Your privacy.
We collect what we need to run the tower, the community and the audits, and nothing for advertising. We don't sell your data.
holdmycrown is run by its founder, an individual based in India, who is responsible for your data here. Questions or requests go to hello@holdmycrown.in.
What we collect
When you buy a floor or an audit
- Your email address, so we can send the receipt, the report and anything about your order.
- For a floor: your startup’s name, website, logo, tagline and category. These are public, because they’re the advertisement.
- For an audit: the website and the note you write us, and the results of the checks. The report is private to whoever has its link.
- Card and bank details go straight to Dodo Payments. We never see them. Dodo tells us whether a payment went through, the amount and the currency.
When you sign in
- Your name, email address and profile picture from X, GitHub or Google, whichever you choose.
- A sign-in cookie that keeps you signed in for up to 30 days, with the IP address and browser it was created from, to spot stolen sessions.
- What you post, comment, vote and review. Posts, comments and reviews are public, with your name and handle.
When you visit
- When you click through to a startup, we count it: one more click for that floor in that hour. We don’t store who clicked. Your IP address is held in memory for 10 minutes so a repeat click isn’t counted twice, then it’s gone.
- Our hosting provider keeps standard server logs, such as IP addresses and pages requested, for security.
Cookies
The only cookie we set is the sign-in cookie, and only when you sign in. There are no advertising or tracking cookies, so there’s no cookie banner. If we add visitor analytics later, it will be a privacy-friendly kind without cookies, and we’ll list it here.
Who we share it with
- Dodo Payments, which processes payments as the merchant of record and keeps its own records under its privacy policy.
- X, GitHub and Google, only if you sign in with them. They tell us who you are; we don’t post anything for you.
- Google also receives the address of a website we audit (PageSpeed Insights) and the domains of listed startups, to fetch their logos. That’s the site’s address, not anything about you.
- Our hosting and database providers, which store the data for us and may not use it for anything else.
- Authorities, if the law requires it.
We don’t sell or rent personal data, and we don’t use it for advertising.
How long we keep it
- Your account and what you’ve posted: until you ask us to delete it.
- Orders and payment records: as long as Indian tax law requires us to keep them.
- Audit reports: until you ask us to delete them.
- Sign-in sessions: 30 days at most.
Your rights
You can ask to see the personal data we hold about you, to correct it, or to delete it. Email hello@holdmycrown.in from the address you used, and we’ll reply within 30 days. This applies to everyone, including your rights under India’s Digital Personal Data Protection Act and, if you’re in Europe or the UK, the GDPR. Deleting your account removes your profile; if you also want your posts and reviews gone, say so.
holdmycrown is for people aged 18 and over.
Changes
If we change how we use your data, we’ll update this page and the date at the top.