Legal & Privacy
Privacy Policy
Last Updated: 12 August 2026
Welcome to tossatale (“tossatale”, “we”, “us”, or “our”). This Privacy Policy explains how we collect, use, store, protect, and share information when you access or use our digital storytelling platform, website, applications, stories, blogs, videos, and related services (collectively, the “Platform”).
By using tossatale, you acknowledge and agree to the collection and use of your information in accordance with this Privacy Policy. If you do not agree with this policy, please discontinue use of the Platform.
1. Information We Collect
We collect information in the following categories:
A. Information You Provide Directly
- Account Details: Full name, email address, password, and profile photo when registering.
- Writer Information: Biography, portfolio links, social media handles, and profile preferences.
- Content Submissions: Stories, essays, articles, series chapters, and review notes.
- Communications: Messages, feedback, or support inquiries sent to our editorial team.
B. Information Collected via Third-Party Authentication
When you authenticate through Google Sign-In (OAuth), Google shares your name, verified email address, profile photo URL, and authentication token. We do not receive or store your Google password.
C. Automatic Usage & Engagement Data
- Reading Activity: Stories viewed, estimated read times, likes, bookmarks, and shares.
- Technical Logs: Device type, browser user-agent, operating system, and IP address for security and anti-fraud verification.
2. How We Use Your Information
We use collected information solely for legitimate operational purposes:
- To provide, operate, and maintain the tossatale digital storytelling platform.
- To authenticate readers, writers, and administrators securely.
- To review, curate, format, and publish approved stories and series.
- To calculate aggregate engagement metrics (views, likes, bookmarks, reads) without exposing individual reader identities.
- To deliver administrative notifications, verification codes (OTP), editorial review feedback, and platform updates.
- To detect, prevent, and mitigate spam, automated bot activity, fraud, and security vulnerabilities.
3. What We Never Do
- We never sell, rent, or trade your personal information or reading history to third parties or data brokers.
- We do not run invasive third-party cross-site advertising trackers.
- We never share individual reading logs with writers. Writers receive aggregated view counts and engagement numbers, never individual reader names.
4. Information Sharing & Service Providers
We may share necessary data with trusted third-party service providers bound by strict confidentiality and data protection obligations:
- Google OAuth: For secure one-click user sign-in and account verification.
- Email Delivery (Resend API / SMTP): For transmitting password reset codes (OTP), security notices, and editorial status updates.
- Hosting & Cloud Infrastructure: For hosting databases, media files, and server infrastructure.
- YouTube: For embedding and streaming short films and video documentaries.
- Legal Compliance: When required by applicable Indian law, court order, or governmental authority.
5. Cookies & Local Storage
tossatale uses essential cookies and local storage tokens exclusively for functional purposes:
- Authentication Tokens: Secure JWT / session cookies to maintain your logged-in state.
- Theme Preference: To remember your Light / Dark mode display settings.
- Reading State: To preserve your place in serialized longform chapters and bookmarks.
6. Data Security & Retention
We implement industry-standard administrative, technical, and physical security measures, including HTTPS encryption, hashed passwords (PBKDF2/Argon2), and role-based access controls to safeguard your data.
We retain your information only as long as necessary to provide platform services or comply with legal obligations.
7. Your Rights & Choices
You have complete control over your personal information:
- Access & Update: Edit your profile details, bio, photo, and social links at any time in your Studio Settings.
- Password Management: Reset your password securely via OTP verification.
- Account Deletion: You may request the permanent deletion of your account and personal records by contacting our support team.
8. Children's Privacy
tossatale is not directed to children under the age of consent under applicable Indian law without parental involvement. We do not knowingly collect personal data from minors without parental consent.
9. Governing Law
This Privacy Policy is governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023 (DPDPA) and the Information Technology Act, 2000.
10. Contact Us & Grievance Officer
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:
By using tossatale, you acknowledge that you have read, understood, and agreed to this Privacy Policy.