1. Who this notice covers
This Privacy Policy applies to visitors, account holders, people using admission-comparison tools, contributors, support correspondents and other users of deetnuts.com. DEETNUTS determines how personal information is used for operation of the Service and is the contact for privacy and grievance requests.
Public cutoff pages are open to everyone and do not require an account or analytics consent. This notice does not govern an official counselling portal, Google, Supabase, Vercel, YouTube, Cloudinary, a payment checkout, or another independent site you choose to visit.
Privacy and grievance contact: help@deetnuts.com. Use the subject “Privacy request” and identify the relevant account or interaction without sending a password, one-time code, identity document or full payment-card number.
2. Information processed
| Category | What it can include | Source | Why it is used |
|---|---|---|---|
| Request and security data | IP address, approximate city or country derived from IP, date and time, requested route, HTTP method and status, referrer, user agent, device or browser class, request identifiers, performance, error and security events. | Your browser, hosting infrastructure and security controls. | Deliver pages, route traffic, prevent abuse, investigate errors, maintain availability and protect accounts. |
| Account and profile data | Google-provided account identifier, email address, display name and avatar; Supabase user and session identifiers; profile name; avatar uploads; email-verification and authentication timestamps. | You, Google OAuth and Supabase Auth. | Create and secure an account, maintain a session, display account details and support authenticated features. |
| Admission-comparison inputs | Entered rank or percentile, score type, candidature type, home university, category, gender-seat eligibility and selected indicators for EWS, TFWS, disability, orphan or minority eligibility. | You, when you submit a comparison or save a profile in your browser. | Derive applicable historical seat pools and calculate the comparison you requested. |
| Service-use events | A random request identifier, feature name, broad platform, served/rejected/failed status and request duration. Bot integrations may additionally record the platform’s external message identifier and values needed to answer that request. | Your use of a search, API or bot feature. | Enforce limits, diagnose failures, prevent duplicate processing and understand aggregate service reliability. |
| Optional analytics | Sanitised route template, page-view event, Core Web Vitals, browser and device information, consented analytics identifiers, and network information necessarily received by Google when the tag is requested. | Your browser, only after an affirmative analytics choice. | Measure page performance and broad usage so the Service can be improved. |
| Messages and corrections | Email address, message content, attachments, relevant page or source identifiers, response history and abuse-prevention metadata. | You and the mail provider you use. | Respond, verify a correction, resolve a grievance, keep an audit trail and protect the support channel. |
| Contribution records | Transaction reference, status, amount and contact details that a checkout provider makes available to the project. Card and bank credentials are entered on the provider’s page, not on DEETNUTS. | The external checkout provider and you. | Confirm and reconcile voluntary support, handle billing questions and meet accounting obligations. |
3. Admission-profile processing
A saved candidate profile is stored in browser local storage under a DEETNUTS key. A profile placed in a share link is encoded after the # fragment. Browsers do not include that fragment in the ordinary HTTP request for the page, but anyone who receives the complete link can read it.
When you select the comparison action, the profile values are sent to the DEETNUTS comparison endpoint so the server can calculate a response. That request uses HTTPS in production, has a strict size limit, is validated, is returned with no-store caching, and is not intentionally written into the custom service-use event. Hosting and network providers still process ordinary request metadata.
Because category, disability and minority selections can be sensitive in context, share a profile link only with a person you trust. Do not enter a diagnosis, certificate number, government identifier or document image. “Clear profile” removes the saved browser copy and the DEETNUTS profile fragment; it does not delete a copy that another person already saved from a shared link.
4. Analytics and advertising
Google Analytics is optional and uses a global opt-in. Before an affirmative Allow choice, the external Google tag is not loaded and DEETNUTS does not send an analytics request to Google. Decline leaves public functionality available. The choice can be reopened from “Cookie settings” in either footer.
DEETNUTS sends a route template instead of the exact dynamic college or profile path. URL fragments, cutoff-filter selections, account names, email addresses and admission-profile values are not added to analytics events. Google advertising storage, advertising user data and advertising personalisation stay denied; Google Signals and ad-personalisation signals are disabled in the site configuration.
DEETNUTS does not sell personal information, use admission selections to build advertising profiles, operate interest-based advertising, or provide personal information to data brokers. A YouTube embed may independently display non-personalised advertising under YouTube’s controls. See the Cookie Policy for the storage inventory and withdrawal mechanics.
5. Purposes and grounds
DEETNUTS processes information only for a stated and lawful purpose, using no more than is reasonably necessary for that purpose. Depending on the feature and the law that applies, processing is based on your request or agreement, your consent, legitimate operation and security of the Service, compliance with law, protection of a person, or establishment and defence of legal claims.
- Requested service: deliver pages, authenticate an account, calculate a comparison, answer a support request or process a contribution.
- Consent: run optional Google Analytics and any other clearly identified optional processing.
- Security and operation: prevent abuse, enforce usage limits, diagnose failures, preserve evidence of malicious activity and maintain reliable infrastructure.
- Compliance: respond to valid legal process, keep records required by law and handle privacy, correction or dispute requests.
Where consent is the applicable ground, it may be withdrawn as easily as it was given. Withdrawal does not make earlier lawful processing unlawful and does not prevent retention that another applicable legal ground requires.
6. Providers and disclosures
| Provider or recipient | Function | Information involved | When |
|---|---|---|---|
| Vercel | Hosting, content delivery, functions, request routing and operational logs. | Request, network, device, approximate-location, performance and error information; content sent to server endpoints. | When the Service is requested. |
| Supabase | Authentication, database, storage and server-side service records. | Account, session, profile, avatar, database and limited service-use event data. | When an account or Supabase-backed feature is used. |
| OAuth sign-in and optional Google Analytics. | OAuth identity and security data during sign-in; analytics information only after Allow. | When Google sign-in is chosen or analytics is allowed. | |
| Cloudinary | Delivery of selected image assets. | Ordinary image-request metadata, including IP address, user agent and referrer information supplied by the browser. | When a page loads a Cloudinary-hosted image. |
| YouTube | Privacy-enhanced embedded video playback. | Player request, IP address, user agent, referrer and interaction data described by YouTube. | When a page containing the embed loads or you interact with it. |
| Checkout provider | External payment and transaction processing. | Information you enter at checkout and transaction details made available for reconciliation. | Only if you open and use the external checkout. |
| Authorities and advisers | Lawful requests, incident response and claims. | Only information reasonably relevant to the request, incident or claim. | When required by law or reasonably necessary to protect a person, the Service or a legal position. |
DEETNUTS may also disclose information in a genuine transfer or reorganisation of the Service, subject to appropriate confidentiality and applicable notice requirements. It does not publish account or candidate-profile information as part of public cutoff pages.
7. International processing
The Service and its providers may process information in India, the United States, the European Economic Area and other locations where they or their subprocessors operate. Those locations may apply different privacy rules. Where required, the relevant provider terms, contractual safeguards, adequacy mechanism or other lawful transfer method is used.
Public internet transmission necessarily crosses networks operated by multiple entities. No policy can promise that information remains in one country merely because the visitor or DEETNUTS is located there.
8. Retention
Information is retained for the shortest period reasonably needed for the stated purpose, security, dispute handling and mandatory recordkeeping. The applicable period depends on the record:
- Admission-profile values: the browser copy remains until you use Clear profile, clear site storage or overwrite it. Submitted comparison bodies are processed to return the result and are not intentionally stored in the custom service-use event.
- Anonymous usage counter: the first-party server counter expires after seven days. The corresponding local action counter remains until cleared, reset or replaced.
- Analytics consent: the versioned preference expires after 180 days unless changed sooner. Optional GA cookies follow the periods in the Cookie Policy and browser limits.
- Analytics reports: event-level retention follows the configured Google Analytics property period. Aggregated reports and deletion-system latency may continue beyond the event-level setting as described by Google.
- Accounts: active account and profile records remain while the account is used. After a verified deletion request, active account data is deleted or de-identified unless security, fraud, dispute or legal duties require a limited record.
- Operational logs: hosting and runtime logs follow the active hosting plan and provider controls. Security evidence may be retained longer when tied to an abuse investigation or legal requirement.
- Support and corrections: ordinarily retained for up to 24 months after resolution, or longer when needed to document a material data correction, dispute, abuse report or legal obligation.
- Contribution and accounting records: retained for the period required for reconciliation, tax, fraud prevention, chargebacks and applicable accounting law.
- Backups: deleted information may remain temporarily in access-restricted backups until the backup cycle replaces it.
9. Security
DEETNUTS uses safeguards appropriate to the nature of the Service, including HTTPS in production, secure response headers, restricted server credentials, input validation, request-size limits, no-store responses for personalised comparisons, authenticated account checks, provider access controls, checksum validation for cutoff artifacts and separation of public pages from account features.
No internet service can guarantee absolute security. You are responsible for securing your Google account, device and complete share links. If you believe personal information or an account has been compromised, contact help@deetnuts.com promptly with the time and nature of the incident, but do not email passwords or one-time codes.
When a personal-data incident requires notice under applicable law, DEETNUTS will investigate, contain the issue, preserve appropriate evidence and notify affected people and authorities in the manner and timeframe required.
10. Your privacy choices and requests
Subject to applicable law and necessary verification, you may ask DEETNUTS to provide information about processing, give access to personal information associated with you, correct inaccurate or incomplete information, erase information no longer needed, withdraw consent, or address a grievance. Where applicable, you may also nominate another person to exercise a request in the event of death or incapacity and may complain to the competent data-protection authority after using the grievance process.
- Analytics: use Cookie settings to Allow, Decline or revoke optional analytics.
- Browser profile: use Clear profile and remove a shared fragment from any copy of the URL.
- Account profile: update the displayed name in Account settings.
- Account or data request: email help@deetnuts.com from the account address where possible.
- Marketing: DEETNUTS does not currently send behavioural marketing email. A future optional mailing list would require its own clear control.
A request should state the action sought and the relevant feature, account email, URL, date or transaction reference. DEETNUTS may request proportionate verification, may redact another person’s information, and may refuse or limit a request where applicable law permits or requires it. A response will be provided within the applicable legal period; privacy grievances are targeted for resolution within one month.
11. Children and students
The subject matter is relevant to students, including people under 18, but public cutoff pages do not require a name, account or candidate profile. DEETNUTS does not knowingly request birth dates, school records, identity documents or precise location from children and does not use student profiles for targeted advertising.
If you are under 18, involve a parent or lawful guardian before creating an account, submitting a personalised profile, making a contribution, contacting support with personal information or allowing analytics. A parent or guardian may request review or deletion through the privacy contact. If DEETNUTS learns that personal information was processed without required permission, it will take reasonable steps to stop and delete that processing unless retention is legally required.
12. Automated comparisons
Comparison tools apply deterministic filters and calculations to historical cutoff data. They do not make an admission decision, communicate with a counselling authority, change your application or produce a legally significant decision about you. No DEETNUTS output should be used as the sole basis for a decision that materially affects another person.
13. Policy changes
This page carries an effective date and version. Material changes will be presented with an updated date and, where required, a prominent notice or renewed choice. A new purpose that requires consent will not be treated as accepted merely because you visited before the change.
This notice is intended to remain understandable on its own and to operate alongside applicable Indian privacy requirements, including provisions of the Digital Personal Data Protection Act, 2023 and its rules as they come into force, without limiting protections that apply in another jurisdiction.
14. Privacy and grievance contact
Send privacy questions, grievances, access or deletion requests and suspected incidents to help@deetnuts.com. DEETNUTS will acknowledge a properly directed grievance, investigate it in good faith and target resolution within one month or the shorter period required by applicable law.