[ statutory privacy & data governance ]last updated: 20 october 2026 • policies effective immediately upon publication (7-day cure window for prior non-compliant content)

privacy policy and data controls

this document explains how spillit collects, processes, stores, protects, and deletes personal data, alongside the practical data controls and rights available to all users.

statutory document

privacy policy

website: spillit.online • entity: spillit anonymous campus network • last updated: 20 october 2026 • privacy desk: support@xenodochy.com

[ support & reporting timeline notice: at least 7 days ]

please note: for any kind of support inquiry, data request, privacy concern, violation report, or email sent anywhere to us (including support@xenodochy.com), our team will take at least 7 days to review, investigate, and process.

[ intermediary safe harbour • section 79 it act ]

1. introduction & statutory safe harbour

spillit ("spillit", "we", "us" or "our") is an online community that enables users to share posts, participate in discussions and interact with other members through pseudonymous accounts.

spillit operates strictly as an intermediary under section 2(1)(w) and section 79 of the information technology act, 2000 and rule 3 of the intermediary guidelines rules, 2021. the website owner, operator, administrators and founders provide a passive transmission conduit and assume zero personal, direct, or vicarious liability for personal data inadvertently or maliciously published by third-party users in public submissions.

all provisions of this policy take effect immediately upon publication. in the event of policy revisions or updates, previous submissions or user conduct are granted a 7-day cure window to rectify themselves before administrative penalties apply, excluding severe safety violations (e.g. non-consensual sexual content, doxxing, or threats of violence) which are acted upon instantaneously.

we recognise the importance of privacy, personal data protection and user autonomy. this privacy policy explains how we collect, use, store, disclose and protect personal data when individuals access or use spillit.online and its associated services.

this privacy policy also explains the choices available to users regarding their personal data, including applicable rights to access, correction, updating, erasure and withdrawal of consent.

spillit is designed to allow users to participate without publicly displaying their real-world identities. however, pseudonymous participation does not necessarily mean that all information relating to a user is anonymous or that the user cannot be identified under any circumstances.

we process personal data in accordance with applicable laws and regulations, including the indian data protection and information technology laws applicable to our operations.

2. scope of this policy

this privacy policy applies to individuals who visit, register for, or otherwise use spillit, including users who publish posts, submit comments, participate in discussions, report content or contact us.

it applies to personal data processed through our website and associated services. where a separate privacy notice applies to a particular feature or service, that notice shall be read together with this privacy policy.

3. information we collect

depending on the features used and the manner in which the website operates, spillit may collect the following categories of information:

3.1 account information

when a user registers for an account, we may collect:

a. username or display name;
b. authentication information necessary to create and secure the account;
c. email address, where voluntarily provided for account recovery or another disclosed purpose;
d. country and college affiliation, where requested during registration or onboarding; and
e. other information voluntarily provided through account settings.

passwords shall be handled using appropriate security practices. they should not be stored in plaintext. users should not include passwords or other authentication secrets in public posts, comments or communications.

3.2 user-generated content

we may process content that users submit through spillit, including:

a. posts and comments;
b. replies and other interactions;
c. votes, reactions and saved content, where these features are available;
d. reports concerning posts, comments or accounts; and
e. information voluntarily included in communications with spillit.

users are responsible for considering whether their submissions contain personal information about themselves or other individuals. spillit does not require users to disclose sensitive personal experiences publicly. users should avoid including information that could unnecessarily expose their identities or compromise another person's privacy.

3.3 technical and security information

when users access spillit, certain technical information may be collected or generated, depending on our hosting infrastructure, security configuration and analytics tools:

a. ip addresses;
b. browser and device information;
c. access timestamps and server logs;
d. authentication events and session information;
e. security and abuse-prevention signals; and
f. information necessary to diagnose errors, prevent unauthorised access and maintain website availability.

we shall seek to limit the collection and retention of such information to legitimate, disclosed purposes and applicable legal requirements.

3.4 communications and reports

if a user contacts spillit, submits a complaint or reports content, we may process the information included in the submission and information reasonably necessary to investigate and respond. access to reports and associated information shall be restricted to authorised persons who require it for moderation, security, complaint handling or other legitimate purposes.

3.5 cookies and similar technologies

spillit and its service providers may use cookies or similar technologies to support authentication, maintain sessions, protect against abuse, remember preferences, analyse website performance or provide advertising services. where required by applicable law, appropriate notice and consent mechanisms shall be implemented before the relevant technologies are used. users may manage cookies through browser settings. disabling essential cookies may affect some features.

4. purposes of processing

spillit may process personal data for the following purposes:

a. creating, authenticating and maintaining user accounts;
b. providing access to college and global forums;
c. displaying posts, comments and other content according to website functionality;
d. enabling users to interact with discussions and manage their content;
e. reviewing reports and enforcing the community guidelines;
f. detecting spam, fraudulent activity, impersonation, harassment and other forms of abuse;
g. maintaining website security, reliability and performance;
h. responding to user enquiries, complaints and requests;
i. managing account recovery and account deletion;
j. meeting applicable legal and regulatory obligations;
k. administering advertising, where implemented in accordance with applicable requirements; and
l. other purposes disclosed to users and supported by an appropriate legal basis.

personal data shall not be processed for purposes materially different from those disclosed to users unless an appropriate legal basis exists and any required notice or consent has been obtained.

[ pseudonymous architecture ]

5. pseudonymity and public visibility

spillit is designed to permit participation through usernames rather than requiring users to display their real-world names publicly. subject to the features enabled on the website:

a. a user's username and published content may be visible to other users;
b. posts and comments may be publicly accessible to visitors, including individuals who do not have an account;
c. college affiliation or other profile information may be visible if the relevant feature displays it;
d. email addresses, passwords and other private account credentials shall not be intentionally displayed publicly; and
e. information submitted in reports or private communications shall not be made public merely because it was provided to spillit.

anonymity boundaries warning:

users should understand that information disclosed within a post may identify them indirectly (such as specific dates, locations, or distinctive details). spillit does not guarantee complete or absolute anonymity. technical information may be processed for legitimate operational, security and legal purposes. information may also need to be disclosed where required or authorised by applicable law.

6. disclosure and sharing of personal data

spillit does not intend to sell users' personal data as a commercial product. personal data may be disclosed, where necessary and appropriate, to the following categories of recipients:

6.1 service providers

third-party providers supporting hosting, databases, authentication, website security, analytics, communications, and backups, under strict contractual instructions.

6.2 advertising providers

if advertising is introduced, relevant tracking practices shall be disclosed and any required user consent or preference controls will be implemented beforehand.

6.3 moderation and security

authorised moderators and staff investigating reports, enforcing platform rules, protecting user safety, or maintaining security, restricted by role.

6.4 legal and regulatory disclosures

where required by applicable law, valid court orders, or competent authority directives, limited strictly to the information necessary to satisfy the requirement.

6.5 business transfers

in the event of a merger, acquisition, restructuring, or transfer of operations, personal data may be transferred where legally permissible and subject to appropriate safeguards.

7. retention of personal data

spillit shall retain personal data only for as long as reasonably necessary for the purposes for which it is processed, subject to legal requirements and security needs:

a. account information is retained while an account remains active and for an appropriate period thereafter;
b. public posts and comments may remain available until deleted or removed in accordance with platform policies;
c. security logs are retained for a defined period necessary for abuse prevention and compliance;
d. reports and moderation records are retained to investigate incidents, handle appeals, and meet obligations; and
e. backup copies remain temporarily until overwritten in accordance with backup-retention routines.

where information is no longer required, it shall be deleted or irreversibly anonymised, unless continued retention is permitted or required by applicable law.

[ statutory rights ]

8. user rights and data requests

subject to applicable law (including digital personal data protection frameworks), users may have the right to:

a. request access to information concerning their personal data;
b. request correction or updating of inaccurate or incomplete personal data;
c. request erasure of personal data where applicable conditions are satisfied;
d. withdraw consent where processing is based on consent;
e. raise grievances concerning the processing of their personal data; and
f. exercise any additional rights available under applicable law.

users may exercise these rights through account settings or by emailing support@xenodochy.com. identity verification will be proportionate to the request. any privacy request, data correction, or support inquiry will take at least 7 days to review and process, subject to applicable statutory requirements.

9. account and content deletion

users may request deletion of their accounts through account settings, where available, or by contacting spillit through the designated privacy channel.

where technically supported and consistent with applicable retention requirements, spillit shall remove or de-identify personal data associated with a deleted account. certain information may be retained where necessary or legally permitted for security, fraud prevention, dispute resolution, or compliance.

users should not assume that removing content from public view immediately eliminates every copy from backups or security records.

10. withdrawal of consent

where spillit relies on a user's consent to process personal data, the user may withdraw that consent at any time through settings or by contacting support@xenodochy.com (requests take at least 7 days to process).

withdrawal of consent shall not affect the lawfulness of processing carried out prior to withdrawal. following withdrawal, spillit shall cease relevant processing unless continued processing is legally permitted or required.

11. security measures & limitation of technical liability

spillit implements commercially reasonable technical and organisational security measures appropriate to the data processed:

a. secure authentication and cryptographic password hashing;
b. role-based access controls and restrictions on administrative privileges;
c. encryption in transit (https/tls) and encryption at rest;
d. automated rate-limiting and anomaly detection for abuse prevention;
e. security patching and regular vulnerability assessments;
f. restricted access to reports and moderation logs;
g. resilient backup and disaster recovery protocols; and
h. established procedures for investigating and addressing potential security incidents.

notwithstanding the foregoing, transmission over the public internet and digital storage cannot be guaranteed to be completely impenetrable. to the maximum extent permitted under section 43a and section 79 of the information technology act, 2000, the website owner, operator and administrators bear zero liability for unauthorized intercepts, third-party malicious intrusions, zero-day vulnerabilities, or external data scraping beyond reasonable technical safeguards.

12. personal data breaches

in the event of a confirmed personal data breach, spillit shall promptly assess the incident, contain vulnerabilities, and mitigate impact.

where required by applicable law, spillit shall notify affected individuals and relevant supervisory authorities (including cert-in and data protection boards) within prescribed statutory timeframes with nature, likely consequences, and remediation guidance.

13. children's privacy

spillit establishes a minimum registration age policy aligned with college enrollment and applicable indian data protection rules. we do not knowingly process personal data of minors without appropriate parental or legal compliance where mandated.

if you believe an ineligible minor has provided personal data, contact us at support@xenodochy.com for review and deletion (review takes at least 7 days).

14. third-party services and external links

spillit may contain links to external websites, crisis helplines, or partner resources. spillit does not control third-party privacy practices; users should review respective policies before submitting personal data to external domains. the website owner and operator assume zero responsibility or liability for third-party practices.

15. changes to this privacy policy

spillit may update this privacy policy at any time to reflect advancements in technology, platform functionalities, regulatory guidelines, or judicial orders. all updates and revised terms become effective immediately upon being published on spillit.online with the notation 'last updated: 20 october 2026' (or subsequent timestamp).

where a policy amendment introduces newly restricted data disclosures affecting previously submitted user content, users are granted a 7-day cure window from the revision publication date to review, rectify, or permanently delete prior non-compliant disclosures. acute violations—such as non-consensual sexual content, doxxing of private addresses or telephone numbers, and extortionate material—are strictly excluded from the cure window and will be removed immediately without delay.

[ statutory contact desk ]

16. contact and grievances

questions, complaints, or requests concerning personal data and privacy controls may be submitted through:

privacy contact: support@xenodochy.com

responsible entity: spillit anonymous campus network

statutory grievance desk: support@xenodochy.com

general support: support@xenodochy.com

registered address: spillit legal operations desk, india

support & grievance timeline: any email, support inquiry, data request, or report sent to support@xenodochy.com will take at least 7 days to review and process.

spillit shall review all privacy-related requests, support inquiries, and grievances in accordance with statutory procedures, taking at least 7 days for initial evaluation and investigation.

17. applicable law & website owner indemnity

this privacy policy shall be interpreted and governed exclusively in accordance with the laws of india.

you agree to defend, indemnify, and hold harmless the website owner, operator, founders, and administrators against any and all claims, regulatory penalties, damages, liabilities, costs, and advocate fees arising from personal data or confidential material submitted by you to the platform in violation of applicable laws or third-party rights.

practical controls

data controls for users

website: spillit.online • last updated: 20 october 2026 • tools and rights to manage your account, personal data, and public presence

[ data requests & support timeline notice: at least 7 days ]

all account deletion requests, data inquiries, violation reports, and emails sent anywhere to us will take at least 7 days to review and process.

the following controls give users practical authority over their accounts and personal information:

[ 1 ] account information

users can review and manage their account details, including username, optional recovery email, and college affiliation. changes may be subject to reasonable security verification.

[ 2 ] posts and comments

there is no individual delete option for published spills or replies. what you write will stay forever. if an account is deleted, published content is preserved on the feeds with the author handle anonymised to "deleted user".

[ 3 ] account deletion

users may request permanent deletion of their user accounts and authentication credentials. upon deletion, the user account is purged, while previously submitted public spills and comments remain on the platform with the author username replaced by "deleted user".

[ 4 ] privacy requests

submit statutory requests regarding data access, correction, updating, or erasure directly to support@xenodochy.com (all privacy and data requests take at least 7 days to process).

[ 5 ] reporting privacy violations

report any spill or comment exposing personal information, doxxing individuals, or impersonating others to support@xenodochy.com for review. all violation reports and emails take at least 7 days to review and process.

[ 6 ] security & account access

keep authentication credentials confidential. if you suspect unauthorized access or compromised security, contact us at support@xenodochy.com. support requests take at least 7 days to review and process.