LawBriefly Privacy Policy

Welcome to LawBriefly("we," "our," or "us"). LawBriefly is an educational and legal-technology mobile application and web ecosystem designed primarily for law students, legal scholars, advocates, judicial service aspirants, and citizens seeking clear, structured access to legislative acts and legal knowledge in the Republic of India.

We respect the privacy of our users ("Data Principals") and are committed to protecting personal data through transparent, lawful, and secure data processing practices. This Privacy Policy explains what personal data we collect, why we collect it, how it is processed and protected, the third-party software development kits (SDKs) embedded in our application, and your statutory rights to access, rectify, and erase your personal data.

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000, the Data Fiduciary operating LawBriefly is:

• Operator / Developer: LawBriefly Development Team
• Application Identifier: com.adityabhise.lawbriefly
• Jurisdiction: Republic of India
• Privacy & Grievance Contact: privacy@lawbriefly.com
• General Support Contact: support@lawbriefly.com

Note: If corporate registration details or designated entity particulars are updated, this section is promptly updated with formal corporate registry metadata.

This Privacy Policy applies to all personal data collected or processed through:

• The LawBriefly Android mobile application (distributed through Google Play Store).
• The official LawBriefly compliance and service web portal (hosted via Next.js App Router).
• Our backend synchronization APIs, notification dispatch systems, and external account deletion endpoints.

This policy does not govern external third-party websites or services linked from our platform (such as third-party news publication sources indexed via NewsData.io). Users are encouraged to review the privacy notices of external publishers before interacting with external links.

In accordance with the principle of data minimization (processing only personal data necessary for specified purposes), we classify the personal data collected into the following distinct categories:

To maintain study progress across devices, LawBriefly enables users to create a personalized account using:

• Email & Password: Authenticated directly through Supabase Auth. Passwords are cryptographically salted and hashed using modern key derivation functions (bcrypt). We never view or store plaintext passwords.
• Google OAuth: If you elect to authenticate using your Google Account, we receive your email address, verified email status, display name, and avatar image URL via standard OAuth 2.0 scopes. We do not access your Google contacts, Google Drive files, or other private Google services.

Local session authorization tokens (JWT access and refresh tokens) are securely cached on your device using encrypted storage mechanisms (Expo SecureStore / MMKV).

Your user profile in LawBriefly stores:

• Display Name: Sourced from your Google profile or entered during registration (defaults to "Legal Professional" if absent).
• Avatar URL: Image URL pointing to your display avatar to render your personal header icon.
• User UUID: An internal non-public unique identifier generated by Supabase (`auth.users.id`) used to associate notes and bookmarks with your specific account.

LawBriefly empowers users to interact actively with legal texts by writing personal notes, highlighting statutory sections, and participating in mock examinations. All user-authored content remains strictly personal to your account. We do not publish, sell, or commercially broker your private notes or examination answers.

When you compose a note on a legal section (such as an annotation on Bharatiya Nyaya Sanhita or the Indian Evidence Act):

• The note text, associated Act ID, Section ID, and timestamp are saved in local SQLite storage on your device (`local_notes` and `local_bookmarks`).
• When network connectivity is active, the app synchronizes these entries with our cloud database (`public.notes` and `public.bookmarks` in Supabase PostgreSQL) protected by Row-Level Security (RLS) policies.
• You may delete any individual note or bookmark at any time via the in-app interface, which removes it from both local device storage and the cloud database.

To enable the "Continue Reading" shelf on your home dashboard, LawBriefly records the last statutory sections opened. This metadata is stored primarily within your local SQLite database snapshot (`lawyer_legal_snapshot.db`). It is used exclusively to restore your reading position and provide a seamless offline reading experience.

LawBriefly provides timed mock examination modules for legal candidates. When you participate in an examination:

• Session Record: Exam ID, attempt start time, scheduled expiry timestamp, submission time, and completion status are recorded in `public.attempts`.
• Candidate Responses: Your selected answers to individual multiple-choice questions are stored in `public.attempt_questions`.
• Automated Expiry: A secure scheduled GitHub Actions backend routine checks for overdue exam attempts and finalizes them to preserve academic grading integrity.

LawBriefly uses Firebase Cloud Messaging (FCM) provided by Google to deliver timely notifications regarding breaking legal news, legislative amendments, and exam reminders.

• FCM Device Token: Upon granting push notification permission on Android, an anonymous device registration token is generated and stored in our database (`public.notification_devices`).
• Topic Preferences: You can independently toggle notification alerts for specific legal categories ("Supreme Court," "High Court," "Parliament," "Government," "Acts," "Legal News") within the profile screen.
• Token Deletion on Sign Out: When you sign out from your account, the app automatically deletes your registered FCM token from `notification_devices` to prevent unauthenticated notification receipt.

In accordance with Google Play Developer Program Policies, we explicitly disclose the following regarding the embedded Google Mobile Ads SDK:

• Ad Formats & Placements:
  • Medium Rectangle Banner (`BannerAdSize.MEDIUM_RECTANGLE`) embedded on the News Updates screen (`App/lawyer-app/app/(tabs)/news.tsx`).
  • Anchored Adaptive Banner (`BannerAdSize.ANCHORED_ADAPTIVE_BANNER`) embedded within legal node reading views (`App/lawyer-app/app/acts/[act]/node/[nodeId]/index.tsx`).
• Data Collected Automatically by Google AdMob:
  • Device & Advertising Identifiers: Google Advertising ID (AAID on Android), Android ID, and vendor-specific identifiers.
  • IP Address & Approximate Location: Used by Google to determine coarse geographical region (country and city) for ad serving and anti-fraud verification.
  • App Performance & Diagnostics: Ad load latency, crash logs, diagnostic telemetry, and device model/OS specifications.
  • Ad Interaction Telemetry: Records of ad impressions, clicks, and viewability metrics.
• Data Sharing Disclosure: This data is collected directly by Google LLC and its authorized programmatic advertising partners. LawBriefly itself does not store your Google Advertising ID on its private database.
• Advertising ID Reset and Opt-Out: You have full control over interest-based advertising. You may reset your Advertising ID or opt out of personalized advertisements at any time in Android system settings: Settings > Google > Ads > Reset advertising ID or Delete advertising ID.

The LawBriefly compliance and administrative website (`Server/`) does not deploy invasive third-party tracking cookies or marketing pixels. Essential HTTP-only session cookies and authorization headers are used solely to verify administrative access and authenticate account deletion requests.

We collect and process personal data exclusively for the following specified, lawful purposes:

1. To provide, administer, and maintain the LawBriefly educational platform and bare acts reading engine.
2. To authenticate user sessions, maintain account security, and safeguard against unauthorized access.
3. To synchronize user notes, bookmarks, reading progress, and exam scores across user sessions.
4. To dispatch push notifications on legal news and updates according to user-selected preferences.
5. To display non-intrusive banner advertisements supporting free educational accessibility.
6. To comply with statutory legal obligations under Indian law and enforce our Terms of Service.
7. To process and fulfill statutory account deletion and data erasure requests.

Under the Digital Personal Data Protection Act, 2023 (Section 4, 5, and 6), our processing of personal data is grounded on:

• Consent: Freely given, specific, informed, unconditional, and unambiguous consent provided by the Data Principal when creating an account, entering personal notes, or enabling push notifications.
• Certain Legitimate Uses: Processing required for compliance with statutory laws, court orders, or preventing fraud and security vulnerabilities as permitted under Section 7 of the DPDP Act.

We engage reputable cloud infrastructure service providers ("Data Processors") who adhere to strict confidentiality and security standards:

• Supabase Inc. (Database & Authentication): Hosts our encrypted cloud PostgreSQL database, user authentication directory, and Row-Level Security infrastructure. (Privacy Policy: supabase.com/privacy).
• Google LLC (Firebase Cloud Messaging & Google Identity): Handles push notification routing and Google OAuth sign-in. (Privacy Policy: policies.google.com/privacy).
• Google LLC (AdMob): Programmatic advertising engine serving in-app banner ads. (AdMob Policies: support.google.com/admob).
• NewsData.io: External content syndication REST API used by our automated backend to aggregate publicly published Indian legal news headlines.

We do not sell, rent, lease, or trade your personal data to third-party data brokers, marketers, or unauthorized commercial entities. Personal data is only shared in the following strictly limited situations:

• With Service Providers: As detailed in Section 16, strictly for operating cloud hosting, authentication, and notification delivery under binding contracts.
• With Advertising Networks: Automatically generated telemetry and advertising IDs collected directly by Google AdMob as detailed in Section 12.
• Compliance with Legal Process: If required to do so by applicable Indian law, court order, decree, or lawful governmental directive issued by a competent legal authority.

Our cloud data repositories and PostgreSQL database instances are hosted with Supabase on secure cloud infrastructure. Statutory bare acts and offline legal libraries are pre-compiled and stored locally on your device in SQLite format, ensuring that legal study materials remain fully accessible offline without transmitting continuous telemetry.

In compliance with Section 8(5) of the DPDP Act, 2023 and the Information Technology (Reasonable Security Practices) Rules, 2011, we implement robust technical safeguards:

• Encryption in Transit: All communications between the mobile application, web portal, and cloud servers are encrypted using modern Transport Layer Security (TLS 1.2 / TLS 1.3).
• Encryption at Rest: Database volumes and cloud data backups are protected by industry-standard AES-256 encryption.
• Database Access Controls: PostgreSQL Row-Level Security (RLS) policies enforce strict user isolation, ensuring users can only read, write, or delete their own notes and bookmarks.
• Credential Isolation: High-privilege database service-role secrets and private keys are never shipped in the client mobile bundle.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Account Data: User profile, notes, bookmarks, exam attempts, and preferences are retained for the active lifetime of your account.
• Account Deletion: Upon receiving an account deletion request, user-associated database records are permanently deleted within thirty (30) days.
• Server Error & Security Logs: Transient operational logs and IP connection logs are automatically purged or rotated every ninety (90) days.
• Public Non-Personal Content: Bare acts, legislative amendments, and aggregated public legal news are retained permanently as public legal references.

You may initiate account deletion through either of the following pathways:

1. In-App Deletion Guidance: Open the mobile app, navigate to Profile > Settings > Delete Account to open the deletion request pathway.
2. Manual Email Request: Send an email from your registered account email to lawbrieflyofficial@gmail.com with the subject Account Deletion Request.
3. Dedicated Web Deletion Portal: You can review the complete step-by-step instructions, generate a pre-formatted email deletion request, or copy our official deletion email directly at our web deletion page: https://lawbriefly.com/delete-account.

Our team manually reviews deletion requests and aims to process them within seven (7) working days. Upon successful verification of account ownership, your authentication record (`auth.users`), profile, user notes, bookmarks, exam attempts, and notification device tokens are completely and permanently erased.

Under Chapter III of the Digital Personal Data Protection Act, 2023, Data Principals possess the following statutory rights:

• Right to Access Information (Section 11): Right to obtain a summary of personal data being processed and identities of Data Processors.
• Right to Correction and Erasure (Section 12): Right to correct misleading or inaccurate data and erase data that is no longer necessary.
• Right of Grievance Redressal (Section 13): Right to have grievances redressed by the Data Fiduciary within thirty (30) days.
• Right to Nominate (Section 14): Right to nominate another individual to exercise rights in the event of death or incapacity.

To exercise any of these rights, email our designated Grievance Officer at privacy@lawbriefly.com or submit a request on our Support Page.

LawBriefly is an educational platform intended for law students, legal practitioners, and adults aged 18 and older. We do not knowingly collect, solicit, or target personal data from children under the age of 18 without verifiable parental consent, in strict compliance with Section 9 of the DPDP Act, 2023. We do not track or profile children or serve targeted behavioral advertisements directed at minors.

LawBriefly is primarily operated from India. Where cloud infrastructure processors (such as Supabase or Google Cloud) process data internationally, transfers are executed in full conformity with Section 16 of the DPDP Act, 2023 and applicable governmental guidelines, ensuring adequate standards of data protection.

We may update this Privacy Policy periodically to reflect evolving legal interpretations, statutory rule notifications, or changes in application features. When modifications occur, we will update the "Effective Date" at the top of this document and notify active users through an in-app notice or push notification where appropriate.

LawBriefly provides legal study, reference, and mock examination material solely for informational and educational purposes. Using the application or reading content on this website does not create an advocate-client relationship under the Advocates Act, 1961. For specific legal counsel or litigation matters, consult a licensed advocate. (See our full Legal Disclaimer).

For any questions regarding this Privacy Policy, your personal data, or to lodge a formal grievance under Indian data protection law, please contact:

This Privacy Policy is formulated in adherence to Section 43A of the Information Technology Act, 2000; the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011; Rule 3 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021; the Digital Personal Data Protection Act, 2023; and the Google Play Developer Distribution Agreement and User Data Policies.