not resolve it, you can complain to the Data Protection Board of India, or to your own supervisory authority if you are in the EU or UK.

Traffic is encrypted in transit. Passwords are hashed, never stored in a readable form. Access to production data is restricted to the people who need it, protected by multi-factor authentication, and logged.

No system is perfect. If we discover a breach affecting your data we will tell you and the relevant regulator, without burying it in a changelog.

SortedChoice is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, tell us and we will delete it.

When this policy changes we update the effective date at the top. For changes that materially affect your rights we will tell account holders directly rather than relying on you to re-read the page.