Privacy Policy

Last updated: 16 September 2026 · Governed by India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

The short version

• We collect order details, anonymous site-usage signals, and whatever you choose to type to us in the chat or in an email. Nothing else.
• No child ever gives us data through this website. The account holder is a parent or guardian.
• This marketing website carries Meta's advertising pixel, which sets a cookie in your browser and tells Meta that a visit, a form or a purchase happened. It is how our ads find parents and how we know which ones worked. See advertising measurement — including the switch that turns it off.
• The live chat in the corner is run for us by Zoho. The button itself is ours and loads nothing; only when you tap it does Zoho's widget load and set its own cookies. If you never tap it, Zoho never hears that you were here. See live chat.
• Nothing your child does is ever sent to an ad platform. The pixel does not exist inside the app, inside the episode player, or in your signed-in account area — and children are never tracked, anywhere, ever. The chat button is absent from those same surfaces, for the same reason.
• We never sell or rent your data, and other than the advertising measurement described below we share it only with the companies that deliver your order, answer your messages and send your email.

What we collect, and why

We never collect card or UPI details. Payment happens inside Razorpay's own secure checkout. We receive only a payment reference and a success or failure result.

Children's data

Under the DPDP Act, a child is anyone under 18 — the highest threshold in the world, and we build to it. This website is for parents and guardians. It has no child sign-up, no child profile, and no place for a child to enter anything.

Inside the app, where children do appear, we never track them, never monitor their behaviour, and never show them advertising — as required by DPDP s.9(3), and as a design principle we would hold to regardless. The app requests no camera, microphone, location or contacts permission at all.

The advertising pixel described below is switched off by construction on every surface a child can reach. It is not present in the app at all, and on this website it refuses to load on the episode player, on your signed-in account pages and on our own admin pages. That exclusion is written into the code, not into a setting someone could flip.

The live-chat button obeys the same exclusion. It is not rendered on the episode player, on your account pages or on our admin pages — the same list, read from the same place in our code, so the two can never drift apart. If you open the chat on a public page and then walk into the player, the widget is removed rather than merely hidden: the page reloads once, without it.

Cookies

Ours: one, and only if you sign in to your account — a session cookie that keeps you signed in. It is HttpOnly, Secure, SameSite=Lax, and carries no advertising identifier. Our own usage measurement sets no cookie at all.

Meta's: when the advertising pixel runs, Meta sets its own cookies in your browser on this website — one that gives your browser a random identifier (_fbp), and, if you arrived by clicking one of our ads, one that remembers that click (_fbc). They live for a few months. If you switch advertising measurement off below, we store one small flag on your device (amritpur-ads-off) so that your choice survives — a refusal, never an identifier.

Zoho's: none at all unless you open the live chat. When you do, Zoho's widget sets its own cookies and stores its own entries on your device so that a conversation survives a page change and so that your reply reaches the same person. They are set by Zoho, in your browser, at the moment you tap the button — not before, and never on a page a child can reach. If you would rather they never existed, do not open the chat: write to support@talesofamritpur.com instead, and nothing third-party is loaded at all.

We have chosen not to put a cookie pop-up in front of you. A banner that everybody taps away without reading is not consent in any meaningful sense; telling you in plain words, on a page you can actually read, and giving you a switch that genuinely works, is what we think honesty looks like here. If you would rather nothing at all: the switch below, your browser's tracking-protection setting, or a Global Privacy Control signal — we honour all three.

Who we share data with

• Razorpay — to take the payment. They receive your name, email and mobile number as required for the transaction.
• Our courier partner — receives your name, address and mobile number, solely to deliver the books.
• Our email provider — receives the address needed to deliver each message we send you (order confirmations, the free kit, login codes).
• Zoho — runs the live chat, and only for the people who open it. Zoho receives the conversation itself and the ordinary technical details of the browser you are chatting from. It is not given your order, your address, your account or anything about your child unless you type it into the chat yourself.
• Meta (Facebook / Instagram) — receives the advertising signals in the table above from this marketing website: that a page was viewed, that the form was filled, that a purchase happened and for how much, and — for events our server confirms (a form step completed, a purchase captured) — an irreversible hash of your email or mobile so that Meta can match the result to the ad you saw. Never your address, never your child's name, never anything from inside the app.

That is the complete list. The first four are data processors: they act on our instructions and may not use your details for their own purposes. Meta is different, and we would rather say so than blur it. Meta is a recipient in its own right — it uses what it receives under its own terms and its own privacy policy, including for its own advertising systems, and we cannot control that on your behalf. That is precisely why the switch below exists.

Advertising measurement

We advertise on Meta, because that is where the parents we are trying to reach actually are. Two things make that measurable, and you should know about both.

The pixel. A small piece of Meta's code runs on the public pages of this website — the landing page, the get-started form, the offer and checkout pages. It tells Meta that a visit or a step happened, and it lets Meta show our ads again to adults who looked but did not enrol. We have deliberately switched off its automatic collection features: it does not read your form fields, it does not scrape the buttons you tap, and it never receives your name, your address or anything you typed. Our ads are targeted to adults aged 25–45, never to children.

The server-side half. When our server confirms an event — a step of the get-started form completed, or a payment captured — it also reports that one event to Meta directly, with your email or mobile reduced to an irreversible SHA-256 hash before it leaves our machine, alongside the same technical details your browser itself sends Meta whenever the pixel runs — your network address, browser type and Meta's own cookie identifiers — and with a shared reference number so that Meta counts each event once rather than twice. This exists because ad-blockers and slow networks silently drop a large share of browser-side reports, which would leave us guessing about which campaign paid for itself.

Where it never goes. Not into the app. Not into the episode player. Not into your account pages. Not into our admin pages. Nothing a child watches, answers or earns is sent to Meta or to any other advertising company, and that is not a policy setting — it is a rule enforced in our code.

Separately from all of this, we keep first-party, anonymous usage statistics on our own servers — the site-usage signals in the table above. Those are ours alone and are never shared.

Live chat

There is a small “मदद चाहिए?” button in the corner of every public page. A real person answers it — we have no bots and no call centre, and nobody will ring you because you used it. If nobody is at the desk when you write, your message waits and we come back to you — the chat reaches the same person as support@talesofamritpur.com and carries the same published first-response promise.

The button is ours. The chat is Zoho's. The button you see is our own markup in our own colours, and it loads nothing: no Zoho script, no Zoho cookie, no record anywhere that you visited. Only when you tap it do we fetch the chat widget from Zoho (Zoho Corporation), who run it for us. That is a deliberate design choice and the reason this section can be short: for the great majority of visitors, who never open the chat, this entire page describes something that did not happen.

What Zoho gets, once you open it. The conversation itself, whatever name or email you choose to give the window, the page you opened it from, and the ordinary technical details every website sees — browser, device, and the city your network address resolves to. Zoho acts as our processor on our instructions and may not use any of it for its own purposes. We hold your chats in Zoho's Indian data centre, the same country as the rest of this system. Ask us and we will delete a conversation.

A chat is support, never a sales lead. Opening it does not add you to an advertising audience, is never reported to Meta, and is never joined to the advertising signals described above.

Where it never appears. Not on the episode player, not on your signed-in account pages, not on our admin pages — the same excluded list the advertising pixel obeys, read from the same place in our code. A child watching a story is never offered a chat window and is never inside a chat company's session. If you open the chat on a public page and then move to the player, the page reloads once so the widget is gone rather than hidden. The chat also cannot start a voice or video call: this website tells your browser to refuse the camera and microphone outright, on every page, whoever asks.

How to avoid it entirely. Do not tap it — that is the whole mechanism, and it needs no switch, no banner and no account. If you would rather write, support@talesofamritpur.com reaches the same person and loads nothing third-party at all. With JavaScript off the button is not drawn at all; if a content blocker stops the chat from loading, the button turns into that same email address rather than pretending to work. Either way the rest of the site behaves exactly as it does now.

Where the data lives

Chat conversations live in Zoho's console in its Indian data centre and nowhere else; we keep no copy. Everything else below is ours.

Order data is stored in a managed Postgres database with row-level security enabled and access restricted to our servers. Transport is TLS-encrypted throughout, and the database itself is encrypted at rest. Sensitive values — login codes, and the index we use to look your orders up by email — are stored hashed, never in plain text. On top of that, the most sensitive fields — your delivery address, support messages, and the name, number and answers you give while getting your free Kit — are additionally encrypted by our application with their own key, so even a copy of the database alone cannot read them.

Your rights

Under the DPDP Act you may ask us to:

• tell you what data of yours we hold and who we shared it with;
• correct anything inaccurate or incomplete;
• erase your data — subject to the records tax law requires us to retain;
• nominate someone to exercise these rights if you cannot;
• withdraw consent, at which point we stop the related processing.

Write to support@talesofamritpur.com. We acknowledge within 48 hours and resolve within 30 days.

If something goes wrong

If a breach affects your data we will notify you and the Data Protection Board without delay, and file the detailed report the law requires within 72 hours. Our playbook for this is written in advance rather than improvised on the day.

Grievance Officer

Mayank Patel, Designated Partner — Grievance Officer
mayank@leocaster.com
Leocaster Systems LLP, Ward 19, Ahead of Vallabh Das Bhawan, Talaiya, Vidisha 464001, India