Privacy Policy

1. Who we are

FindFake (findfake.in) is operated by the FindFake team. For anything in this policy write to contact@findfake.in. We follow the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules.

2. What we collect

• Browsing without an account: nothing is needed to read the public feed, people pages and incidents. A random anonymous ID is kept in your browser so Practice Mode can count your answers.
• Account: your email address, a password (stored only as a one-way argon2id hash, never readable by us) or the identity from a third-party sign-in you choose to use, and optionally a username and phone number you add yourself.
• What you submit for verification: the file or link you send, any description or source link you add, and the result we give you. We also keep a record of the review.
• Face watch (Pro): a faceprint, explained in section 4. Not your photo.
• Activity inside the app: people you follow, notifications, Practice Mode answers, email preferences.
• Subscription records (Pro): your plan, start and end dates, and the amount and UPI reference of the payment you made, so we can match it to your account. We never see your bank or UPI credentials.
• Technical data: IP address, browser type and request logs, kept for security, abuse prevention and fixing faults. Your IP address is also used to rate-limit requests.

3. Why we use it

• To run your account, sign you in and keep it secure.
• To check what you submit and email you the result.
• To send the emails you asked for: sign-up confirmation, verification results, and (for Pro) the daily digest and renewal reminders. Each non-essential email has an unsubscribe link.
• To protect the service from abuse and to meet legal obligations.
• We do not sell your data, do not run advertising, and do not use your submissions or faceprint to train any AI model.

4. Faceprints (biometric data)

Face watch is optional and only for subscribers. If you use it:

• You upload one photo of yourself. We convert it into a faceprint, a list of numbers used only to compare against faces in newly published synthetic media. The original photo is discarded and is never stored.
• A faceprint cannot be turned back into your photo. We use it for nothing else: not to identify you elsewhere, not to train models, not to share with advertisers.
• Only enroll your own face. Enrolling someone else's face is not allowed (see the Terms).
• You can delete your faceprint at any time under Alerts → Active watches → Delete. Deleting also erases its matches and the takedown text generated for them. This works even if your subscription has ended. Deleting your whole account removes it too.

5. Who else handles your data

To deliver the service we use reputed third-party platforms whenever needed, for example to check media, search for where an image appears elsewhere, send email, support sign-in and host our servers. They process data only on our behalf and only for those purposes. This means that media you submit for verification, and its result, may be shared with such platforms as part of checking it. If you do not want a file shared this way, please do not submit it.

Public news and fact-check articles may be read and translated by automated language tools to build the feed. Your submissions, account details and faceprints are never used for that.

Some of these platforms operate outside India, so data may be processed there. We may also disclose data when the law requires it, for example to a court or a government authority acting under Indian law.

6. How long we keep it

• Faceprints: until you delete them or delete your account.
• Account data: while your account exists. When you delete your account it is erased immediately.
• Submissions and their results: kept until you delete them by deleting your account. A fact-check we published from your submission can stay as a public record; it is detached from your account and your uploaded file is removed from it.
• Payment references and subscription dates: kept without your name (only a masked label such as d***@example.com) for accounting and tax purposes for the period the law requires.
• A security log of important events (for example that an account was deleted) is kept with an anonymous ID and no email address.
• Request logs: kept for a short period for security and then removed.

7. Your rights

You may see the data we hold about you, correct it, erase it, or stop us using it for something you consented to. You can withdraw consent at any time (for example by deleting your faceprint or unsubscribing from emails).

• Delete your account yourself: Profile → Delete account. You confirm with your password (or a fresh sign-in if you use a third-party sign-in) and by typing DELETE. Everything described in section 6 as erased is removed at once, you are signed out everywhere, and we email you a confirmation. It cannot be undone.
• For anything else, or if you cannot sign in, write to contact@findfake.in from the email address on the account; we aim to answer within 30 days. If we have not resolved your concern you can complain to the Data Protection Board of India.

Grievance contact: contact@findfake.in.

8. Security

Connections use HTTPS. Passwords are hashed with argon2id. Access to admin tools is limited by role and logged. Uploaded files are stored in private storage and are not publicly accessible. No system is perfectly secure; if a breach affects you we will tell you and the authorities as the law requires.

9. Cookies and browser storage

We use one secure cookie that keeps you signed in, and your browser's local storage for your session token, your theme choice, an anonymous ID for Practice Mode and a note that you accepted the face-watch consent. We do not use advertising or cross-site tracking cookies.

10. Children

FindFake is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has given us data, tell us and we will delete it.

11. Changes

If we change this policy in a way that matters we will say so in the app or by email before it takes effect. The date at the top shows the latest version.