Privacy Policy.

1. Who operates this space?

Vamsi’s Corner at vamsimarripudi.me/corner is a personal publication operated by Vamsi Marripudi (referred to as “Corner”, “we” or “us”). It shares stories, projects, notes, wishes and moments, with optional member accounts and owner-managed publishing.

For questions about personal information and privacy requests, contact connect@vamsimarripudi.me. This notice covers the Corner website, its member area, comments, reactions, reader preferences and any clearly marked optional features. The wider vamsimarripudi.me portfolio has separate collection and consent flows; this notice does not turn those into Corner processing.

A feature described as optional may be unavailable or disabled at a particular time. Its description does not promise activation. This policy is a public explanation, not a certification that every legal obligation has already been audited.

2. Personal information we handle

Different information is handled depending on whether you simply read, react, create an account, contribute a comment or opt into a publication update.

• Basic visitor and security information: an automatically assigned first-party pseudonymous visitor token when needed for reactions or abuse prevention; short-lived hashed network identifiers for rate limiting, server security events, general request timestamps and limited browser technical information.
• Member registration and account access: email address, chosen display name, salted/hashed password representation, email-verification status, account role, session metadata, sign-in timestamps and password-recovery records.
• Private profile data: optional short bio, language selection, optional email-update preference, saved/bookmarked stories and a private uploaded profile image. Profile images are resized and processed to remove embedded metadata where supported.
• Contribution data: comment text, the account display name associated with verified comments, moderation state and timestamps; where enabled, guestbook name/message and the consent to submit it.
• Optional publication subscriptions: an email address (protected in storage), chosen topics and frequency, verification/withdrawal records and confirmation history when the opt-in follow feature is enabled.
• Limited first-party basic events: page/story opens, shares and coarse device details can be recorded during public interaction unless the browser has explicitly declined analytics. Separately, optional reading-depth milestones, visible active time, broad source/device groups and selected feedback require an affirmative reading-analytics choice. These flows do not intentionally record typed form text, full search contents, screen replays, precise GPS locations or full referring URLs.

3. Why that information is used

We use account and session information to create and secure access, verify email addresses, allow users to edit private profiles, provide bookmarked content and recover credentials. We use the visitor token to maintain consistent reactions and protect against repeated automated requests. Contributions are processed to review, publish, hide or remove user-submitted messages.

Detailed first-party reading data is processed only where the browser has actively allowed that category of measurement and privacy signals do not block it. A separate limited basic event endpoint may register page/story/share events before an optional choice, but it is blocked when the Corner analytics cookie is set to deny or an applicable browser privacy signal is present. Optional publication emails require their own opt-in and verification; creating an account alone does not subscribe someone to a mailing list.

Limited operational processing also supports error investigation, access control, fraud/abuse prevention, backup recovery, lawful requests and the security and continuity of the publication.

4. Permission, necessity and withdrawal

Where we request a choice—for example optional reading analytics or optional email updates—we aim to make that choice specific, visible and revocable. Essential account operations such as authenticating a login or delivering a requested password-reset message require certain information to provide the service you requested.

For users in India, the applicable lawful grounds will be assessed under the DPDP Act as relevant provisions come into force; the full statutory framework is not yet operative as of this policy date. Consent-based features can be turned off without requiring the visitor to stop reading the site. Turning off an optional category stops new collection for that category subject to technical and legal limitations.

Account deletion requests, correction requests or disputes about ongoing processing can be sent through the private account controls or connect@vamsimarripudi.me. Withdrawal does not automatically erase information that must remain for a lawful retention or security purpose.

5. Cookies and device storage

Corner uses first-party cookies for authenticated sessions, reactions and explicit consent choices. Some temporary state is also kept in session storage—for example navigation or reading-journey data that helps the site work within one browser tab.

Two optional measurement systems are distinct: Corner reading analytics and the wider portfolio website analytics. Their preferences are not interchangeable. A complete purpose-by-purpose list and instructions for changing your choice are in the Cookie & Tracking Policy.

6. What is public and what stays private

Published Corner articles, approved comments, approved guestbook notes and public media may be visible to visitors and may be indexed or copied by search engines. A submitted comment can display the member’s chosen display name next to the comment.

Member email addresses, passwords, authentication tokens, private profile avatars, bookmarked-story lists and account preferences are not intended for public display. Draft or unapproved Studio content is access-controlled. Do not add sensitive personal information about yourself or others to content you intend to publish.

A private profile is not equivalent to an encrypted end-to-end messaging service. Authorized administrators and service providers may need limited access when operating or protecting the site.

7. Service providers and sharing

To host and operate Corner, information may be processed through infrastructure used for the public frontend, backend application, database or verified recovery backups. The connected deployment stack currently includes Vercel and Railway; their involvement can change with infrastructure maintenance.

Account verification or recovery email may be delivered by an email service provider such as Resend when configured. Service providers receive information needed to perform their limited function and operate under their own technical and legal safeguards.

Information may also be disclosed to address suspected abuse, enforce the site's rules, protect visitors, or respond to legally valid orders. We do not sell member details or run behavioral advertising based on personal reading profiles.

8. Hosting locations and international access

Hosting, mail delivery, support and backup services may process or store information in jurisdictions outside India. We do not promise that every copy of data remains in India. Any applicable cross-border restrictions and contractual safeguards will be reviewed as the relevant laws and government directions take effect.

Visitors outside India should understand that their data may be processed under the laws applicable to the infrastructure and operator. If you require a specific jurisdictional data-hosting guarantee, ask before opening an account.

9. Storage and retention

Raw first-party reading measurement records and the separate website analytics observations have a 90-day cleanup lifecycle, subject to a narrower current-tab withdrawal request. A reaction-associated pseudonymous visitor cookie can persist for up to one year unless cleared. Account login cookies currently last approximately seven days for members and eight hours for privileged Studio accounts.

Account, bookmarked-content, comment and published records generally remain while needed for their particular feature or until removed, deactivated or subject to a reviewed rights request. Expired sessions and transient rate-limit records are removed in routine maintenance; security and audit records have separate operational lifecycles.

The offsite backup scheduler defaults to 30-day retention of completed recovery snapshots; deployment configuration, recovery requirements and lawful holds may affect actual retention. Data removed from the active service may therefore remain temporarily in rotating backups until expiry or verified replacement.

10. How information is protected

The application implements hashed password storage, signed or protected session credentials, role-based Studio permissions, verified-email gates, rate limits, origin protections, access-controlled private uploads and operational backup verification. Owner or staff access may require an authenticator depending on role and configuration.

Uploaded profile images are limited to accepted image types and transformed to a smaller, metadata-stripped image; published media and private media have different access rules. Security is a continuing process; no site or transmission can promise perfect protection.

Please report suspected account compromise, exposed private information or security vulnerabilities privately to connect@vamsimarripudi.me rather than posting exploitation details on public pages.

11. Your choices and data requests

A signed-in account can edit its name and bio, update preferences, replace or remove its avatar, review saved stories, inspect active sessions, change password, request a data export and submit a deletion-review request. The account area may require reauthentication for sensitive requests.

You may ask for access, correction, updating or deletion of eligible personal information, withdraw optional consent, raise a complaint or request assistance through the contact email. We may need to verify that the requester is entitled to act for the account or information involved.

DPDP rights and procedural deadlines will apply according to the legislation’s phased commencement and any applicable exemptions. The India DPDP & Data Rights Notice explains that timeline, including routes for a future Board complaint.

12. Children and young visitors

Public stories can be read without creating an account. Member features are designed for people aged 18 or older at present. Corner does not offer a dedicated verifiable parental-consent workflow for child accounts. Children should not create an account or submit identifying information without a lawful basis and appropriate adult involvement.

If you believe information about a child has been supplied improperly, email the operator with enough detail to locate it without sharing additional sensitive information. We will review and restrict or remove it as appropriate.

13. Changes and contact

This notice may be revised when features, service providers or legal requirements change. The displayed review date identifies the version published. Material changes affecting an existing consent purpose will be communicated and choices refreshed where legally required and technically feasible.

For a privacy concern or data request: connect@vamsimarripudi.me. See also the Grievances & Requests Policy, DPDP Notice and Cookie & Tracking Policy.