Privacy Policy

This Policy explains how Solarcom ("Solarcom", "we", "us") handles personal data when you use solarcom.in and its community forum (the "Service"). For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary, and you are the Data Principal. It forms part of our Terms of Use.

1. The short version

• We collect what running a public Q&A forum needs, and say so below.
• We do not sell your personal data, we run no advertising, and we embed no third-party analytics or tracking scripts.
• We keep our own record of what happens on the Service — including pages you open and buttons you press. It stays with us. See section 2.
• Anything you post — questions, answers, comments, your display name, username and profile details — is public by design, visible to anyone, and indexable by search engines.
• Editing or deleting a post does not erase what it said. We keep the earlier text so moderators can act on reports about it. See section 6.
• We set two cookies, both needed to keep you signed in. See section 10.
• Your email address and mobile number are never shown publicly.
• Accounts are for people aged 18 and over.

2. Data we collect

You give us:

• Account data — name, username, email address, account type, and either a password or a Google sign-in. Passwords are stored only as a salted bcrypt hash; we never hold the plaintext and cannot recover it.
• Profile data (optional) — profile picture, bio, location, company, website and social links. All of it is public, so include only what you are happy for the world to see.
• Mobile number (optional) — kept private, used only to reach you about your account.
• Content — questions, answers, comments, images you attach, likes, dislikes, bookmarks and reports you submit.
• Drafts — questions you save without posting. They are stored on our servers against your account so you can finish them on any device, are visible only to you, and are never kept in your browser's storage. Photos are not saved with a draft.
• Correspondence — messages you send us by email or through the contact form, appeals against moderation decisions, and any reason you give when asking for your account to be deleted.

We receive from Google, if you sign in with Google:

• Your email address, name and profile picture, and confirmation that Google has verified that address. We ask for nothing else, and get no access to your Gmail, Drive, contacts or any other Google service.
• The sign-in is handled by Firebase Authentication; we verify the token Google issues and then create our own session. We never receive your Google password.

We record as you use the Service:

• Account and security events — sign-ins and failed sign-in attempts, verification codes sent and confirmed, changes to your email, password or account type, reuse of an expired session token, and requests to delete your account. Each carries the time, your IP address and a shortened description of your browser.
• Actions on content — questions, answers and comments you post, edit or delete, and likes, dislikes, bookmarks and reports you make.
• Use of the Service — the pages you open and the controls you press, recorded as the page path and the button's own label. We do not record what you type into search boxes or forms, and paths are stored without their query strings for that reason.
• Technical logs — request metadata generated by our servers and hosting provider in the ordinary course of operating and securing the Service.

This record is our own. It is not shared with an analytics company, it feeds no advertising profile, and no third-party script collects it in parallel. Our staff can read it.

We do not knowingly collect financial account details, government identifiers, biometric data or health data. Please do not post them — and do not post an electricity bill without covering your consumer number and address.

3. Why we use it, and on what basis

We process personal data on the basis of the consent you give when you register and, where the DPDP Act allows, for legitimate uses without separate consent. Specifically:

• To provide the Service — create and authenticate your account, publish your content and attribute it to you. Basis: your consent, and the use you have voluntarily provided the data for.
• To keep the Service safe — detect and investigate spam, abuse, account takeover and breaches of our Terms, and act on reports. Basis: legitimate use for security, and compliance with law.
• To understand and improve the Service — see which topics and features are used, and where people get stuck. Basis: your consent. We do not use this to build advertising profiles.
• To communicate with you — verification codes, replies to your queries, notifications about activity on your posts, and service or security notices.
• To comply with law — respond to lawful requests and meet obligations under the Information Technology Act, 2000 and rules made under it. Basis: legal obligation.

We use personal data only for the purposes above. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

4. Who we share it with

We do not sell, rent or trade personal data. We share it only with:

• Google (Firebase) — our database, uploaded images and the Google sign-in flow run on Google Cloud Firestore, Cloud Storage and Firebase Authentication. They process this data on our instructions to host the Service.
• Resend — delivers our email: verification codes, notifications and replies. They receive your email address and the contents of that message, and nothing else.
• Authorities — where we are legally required to disclose, as described in clause 11 of the Terms of Use, or where disclosure is necessary to protect our rights, our users or the public.
• A successor — if the Service is merged, acquired or its assets sold, in which case we will notify you and the acquirer remains bound by this Policy.

These providers may store or process data on servers outside India. Where that happens we rely on the provider's contractual safeguards, and transfer data only to jurisdictions not restricted by the Central Government under the DPDP Act.

5. Public content and search engines

The forum is a public archive. Your posts and profile can be read without an account, indexed by search engines, and copied or quoted by others. Deleting content from Solarcom does not remove copies already cached or republished elsewhere, and we cannot control third-party caches.

6. Edits and deletions are recorded

When you edit a question, answer or comment, we keep the previous text alongside the new one. When you delete a comment or answer, we keep what it said. Both records show who made the change and when, and are visible to our moderation staff — not to other members.

This exists for one reason: a post that is reported for abuse and then quietly rewritten or removed would otherwise leave the report describing something nobody can read, and there would be no way to act on it fairly. It is not used for any other purpose.

7. How long we keep it

• Account and profile data — while your account is open, and for a short period afterwards to handle disputes and prevent abuse.
• Content — indefinitely, as part of the public archive, unless removed under section 8.
• Drafts — until you post or delete them, or your account is deleted, whichever comes first.
• Activity records — page views and clicks are kept for up to 12 months. Security events such as sign-ins and verification are kept longer where needed to investigate abuse, then deleted or anonymised.
• Edit and deletion history — kept while the underlying account and discussion exist, so a report can still be assessed after the fact.
• Session tokens — stored only as a one-way hash and valid once. A used token's record is kept until its 30-day expiry so that a stolen copy presented later can be recognised; signing out deletes it immediately.
• Verification codes — stored as a hash, valid for ten minutes, and destroyed once used or expired.

We keep data longer only where a law requires it or where it is needed for an ongoing legal claim. When data is no longer needed for its purpose we erase it, unless the law requires us to retain it.

8. Your rights

Under the DPDP Act you may, in respect of your personal data:

• Access a summary of the data we process and who we have shared it with. Ask from Help & Support by choosing “Request a copy of my data”.
• Correct or complete inaccurate data — most of it yourself under Settings, or email us and we will make the change.
• Erase data that is no longer needed for the purpose it was collected for. You can ask us to delete your account from Help & Support by choosing “Delete my account”. A request sent while you are signed in is linked to your account; one sent while signed out is confirmed with the account's email address first, so that nobody can delete an account that isn't theirs. We review each request and confirm before anything is removed. Because the forum is a shared public record, we may anonymise posts rather than delete them where removing one side of a conversation would render the rest unintelligible.
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out, and withdrawing consent for processing that is essential to the Service means we can no longer provide you an account.
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Grievance redressal — complain to us, and if you are not satisfied, to the Data Protection Board of India.

To exercise any of these, email hello@solarcom.in from the address on your account. We will respond within the period required by law. We may ask you to verify your identity before acting, and may decline requests that are manifestly unfounded, repetitive, or that would infringe another person's rights.

You are responsible for the accuracy of the data you give us, and for not filing false or frivolous complaints — the DPDP Act imposes duties on Data Principals too.

9. Security

We apply reasonable technical and organisational safeguards, including:

• passwords stored as salted bcrypt hashes, never in plaintext;
• verification codes stored as hashes, expiring in ten minutes, limited in attempts and rate-limited between sends;
• short-lived, HTTP-only session cookies that JavaScript cannot read, and single-use refresh tokens stored only as hashes — presenting a used token ends every session on the account;
• encryption in transit (HTTPS), no direct client access to our database — every read and write passes through our own API — and refusal of state-changing requests that come from other websites;
• sanitisation of user-submitted content before it is displayed, to prevent script injection;
• staff and member accounts kept entirely separate, so staff access cannot be reached through the public site;
• rate limiting on sensitive operations such as sign-in, registration and code sending.

No system is perfectly secure. If a personal data breach occurs we will notify the Data Protection Board of India and each affected user as the DPDP Act requires.

10. Cookies and similar technologies

We set two cookies. Both are strictly necessary to keep you signed in. We use no advertising, analytics, social-media or third-party cookies of any kind — which is why you are not shown a consent banner: cookies essential to deliver a service you have asked for do not require one.

• sc_access — holds a short-lived signed token identifying your session. Expires after 15 minutes.
• sc_refresh — holds a single-use token that renews your session so you are not signed out every 15 minutes. Expires after 30 days, is sent only to our sign-in endpoints, is replaced every time it is used, and is deleted when you sign out.

Both are first-party, set by our own API, and HTTP-only — JavaScript running in a page cannot read them — and in production are Secure, so they travel only over HTTPS. Because our API currently runs on a different domain from the site, they are configured to accompany requests from our site to that API; our API refuses any request that would change data if it comes from another website. Neither cookie contains your name, email address or password, and neither is used to track you across other websites.

We do not use local storage, session storage or similar technologies to store personal data. Images are served through our own domain rather than directly from a storage provider, so viewing a page does not expose you to a third party. If any of this changes, this section will be updated first.

You can delete or block cookies in your browser settings. Doing so signs you out and prevents signing in, but all public content — questions, answers, profiles, guides and the calculator — remains available with cookies blocked entirely.

11. Children

The DPDP Act treats anyone under 18 as a child, and processing a child's personal data requires verifiable consent from a parent or lawful guardian. The Service has no means of obtaining that consent, so accounts are only for people aged 18 and over. We do not knowingly collect personal data from children, and we do not carry out tracking, behavioural monitoring or targeted advertising directed at children. If you believe a child has created an account or given us personal data, contact us and we will delete it.

12. Contact and grievances

• Privacy queries: hello@solarcom.in
• Grievance email: hello@solarcom.in

We acknowledge grievances within 24 hours and resolve them within 15 days. If you remain dissatisfied you may complain to the Data Protection Board of India.

13. Changes to this Policy

We may update this Policy. The "Last updated" date above always reflects the current version, and we will give reasonable notice of material changes through the Service or by email.