Privacy policy.

Pookpit Hub Private Limited respects your privacy and is committed to protecting your personal data. This Privacy Policy outlines how we collect, process, store, use, share, and protect your personal data when you use the PookPit mobile application, services, and associated web domains (collectively, the "Platform").

By registering an account and explicitly checking the consent box during registration, you confirm that you have read, understood, and provided your free, specific, informed, unconditional, and unambiguous consent to the processing of your personal data in accordance with this Policy and the Digital Personal Data Protection (DPDP) Act, 2023.

To provide our campus-exclusive, peer-to-peer services, we collect various categories of personal data. We restrict data collection strictly to what is necessary for the specified purposes of the Platform (Data Minimization principle).

2.1 Information Provided Voluntarily by You

• Identity Data: Full legal name, gender, age, profile photograph, and university enrollment details.
• Institutional Academic Data: Official college/university email address domain (e.g., name@university.edu.in) and student identification numbers or digital ID cards.
• Contact Data: Verified mobile phone number and communication preferences.
• Financial Data: Bank account numbers, UPI IDs, and digital transaction history tied strictly to your internal POOKPIT Wallet.
• User-Generated Content (UGC): Items listed for borrow/sale, eatery details, feedback forms, chat text within peer groups, journal logs, and wellness tracking inputs.

2.2 Information Automatically Collected

• Geo-Location Data: Precise real-time geographical coordinates via GPS/network signals to verify your physical presence on campus and facilitate local peer handovers.
• Technical Log Data: IP address, device type, unique device identifiers, operating system version, and application performance metrics.

Under Section 6 of the DPDP Act, 2023, PookPit processes your personal data strictly on the basis of your explicit consent or for legitimate uses as permitted under the Act.

4.1 The “Peer Help” Conditional Anonymity Framework

• Frontend Masking: When you create or participate in specialized campus help threads or group chats, our Platform utilizes technological filters to hide your real identity, mobile number, and specific location from other users on the user interface.
• The “Deal Activation” Disclosure Rule: You acknowledge and agree that upon the exact mathematical moment a peer transaction or deal is accepted by both users, the Platform automatically revokes frontend masking. The system will instantly transmit your registered mobile number, real legal name, and designated location to the opposite participating peer to ensure physical safety, identity verification, and anti-fraud accountability during the physical handover.
• Immutable Backend Audit Trail: In compliance with the Bharatiya Nyaya Sanhita (BNS), 2023, absolute anonymity does not exist on our servers. PookPit continuously maintains completely unmasked, plaintext system logs of all anonymous group communications on its secure backend databases to satisfy statutory law enforcement tracing requirements.

4.2 The “Peer Mental Health Support” Confidentiality Protocol

• Enhanced Encryption Standards: All personal notes, internal insights, and tracking metrics generated within the mental well-being module are subjected to specialized access controls and logical partition separation on our cloud servers.
• Consent for Third-Party Specialist Escalation: If you choose to seek structured mental wellness solutions or professional interventions through the Platform, you provide your explicit, informed, and separate consent to PookPit to securely transfer your specific logs, insights, and data inputs to verified, licensed third-party mental health specialists, clinical psychologists, or psychiatric consultants integrated with our system.
• Statutory Life-Safety Exception: If our internal analytical automated logs or administrative reviews detect an imminent, material threat of self-harm, suicide, or physical violence, PookPit reserves its statutory legal right to override confidentiality protocols. Under these emergency conditions, we will securely transmit your personal data and location coordinates to university disciplinary boards, family emergency contacts, or emergency medical response services.

4.3 Zero-Tolerance Contraband Monitoring

In accordance with the Narcotic Drugs and Psychotropic Substances (NDPS) Act, 1985, PookPit routinely scans all marketplace product listings, eateries metadata, and peer chats for banned substances (including narcotics, prescription medicines, alcohol, and weapons). If any prohibited items are flagged, your personal data, chat transcripts, IP logs, and college ID information will be frozen internally and shared directly with law enforcement agencies without requiring your prior approval.

PookPit does not sell, rent, or trade your personal data to third-party data brokers or marketing firms. We share data only with the following verified entities:

• Participating Peers: Limited contact details are disclosed only after a mutual transaction deal is finalized, as described in Section 4.1.
• Verified Mental Health Specialists: Shared strictly on an opt-in basis with your explicit consent to execute wellness interventions.
• Payment Aggregator Partners: Financial tokens are passed securely to RBI-compliant banking networks to process withdrawals from your internal POOKPIT Wallet.
• Legal and Law Enforcement Authorities: Data will be shared when mandated by a statutory order, court warrant, or under the Information Technology Intermediary Guidelines, 2021, to prevent fraud, cyber incidents, or criminal offenses under Indian law.

• Data Localization: In strict compliance with Indian data security frameworks, all personal data, wallet transactions, and communication logs are hosted and processed on secure cloud servers physically located within the territorial boundaries of the Republic of India.
• Data Retention Policy: We retain your personal data only for as long as your student account remains active or as required to fulfill the specific purposes outlined in this Policy. If you delete your account or graduate from your academic institution, your personal data will be permanently anonymized or purged from our active databases within 180 days, unless statutory tax laws or pending legal disputes mandate extended retention.

Under Chapter III of the DPDP Act, 2023, you possess robust legal rights regarding your personal data, which you can execute at any time through your account dashboard or by contacting our Data Protection Officer:

• Right to Access: You have the right to receive a summary of the personal data currently being processed by us, along with descriptions of the processing activities.
• Right to Correction and Erasure: You have the right to correct inaccurate data, update incomplete profiles, or request the complete erasure of your personal data from our servers.
• Right to Withdraw Consent: You have the absolute right to withdraw your consent to data processing at any time. Upon receiving a notice of withdrawal, PookPit will cease processing your data within statutory timelines.
• Consequence of Withdrawal: Because data processing is a technical prerequisite for platform security, withdrawing your consent or revoking your institutional email authorization will result in the immediate and permanent termination of your PookPit user account.
• Right to Nominate: You have the right to nominate any other individual to exercise your data rights in the event of your death or physical incapacity.

PookPit implements industry-standard technical and organizational security measures, including AES 256-bit encryption for data at rest, Secure Socket Layer (SSL/TLS) protocols for data in transit, and logical firewalls. While we maintain a robust security framework, you acknowledge that no digital transmission over the internet can be guaranteed as 100% secure. In the event of a material personal data breach, PookPit will fulfill its statutory duty under the DPDP Act, 2023, by instantly notifying the Data Protection Board of India (DPBI) and all affected Data Principals.

If you have any questions, complaints, anxieties, or wish to exercise your legal data rights under the DPDP Act, 2023, please contact our designated Grievance and Data Protection Officer directly. We are legally mandated to acknowledge your grievance within 48 hours and resolve it within thirty (30) days.

• Designated Officer: Grievance & Data Protection Officer (DPO)
• Corporate Entity: Pookpit Hub Private Limited
• Registered Office Address: Moradabad, Uttar Pradesh, India
• Dedicated Legal Email Contact: admin@pookpit.com

Statutory Appellate Recourse: If you remain unsatisfied with the resolution provided by our Grievance Officer, you hold the legal right under Indian law to escalate your complaint directly to the Data Protection Board of India (DPBI).