This page explains what personal data Slate collects, why we collect it, how we look after it, and what control you have over it. It applies to slatexd.eu.org and the Slate app. The honest summary is that we try to collect as little as we possibly can.
Slate is run by XD Group, one person based in India. Under data-protection law that makes us the "controller", or the "data fiduciary" under India's DPDP Act. For any privacy question, request, or complaint, write to xd.adarsh.xd@gmail.com. That same address is our grievance contact under the DPDP Act.
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, password (stored hashed by our login provider), username, display name | To create your account, keep it secure, and let you sign in |
| Profile data | Avatar image, avatar colour, and your app settings | To set Slate up the way you like it |
| Google sign-in data | If you choose Google sign-in, your email and basic profile from Google | To sign you in without a separate password |
| Your content | Canvases, folders, notes, to-dos, links, and other things you create or upload | To save your work and sync it across sessions and devices |
| Consent records | The date and time you accept these terms, and which version you accepted | To keep a record of your consent, as required under India's DPDP Act |
| Notification data | If you turn on timer notifications, your browser's push subscription and the time and title of the timer you set | To send you the "time's up" alert even when the app is closed, then this is deleted once sent |
| Technical data | The bare minimum needed to serve the site, such as an IP address handled briefly by our hosting and login providers for security and delivery | Security, abuse prevention, and getting the site to you reliably |
We do not go looking for sensitive or special-category data, and we ask that you do not store that kind of data in Slate. Some things you add, such as images, can be saved only on your own device through your browser, and never reach us at all.
We use your data to run Slate and save what you make, to sign you in and keep your account secure, to catch and stop fraud, abuse, and security problems (including rate-limiting), to answer your questions and help you out, and to meet our legal obligations. We do not sell or rent your personal data, we do not use it for advertising, and we do not take part in cross-context behavioural advertising.
If you are in the EEA or the UK, here is the legal basis for what we do. We process your data to provide the service you asked for, which is performance of a contract. We process it to keep Slate secure and to make it better, which is our legitimate interest, weighed against your rights. We process it with your consent where consent is what the law calls for, and you can take that consent back at any time. And we process it where the law requires us to.
Slate only uses the browser storage it genuinely needs to work, mostly to keep you logged in and to remember your settings and, for guests, your local work. In practice that means localStorage and sessionStorage for your session, settings, and login-throttle counters, IndexedDB for media you add (kept on your own device), and login tokens set by our auth provider Supabase to keep you signed in.
We do not use advertising cookies, third-party analytics, tracking pixels, or session recording. Because this is all strictly necessary storage, we generally do not need a consent banner. You can still clear this storage any time from your browser settings, though doing that will sign you out and may remove guest work saved on your device.
We only share data with the providers that help us run Slate, and only under proper safeguards.
| Provider | What for | More info |
|---|---|---|
| Supabase | Login, database, and file storage for your account and content | supabase.com/privacy |
| Cloudflare | Hosting, content delivery, and security for the site | cloudflare.com/privacypolicy |
| Optional Google sign-in, Google Fonts, and optional map embeds | policies.google.com/privacy |
We might also share data if the law requires it, to protect people's safety and rights, or as part of a future sale or transfer of the project, with notice where that is required.
We work from India, and our providers may handle data in other countries, including the United States and the EU. When data crosses borders, we rely on the protections those providers put in place, such as standard contractual clauses, along with whatever the law requires.
We hold on to your account and content for as long as your account is open. When you delete something, delete your account, or ask us to erase your data, we remove it from our live systems and from backups within a reasonable time. The one exception is anything we have to keep to follow the law, settle a dispute, or enforce our agreements. Guest data only lives on your device until you clear it.
Everything is served over HTTPS, so traffic between you and Slate is encrypted. Passwords are hashed by our login provider, which means we never see or store them in plain text. Database access is locked down with row-level rules, so you can only reach your own data. We rate-limit and protect the login system against abuse. And we run a Content Security Policy along with other hardening, and we clean user-generated HTML to cut down on cross-site-scripting risk.
No system is ever perfectly secure, so we cannot promise total safety. If a breach ever affects your rights, we will let you and the relevant authorities know, as the law requires.
What you can do depends on where you live. Here is the rundown.
To use any of these, email xd.adarsh.xd@gmail.com. You can also view, edit, and delete a lot of your data right inside the app, through profile settings and account deletion. We will check who you are and get back to you within the time the law allows.
Slate is meant for people aged 13 and over. If you are under 18, or under the age that counts as an adult where you live, you should only use Slate with a parent or guardian's consent and supervision. India's DPDP Act treats anyone under 18 as a child, so for them we rely on a parent or guardian's verifiable consent. We do not knowingly collect data from children without that consent. If you think a child has given us data they should not have, contact us and we will delete it.
We may update this policy now and then. When we do, we will change the "Last updated" date above, and for bigger changes we will give you extra notice where we reasonably can. Carrying on with Slate after a change means you accept the updated policy.
For privacy questions, requests, or complaints, email xd.adarsh.xd@gmail.com. We will acknowledge and deal with grievances in line with the law.
See also our Terms of Service.