Privacy Policy
Last Meaningful Update: October 17, 2026 · Market: India
Formal registered company name and physical corporate premises are currently pending final owner input on our launch checklist. Communications and data requests are monitored via our verified customer WhatsApp (+91 7023987458).
1. Overview & Core Philosophy
CUMID ("we", "our", "us") operates the website https://cumid.store. We build pocket diaries and stationery. We do not sell personal data, do not run behavioural advertising trackers, and do not log your keystrokes or browsing across external websites.
This policy outlines how data is handled across our website, optional customer accounts, and our WhatsApp preorder channel in alignment with applicable Indian laws, including the Digital Personal Data Protection (DPDP) framework as its provisions phase into force.
2. Information We Collect and How
A. Browsing & Local Storage (Guests)
You can browse our entire catalog without an account. When you save favourite covers, they are stored locally on your device in your browser's localStorage under cumid_guest_favourites_v1. These guest favourites remain on this device unless you sign in and explicitly import them into your account. Signed-in favourites are kept separately.
B. Optional Customer Accounts (Google OAuth via Supabase)
If you choose to sign in with Google, authentication is handled via Supabase Auth with PKCE security. We receive only basic profile information (your email address, display name, and avatar URL). We do NOT request access to your Google Drive, Gmail, or phone contacts.
C. Preorder Enquiries via WhatsApp
When you click "Enquire about preorder on WhatsApp", a draft opens. Only if you choose to send it do you send a message to our business WhatsApp number (+91 7023987458). We receive your WhatsApp display name, phone number, and whatever message text you send. We do not pretend that no data is collected simply because communication occurs on WhatsApp; we treat this communication with strict confidentiality for the purpose of answering your product queries.
D. Technical Hosting Logs
Our hosting partner (Cloudflare Pages) maintains standard transient access logs (IP addresses, user-agent, request timestamps) to protect the site from distributed denial-of-service (DDoS) attacks and ensure uptime.
3. Optional Analytics & Cookies
We operate two distinct analytics tiers:
- Cloudflare Web Analytics: Cookieless, aggregate metrics to monitor page load performance and aggregate visitor counts. No personal identifiers or cross-site tracking.
- Google Analytics 4 (GA4): Strictly consent-gated. GA4 scripts and cookies are NOT loaded until you affirmatively click "Accept analytics". We do not send names, emails, phone numbers or WhatsApp message text in analytics events. Google Signals and advertising personalisation are disabled. Google processes technical connection information when its service is enabled.
You can accept, reject, or change your choice at any time using the "Cookie & Privacy Preferences" link in our footer. Essential website functions remain 100% available if you reject analytics.
4. Service Providers & Cross-Border Transfers
To deliver a secure, fast experience, we partner with reliable infrastructure providers:
| Provider | Purpose | Data Handled |
|---|---|---|
| Cloudflare, Inc. | Global CDN, DNS & Hosting | IP address, request headers, caching |
| Supabase, Inc. | Authentication & Favourites Database | User ID, email, saved cover IDs |
| WhatsApp (Meta) | Customer Communication Channel | Phone number, message transcripts |
| Google LLC | OAuth Sign-in & Optional GA4 | Sign-in information; consent-based events and browser identifiers |
5. Data Retention & Self-Service Deletion
- Guest Favourites: Stored on your device until you clear your browser data.
- Account Data: Retained until you delete your account. You can permanently delete your account and all associated cloud favourites directly from Account Settings.
- WhatsApp Messages: The retention schedule for conversations must be confirmed before public launch. You can request deletion through the contact below; deleting a website account does not delete WhatsApp conversations.
6. Children's Privacy
Our website is not targeted at children under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account without parental consent, please contact us for immediate deletion.
7. Your Rights & Privacy Requests
Under Indian privacy principles, you have the right to access, rectify, or request deletion of your personal data, as well as withdraw consent for optional analytics at any time.
To exercise any privacy rights or request manual deletion of records, message our designated privacy contact on WhatsApp at +91 7023987458 with the subject "Privacy Data Request".