Privacy Policy

brkpod (“we,” “us,” “our,” or “brkpod”) operates the website and service located at brkpod.com (the “Service”), which lets users submit YouTube podcast links, generate transcripts, and create personalized, intent-based notes. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

This Policy is drafted to comply with the Digital Personal Data Protection Act, 2023 (“DPDPA 2023”), the Information Technology Act, 2000 (“IT Act 2000”), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (“SPDI Rules 2011”). By using brkpod, you agree to the collection and use of information as described in this Policy.

Under the DPDPA 2023, brkpod acts as the “Data Fiduciary” for personal data processed through the Service.

• Data Fiduciary: brkpod
• Grievance Officer: Uligera Sai Karthik
• Email: hello@brkpod.com

Any grievance, question, or complaint about how your personal data is handled may be raised with the Grievance Officer at the email address above. We acknowledge every grievance within 48 hours of receipt and aim to resolve it within 30 days.

We collect the following categories of personal data:

• Account information: name, email address, and profile picture, obtained via Google Sign-In.
• Authentication data: session and identity tokens, managed by AWS Cognito. We never see or store your Google password.
• Usage data: YouTube URLs you submit, notes you create, and timestamps of these actions.
• Technical data: IP address, browser type, device information, and pages visited, collected automatically to keep the Service secure and working correctly.
• Essential cookies: used strictly for authentication and session management. See Section 11 (Cookie Policy) below.

We do NOT collect: financial data (e.g. card or bank details), biometric data, health data, or your account password (Google and AWS Cognito handle authentication — brkpod never receives or stores it).

We process personal data only for the following purposes:

We do NOT use your data for: targeted advertising, behavioral tracking, profiling, selling to third parties, or automated decision-making that produces legal or similarly significant effects on you.

Wherever brkpod relies on your consent to process personal data, that consent is free, specific, informed, unconditional, and unambiguous, as required by the DPDPA 2023. Consent to create an account and process your identity is captured through the Google Sign-In flow at the point you connect your Google account. Consent to non-essential cookies is captured through the cookie banner shown on your first visit (see Section 11).

You may withdraw consent at any time by emailing hello@brkpod.com. Withdrawing consent is as easy as giving it. Once you withdraw consent, we stop processing your personal data for the relevant purpose within 7 days, and delete the associated personal data within 30 days, except where we are required to retain it to comply with a legal obligation.

• Your data is stored on Amazon Web Services (AWS) infrastructure in the Mumbai, India region (ap-south-1).
• Cloudflare is used as a content delivery network (CDN) and edge processing layer.
• Retention: account data is retained for as long as your account exists, plus 30 days after account deletion, to allow for recovery and to complete deletion processes across our systems.
• Session and authentication tokens expire automatically and are not retained beyond their validity period.
• Technical data (Section 3) is retained for up to 12 months, after which it is anonymized.

We share limited personal data with the following processors, solely to operate the Service:

We do NOT sell, rent, or trade your personal data to any third party for any purpose. Where personal data is transferred outside India (for example, to a processor’s servers abroad), such transfers comply with Section 16 of the DPDPA 2023.

As a Data Principal under the DPDPA 2023, you have the right to:

• Right to Access (Section 11) — obtain a summary of the personal data we hold about you and how it is processed.
• Right to Correction (Section 12) — request correction of inaccurate or misleading personal data.
• Right to Erasure (Section 12) — request deletion of personal data that is no longer necessary for the purpose it was collected.
• Right to Grievance Redressal (Section 13) — raise a grievance about how your data is processed and receive a response.
• Right to Nominate (Section 14) — nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, email hello@brkpod.com with the subject line “Data Principal Rights Request.” The Right to Erasure is also available as self-service: the Delete Account option in your Profile settings immediately and permanently deletes your account, your episodes, and your notes, without needing to email us first.

• All data in transit is encrypted using TLS 1.2 or higher.
• All data at rest is encrypted using AES-256.
• Access to systems and data is restricted using role-based access control (RBAC).
• brkpod never stores your password — authentication is delegated entirely to Google and AWS Cognito.
• Our infrastructure runs on AWS, which maintains ISO 27001 and SOC 2 certifications.

In the event of a personal data breach, brkpod will notify the Data Protection Board of India (DPB) within 72 hours of becoming aware of the breach, and will notify affected users without unreasonable delay, describing the nature of the breach and the steps being taken in response.

• Essential cookies (authentication session, CSRF protection, load balancing) are used to keep the Service secure and functional. These do not require consent, as they are strictly necessary to provide the Service you requested.
• Analytics cookies — used only with your consent, given through the cookie banner shown on your first visit.
• We do not use advertising, tracking, or marketing cookies of any kind.

Consent for non-essential cookies is captured through the cookie banner. You can withdraw that consent at any time via the “Cookie Settings” link in the site footer — withdrawing is exactly as easy as giving consent.

brkpod is not intended for, and is not directed at, individuals under the age of 18. We do not knowingly collect personal data from children. If we discover that we have collected personal data from a child without appropriate consent, we will delete it within 72 hours of discovery.

Per Section 15 of the DPDPA 2023, as a Data Principal you agree to:

• Provide only accurate and complete personal data when using the Service.
• Not impersonate any other person while using brkpod.
• Not register any false or frivolous grievance or complaint with brkpod or the Data Protection Board of India.

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page will reflect the date of the most recent revision. For material changes — changes that meaningfully affect how your personal data is processed — we will notify you by email before the change takes effect.

This Privacy Policy is governed by the laws of India. Any disputes arising from or relating to this Policy are subject to the exclusive jurisdiction of the courts of Hyderabad, Telangana, India.

For any questions about this Privacy Policy or how your personal data is handled, contact:

• Grievance Officer: Uligera Sai Karthik
• Email: hello@brkpod.com