Privacy policyTermsGrievance

1. Who this applies to

This policy explains what personal data LoggedOut collects, why, how long it is kept, who else handles it, and what limits apply to the anonymity of posting. It applies to visitors, to people who post stories, and to people who sign in. The operator is Kexa Labs (Udyam Reg. No. UDYAM-GJ-22-0652675), ("Kexa Labs", "we", "us"), the data fiduciary.

Data protection law status: the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025. Our understanding, which comes from the Government's notifications as reported to us and which we cannot guarantee, is that most duties of data fiduciaries (including notice, consent, erasure and breach intimation) are scheduled to start on 13 May 2027. This policy is written to meet those duties already, so it describes what we do now. If the commencement dates change, this policy will be updated. Until then the Information Technology Act, 2000 and the IT Rules apply.

2. Definitions

• Story: text published on LoggedOut with its company, role, reason, month and other fields.
• Account: the record made when you sign in.
• Keyed hash: a one-way code made from a value using a secret key held on our server. Without the key it cannot be turned back into the value. With the key, anyone can test whether a guessed value produces the same code.
• Login hash: the keyed hash of your email address, or of your Google sign-in identifier, that lets us recognise you when you sign in.

3. What we collect

3.1 When you post a story (you need an account, but nothing stored with the story names it)

We store what you submit: the company, the city if you give one, your role, the main reason, your story, the month you posted, the year you left if you give it. These become public. You must be signed in to post. We do not store your name, your account, your session, your IP address or browser details with the story, and the code that saves a story never writes any of them. After you post we show you a claim code once. We store only a one-way SHA-256 hash of it, beside the story number and nothing else, so that you can delete the story or appeal a takedown (see the Content, Reporting and Takedown Policy). We cannot recover a lost code. An appeal you send is stored with the story number, its text and the month. If you put a name or other personal detail into a story, it becomes part of the public story. The writing form warns you about names, phone numbers and email addresses; the warning runs in your browser and nothing is sent to us.

3.2 When you sign in (needed to post, see all stories, react or report)

3.3 Short-lived technical data

• Rate-limit code. To stop one source flooding the site, the server makes a one-way code from your connection's network address and keeps it in memory. It limits each source to 5 sign-in emails an hour and 3 new accounts a day, and limits attempts at claim codes to 10 an hour. Posting is limited per account instead, to 5 stories a day and one every 30 seconds; those counts are held in memory against the account number, never written to disk, and gone when the server restarts. Signed-out visitors can read the newest 10 stories, and it also counts the single stories a visitor opens beyond the newest 10 stories in a day. These counts are held in memory only and are discarded when the server restarts. The address is not written to our database.
• Network firewall. The server's firewall holds network addresses of current connections in memory while it works, and it can record blocked connections (see section 3.4).
• Security and system logs. We keep security and system logs only, for 180 days: administrator sign-in events, firewall blocks, and service errors. They are not request logs. They do not record which stories you read, what you posted, or the pages you visit. They may include network addresses of connections the firewall blocked or that triggered an error, and the times those happened.

3.4 What we do not collect

• No analytics, advertising, tracking or third-party scripts. Fonts and scripts come from LoggedOut itself.
• The web server keeps no access log of visits.
• We do not collect your name or your email address in our database, your exact posting time (except as described in section 9), or browser details with stories.
• We do not use your data to profile you or to target you.

4. Purposes

We process personal data to: publish stories and run company pages; run sign-in and sessions; keep "Same here" and report counts accurate; protect the service from abuse and flooding; keep it secure; answer complaints and legal orders; and keep the records the IT Rules and other laws require us to keep. We do not sell personal data.

For account data, we rely on your agreement when you sign in (we show the Terms and this policy on the sign-in screen) and on the legitimate uses the DPDP Act allows, such as disclosure required by law. You can withdraw your agreement by deleting your account.

5. Stories that name people

A story can contain personal data about another person, such as a manager. The rules forbid naming private individuals. A person named in a story can use the Content, Reporting and Takedown Policy to ask for the story to be removed.

6. Retention

DPDP Rules 2025 contain a minimum retention of one year for certain personal data, traffic data and logs for specified purposes from 13 May 2027. We will review this table before then and publish any change.

7. Who else handles data, where, and in what role

Personal data is stored and processed outside India, because the server and our providers are outside India. We transfer data to the extent needed to run the service. The DPDP Rules allow transfers subject to any restriction the Central Government may specify. We have no such restriction to apply as of the date above. Our providers process data under their own terms of service and data processing terms. They may retain data for their own periods, which we do not control. A work address you type may be visible to your employer's mail systems.

8. Backups and residual copies

Deleted data does not leave every copy at once:

• In the live database, deleted text is overwritten in the main file when it is removed.
• The replica in cloud backup storage records every database change continuously and keeps about 7 days of history, with finer posting timing than the month shown on the site. Changes are shipped about every 3 seconds. Content deleted today can still be present in the replica for up to about 7 days.
• We do not use the hosting provider's automated disk backup. The secret key is held only in the server's memory and is never written to disk, so no disk snapshot or backup contains it.
• Provider records (email delivery, email checking, identity provider) follow each provider's own retention.
• If we restore an older copy of the database, anything removed or deleted after that copy was made may reappear until we remove it again. We remove it again as soon as we notice, using our records of removals.

9. Anonymity: what it is and where it stops

Anonymity here is a property of how the system is built, not a promise that nobody can ever work out who wrote a story.

What is true by design:

• Posting needs an account, but the code that saves a story stores neither the account nor your session with it. No table links a story to an account or to anything derived from one: the only table beside the story number besides reports is the hash of its claim code, a random value that is not derived from your account. We checked this on our own system, and the check is repeatable.
• We do not store your IP address, name or browser details with a story, and the web server keeps no access log.
• Signed-in accounts hold keyed hashes, not your email address, so we do not hold your email address in our database.

What it does not guarantee:

• Backup timing. The site shows only the month a story was posted, but backups keep finer posting timing for 7 days. Every database change is replicated about every 3 seconds. The replica holds about 7 days of history with timestamps, so the time a story was added can be worked out, to within a few seconds, for about 7 days after it was posted. Someone who also knows when you were online (for example your employer's network logs) could use this to guess which story is yours. Waiting before you post, or posting from a network that is not tied to you, reduces this. Time of signing in and time of posting could be matched the same way.
• Reactions and reports. The server holds the secret key. Anyone holding both the database and that key could test which account reacted to which story, because account numbers and story numbers are small. The key is held only in the server's memory and never on disk, so disk snapshots and backups do not contain it. When you delete your account, your reaction and report records are deleted too; the story totals stay unchanged.
• Your employer. Your employer's network or computer may show that you visited, even though we cannot. A work email address typed into the sign-in form may appear in your employer's mail logs. Google sign-in refuses Google Workspace (work) accounts, but the refusal happens after Google has handled the sign-in, so the attempt may still appear in your employer's Google admin records. Passkeys involve no email.
• What you write. Details in a story can identify you or another person. Writing style can identify a person.
• Legal compulsion. We can be ordered to produce what we hold (see section 10).
• Providers and networks. Providers and network operators between you and us may see your connection. A future change could add logging. Any change that reduces privacy follows the change rules in the Terms of Service.

We do not claim that identification is impossible.

10. Legal requests

We disclose personal data only to comply with law or a valid order, to protect rights in legal proceedings, or with your agreement. We handle requests as described in the Legal Requests Policy. We can produce only what we hold, which is described in section 3 and the Legal Requests Policy. We cannot identify the author of a story, because we do not know who wrote it.

11. Your rights and how to use them

You can use the rights in the DPDP Act, 2023: to ask for information about the personal data we process about you; to ask for correction or erasure; to nominate someone to act for you; and to have your grievance heard. You can delete your account yourself on the site. That removes the account, its sign-in methods, sessions and its "Same here" and report records immediately; story totals stay unchanged; only the login hash is kept for 180 days (Rule 3(1)(h)) and then purged, subject to the backup periods in section 8.

To make a request, write to the contact on the Contact and Grievance Officer page. Give the email address or sign-in method you used, so that we can compute the keyed hash and find the account, and we may ask you to confirm by signing in. We will answer within the periods on that page, and in any case within 90 days. If you are not satisfied, after using our grievance process you may complain to the Data Protection Board of India once it is operating as the Act provides.

Because no stored record links a post to an account, we cannot identify which stories you wrote. Only someone holding the claim code of a story can delete it. To remove a story, use the Content, Reporting and Takedown Policy. Erasure may be declined where law requires us to keep the data, as for removed stories and login hashes.

12. Security

We protect the service with reasonable security practices: encrypted connections (TLS) to the site, keyed hashes for logins, a restricted firewall, restricted administrator access, and limited logging. Backups sent to cloud storage are not encrypted by us before upload. No system is completely secure. If a breach affects your personal data, we will notify you and the authorities as the law requires; because we do not hold your email address, we would post the notice on the site.

13. Children

LoggedOut is for people aged 18 or older. We do not knowingly collect personal data of children. If you believe a child has an account, tell us through the Contact and Grievance Officer page.

14. Cookies and storage on your device

LoggedOut sets a sign-in cookie (30 days) and a short-lived cookie during sign-in. Your browser also stores, on your device only: your colour theme; a flag that you have signed in before; the numbers of stories you reacted to (cleared when you sign out); an unfinished draft for the length of the tab; and a flag for revealed company names for the length of the tab. None of this is sent to us for tracking.

15. Changes

Changes are made as stated in section 12 of the Terms of Service. Each version is dated and listed below.

16. Contact

Questions about this policy: Contact and Grievance Officer.

Version history

1. Who we are and what this covers

LoggedOut is a website where people publish anonymous stories about why they left a job. It is operated by Kexa Labs (Udyam Reg. No. UDYAM-GJ-22-0652675), ("Kexa Labs", "we", "us").

These Terms are the user agreement for everyone who reads, posts, signs in, reacts to or reports content on LoggedOut. By using the site you accept them. Posting a story, or signing in, is an affirmative act of acceptance. You must be signed in to post. Posting is anonymous in the sense that nothing we store links a story to the account that posted it. To create an account you tick an unticked box saying you agree to the Terms, the Privacy Policy and the Content Policy, and to post you must be signed in, so you have already accepted them, and you tick a box saying the story is your own experience. For an account we record only the version you accepted and the date. If you do not accept them, do not post or sign in.

Terms that apply together with these: the Privacy Policy, the Content, Reporting and Takedown Policy (together with section 5 below, the "Content Rules"), and the Legal Requests Policy. Data is stored and processed outside India, as the Privacy Policy explains.

2. Definitions

• Story: text a person submits for publication on LoggedOut, with its company, role, reason and other fields.
• Account: the record created when you sign in with a passkey, a Google sign-in or an email code, as described in the Privacy Policy.
• Content: stories, reasons given in reports, and anything else a user submits.
• Grievance Officer: the Grievance Officer of Kexa Labs, whose contact is on the Contact and Grievance Officer page.

3. Eligibility

You must be at least 18 years old to post, to create an account, or to use the account features. If you are under 18 you may not use the signed-in features or post. You must have the legal capacity to enter a contract under Indian law. You must not use LoggedOut if you are barred from doing so by law.

4. What the service is, and what it is not

LoggedOut is an intermediary within the meaning of the Information Technology Act, 2000. We host content written by users. We do not write, check, verify, edit or endorse stories. Each story is the opinion and account of the anonymous person who wrote it and is not a statement of fact by us about any company or person. A company page counts the stories people posted. It is not a rating, a review score or a finding about the company.

We do not edit the text of stories. We may hide or remove a story, as described in the Content, Reporting and Takedown Policy.

Signed-out visitors see the newest 10 stories, with company names hidden, and can open a limited number of single stories by link each day. Signed-in users can see all stories and company names, react with "Same here" once per story, and report a story once. Accounts can report only after they are 7 days old. These limits are rules of the service, not guarantees of what any story means.

5. Your responsibilities and the content rules

You are solely responsible for what you post. Posting is anonymous, but anonymity does not remove your legal responsibility, and anonymity is not guaranteed in every circumstance (see the Privacy Policy, section 9).

You must not post, upload, display or share content that:

1. belongs to another person and which you have no right to publish, including copyrighted material you do not have permission to use, or confidential information you are legally bound to keep secret (for example trade secrets or customer data);
2. names, describes in an identifying way, or gives the photo, handle or contact details (including phone numbers and email addresses) of a private person. Describe people by role, for example "my manager";
3. is defamatory, obscene, pornographic, invasive of another's privacy (including bodily privacy), harassing, insulting on grounds of gender, race or ethnicity, hateful, or encourages violence, money laundering or gambling;
4. is harmful to a child;
5. infringes a patent, trademark, copyright or other proprietary right;
6. deceives or misleads about where it came from, or that you know to be false, including events you made up or a story about a company you never worked for;
7. impersonates another person;
8. threatens the unity, integrity, defence, security or sovereignty of India, friendly relations with other countries or public order, or incites an offence, or insults another nation;
9. contains software or code meant to damage or disrupt a computer resource; or
10. is otherwise unlawful under any law in force in India.

This list follows the categories in Rule 3(1)(b) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended ("IT Rules"). Do not use LoggedOut to identify, pile on or contact a private person, to get around the rate limits, to create accounts to inflate counts or reports, or to attack the service.

The writing form warns you before you publish if your text looks like it contains a name, phone number, email address or link. The warning is a prompt that runs in your browser, not a check we enforce, and you remain responsible.

Notice required by Rule 3(1)(c) of the IT Rules: (a) we may suspend access, or remove or disable content, that does not comply with these Terms or with law; (b) a user who breaks the rules may be liable to penalty or punishment under the Information Technology Act, 2000, the Bharatiya Nyaya Sanhita, 2023 or other law; and (c) offences that law requires us to report, including under the Bharatiya Nagarik Suraksha Sanhita, 2023 and the Protection of Children from Sexual Offences Act, 2012, will be reported. This notice is on the writing form and the sign-in screen and is repeated in these Terms.

6. Licence you give us

You keep ownership of your story. By posting you give us a non-exclusive, worldwide, royalty-free licence to store, copy (including in backups), display, and make the story available on LoggedOut, and to hide or remove it, for as long as we hold it. The licence is limited to running and moderating LoggedOut and meeting our legal obligations. We do not sell stories or use them to train models or for advertising. Because no stored record ties a story to an account, we cannot identify an author to let the author edit or withdraw a story. After you post we show you a claim code once. With that code you can delete your own story for good, or appeal if we take it down, on the Manage a story page. We cannot recover a lost code. If you cannot use a code, use the process in the Content, Reporting and Takedown Policy. Under that policy a removed story is retained privately and not deleted by us (section 9).

7. Moderation, suspension and availability

We may, at our discretion and acting reasonably, hide, remove or refuse to publish any content, limit or end any account (including suspending its ability to post), and change or stop any feature. We will give reasons to a person who has complained through the grievance process. We cannot give reasons to an anonymous author because we cannot contact the author.

Twenty distinct, eligible reports automatically hold a story for manual review. That is not a finding that the story is false or unlawful (see section 4 of the Content, Reporting and Takedown Policy).

We run LoggedOut with reasonable care, but we do not promise it will always be available, error-free or secure. We may suspend it for maintenance or for reasons beyond our control.

8. Disclaimers

To the extent permitted by law, LoggedOut and everything on it is provided "as is" and "as available". We do not warrant that any story is accurate, complete or lawful. Do not rely on a story for a legal, medical, financial or employment decision. If you are in danger, contact emergency services. Nothing in these Terms excludes a warranty or right that the law does not allow to be excluded.

9. Limitation of liability

LoggedOut is free to use. To the extent the law permits, our total liability to you for any claim arising out of or in connection with your use of LoggedOut is limited to INR 1,000, and we are not liable to you for indirect or consequential loss, loss of profit or loss of reputation arising from content posted by others.

This limit does not apply to, and nothing in these Terms limits or excludes: (a) liability for fraud or wilful misconduct; (b) liability for death or personal injury caused by our negligence; (c) any liability that cannot be limited or excluded under Indian law; or (d) any duty we owe under statute, including our duties under the IT Rules and data protection law. The limit applies only between you and us. It does not bind a court, a regulator, or a person who is not bound by these Terms, such as a person who is the subject of a story.

10. Indemnity

To the extent permitted by law, you agree to compensate us for loss, damage and reasonable legal costs that we suffer because content you posted breaks these Terms or the law, or because you break these Terms. This indemnity covers only your own conduct and content. It does not cover loss caused by our own fraud, wilful misconduct or breach of a legal duty, and a court may reduce it to what is reasonable.

11. Ending your use

You may stop using LoggedOut at any time and may delete your account from within the site. Deleting your account deletes its sign-in methods, sessions and its "Same here" and report records; story totals stay unchanged; only the login hash is kept for 180 days, as explained in the Privacy Policy, section 6. We may suspend or end an account that breaks these Terms.

12. Changes to these documents

We will publish every change to these Terms, the Privacy Policy and the other documents on the site with a new version number and a new "last updated" date, and keep a version history in each document. A change that reduces privacy protections for data we already hold, or that adds obligations on you, will be announced on the site at least 30 days before it takes effect unless a law or an order requires a shorter period. Using the site after a change takes effect is acceptance of it, except where the law requires a fresh, explicit consent, in which case we will ask for it. Rules, the Privacy Policy and these Terms are linked from the sign-in screen, and we inform users of them and of changes at least once a year as Rule 3(1)(f) of the IT Rules requires. If you do not accept a change, stop using the site and delete your account.

Each version of the Terms, Privacy Policy and Content Policy that people accept carries one version number (the version at the top of this document). When a change is material, we raise that number in the site's code and publish the new text. On their next visit, accounts that accepted an older version are shown a notice and must tick a box to accept the new version before they can react or report; reading and signing in are not blocked. Their acceptance is recorded as the new version and the date.

13. Governing law, disputes and courts

These Terms are governed by the laws of India. Please first raise any complaint with the Grievance Officer using the Contact and Grievance Officer page. We do not require arbitration. Subject to any right you have by law to bring a claim elsewhere, the courts at the place where Kexa Labs carries on business in Gujarat, India, have exclusive jurisdiction over disputes between you and us. This choice of court does not limit the jurisdiction of any court over a person who is not bound by these Terms, and does not stop a court or authority elsewhere in India from exercising powers over us under law. LoggedOut is free, so we do not treat the service as a paid service under the Consumer Protection Act, 2019. If we begin to charge for any feature, we will revise these Terms before doing so.

14. General

If a part of these Terms is invalid or unenforceable, the rest remains in force. A failure to enforce a term is not a waiver. You may not transfer your rights under these Terms. These Terms are the whole agreement between you and us about the use of LoggedOut. A person who is not a party to them cannot enforce them. You can reach us at the email on the Contact and Grievance Officer page.

Version history

Content, Reporting and Takedown Policy

1. Scope

This policy explains how stories are reported, reviewed, held, removed and restored on LoggedOut, which is operated by Kexa Labs (Udyam Reg. No. UDYAM-GJ-22-0652675). It sits beside the content rules in section 5 of the Terms of Service. LoggedOut is an intermediary. We host what users write, we do not verify it, and we do not edit it. We act on it as described here and as the law requires.

2. Definitions

• Hold: a story is hidden from the public but kept privately.
• Removal: a hold that we have decided to keep in place after review.
• Complainant: any person or body that complains about a story, whether or not they have an account.
• Grievance Officer: the Grievance Officer of Kexa Labs, whose contact is on the Contact and Grievance Officer page.

3. How to report a story

1. Report button (signed-in users). A signed-in account at least 7 days old can report a story once, choosing a reason. Reports from accounts under 7 days old are not counted, and the site tells the person so.
2. Grievance channel (anyone, no account needed). Anyone, including people who are named in a story, former employers, and people without an account, can write to the Grievance Officer using the details on the Contact and Grievance Officer page. This is the channel to use for defamation, a privacy complaint, a copyright complaint or a legal reason.

A complaint should identify the story (its link or the company and the passage), say why it should come down, and give a way to reach you. Details are on the grievance page.

4. What 20 reports mean, and what they do not

When 20 different eligible accounts have reported a story, the story is held automatically so that it does not stay in public view while we review it. That is a safety measure. It is not a finding that the story is false, unlawful or harmful. It does not mean 20 different people reported it, because a person could create more than one account. It does not decide the outcome. After a hold we review the story and either restore it or leave it removed, and we do not edit its text. We aim to complete review of held stories within 7 days and will tell a complainant who has written to us what we decided.

A smaller number of reports does not hide a story. We may hold a story sooner than 20 reports if it appears to break the law or the content rules.

5. Timelines

These apply from the time we receive a complaint on the grievance channel. They follow Rule 3(2) and Rule 3(1)(d) of the IT Rules.

We publish these as commitments. If a complaint arrives outside working hours, the clock still runs.

6. Defamation, correction and dispute

A story is the opinion and experience of its anonymous author. A person or company that says a story is false and damaging can complain under section 3.

1. What to send. Identify the passage, say what is false and why, and attach any evidence you want considered. Say who you are and in what capacity you complain.
2. What we do. The Grievance Officer reads the story and the complaint. We do not decide whether a statement is true or defamatory in a legal sense. We decide whether to keep the story visible, hold it, or remove it, considering whether it breaks the content rules, whether it names or identifies a private person, whether the complaint raises an arguable legal problem, and any evidence. We may hold a story while we decide.
3. Opinion and truth. Honest opinion and true statements about conduct are not removed merely because they are unwelcome. A story that makes a specific factual accusation, especially of a crime, that the complainant shows is false, may be held or removed.
4. Correction. We do not edit stories, and we cannot reach the author. We cannot at present publish a reply or correction beside a story. If we find a story is inaccurate we may hold or remove it. A complainant may ask us to consider a short written response and tell us if they wish. We will tell the complainant if we can offer one.
5. Reasons. We give the complainant our decision with brief reasons, in writing, within the time in section 5.
6. Court route. A complainant may also go to court. We act on a court order within 3 hours. A private notice, such as a letter from a company, is not a court order, but we still treat it as a complaint under this policy. We tell complainants this.
7. Author's side. Because we cannot contact authors, an author learns of a hold or removal only if they check. An author who wants a story reconsidered may write to the Grievance Officer with the story's link and the text of the story; we cannot confirm authorship and decide on the merits only.

7. Decisions and appeals

A complainant who disagrees with our decision, or an author whose story was held or removed, may ask the Grievance Officer to reconsider within 30 days, giving the reason. The Grievance Officer will look again at the original complaint and the new points and answer within 7 days. This is review by the same operator, not an independent body.

A complainant may also appeal to the Grievance Appellate Committee established under Rule 3A of the IT Rules, within 30 days of our decision or of our failure to resolve the complaint in time. We comply with the Committee's orders. See the Contact and Grievance Officer page.

8. Malicious reports

A report should be made in good faith. We may disregard reports that appear to be coordinated, repeated, made by accounts created to inflate counts, or made to suppress true accounts. We may limit or end accounts that do so. Because the 20-report threshold depends on accounts, it can be manipulated, so a hold is always followed by a review and is not conclusive. A false complaint made with intent to harm may have consequences under law.

9. Removed and held stories are kept

This section is about content that we remove or hold. If an author deletes their own story with its claim code, that is the author's own act and is a real deletion of the story, any held copy and its reports; it is not removal by us, and we keep no copy for the preservation duty. We take no step that links the story to an account, because none exists. An author can also appeal a hold or removal with the claim code (section 7); the appeal is stored with the story number and the month.

We do not permanently delete a removed or held story. We keep it, privately, so that we can review it, resolve disputes, and meet the legal duty to preserve removed content and associated records for at least 180 days (Rule 3(1)(g) of the IT Rules), or longer where a court or authorised agency requires. A held or removed story is not shown to the public. A person named in a removed story can ask us to confirm that it is no longer public. Retention of that kind is a ground on which a request to erase may be declined (see the Privacy Policy, section 11). Backups and replicas hold copies as described in the Privacy Policy, section 8.

10. Orders and legal requests

Court orders and notices from authorities follow the Legal Requests Policy. We preserve a copy before disabling content, so that evidence is not lost.

11. Copyright complaints

A copyright owner who believes a story copies their work can write to the Grievance Officer. Include a description of the work, proof of ownership, where the copy is on LoggedOut, and an undertaking to go to court within 21 days. If we are satisfied, we will restrict access for up to 21 days or until a court order, as the Copyright Act, 1957 and the Copyright Rules, 2013 provide, and we will tell the person who asked.

12. Notice of consequences

We may suspend or remove content or accounts that break the content rules. A user may be liable to penalty or punishment under the law. Offences that the law requires us to report will be reported (see section 5 of the Terms of Service).

Version history

Legal Requests Policy

1. Scope

This policy explains how Kexa Labs (Udyam Reg. No. UDYAM-GJ-22-0652675), which operates LoggedOut, handles court orders, government and agency requests, and similar legal process. It does not cover private complaints, which follow the Content, Reporting and Takedown Policy.

2. Where to send a request

Send orders and requests, in writing, to the Grievance Officer at grievance@loggedout.org. We receive and acknowledge orders and notices from courts, government and authorities through this channel, as Rule 3(2) of the IT Rules requires. The same details appear on the Contact and Grievance Officer page. An order sent anywhere else may not reach us in time.

A request should state: the issuing court or authority and the officer's name and rank; the legal provision relied on; the purpose; the exact web address of any story to be removed or the exact information sought; any deadline; and any request that we keep it confidential, with the legal basis.

3. Our approach

1. We comply with valid Indian legal process. We are an Indian operator and are bound by it.
2. We check that a request is valid before acting: issued by a competent court or an authorised officer, in writing, and specific. We may ask for clarification, and we may challenge a request we believe is overbroad or unlawful, to the extent the law and the timelines allow.
3. We give only what a valid request requires and what we hold. We do not create new records, and we do not collect more data in order to answer a request.
4. We keep a record of each request and what we did, and we may publish a summary count (without personal details) from time to time.

4. Orders to remove content

On a court order, or on a reasoned written notice from an authorised government officer (not below Joint Secretary, or for police not below Deputy Inspector General, which specifies the legal basis, the provision, the nature of the unlawful act and the exact address of the content), we remove or disable the content within 3 hours of receiving it, as Rule 3(1)(d) of the IT Rules requires. Before disabling, we preserve a copy of the content and associated records for at least 180 days, or longer if the court or agency requires, as Rule 3(1)(g) requires. Blocking directions under section 69A of the Information Technology Act, 2000 are complied with as those provisions require.

A private notice (for example from a company or a lawyer) is not an order. We handle it under the Content, Reporting and Takedown Policy.

5. Requests for information

A lawfully authorised government agency may ask in writing, stating the purpose, for information or assistance for verification of identity, prevention, detection, investigation or prosecution of offences, or cyber security incidents. We respond as soon as possible and not later than 72 hours of receiving it, as Rule 3(1)(j) requires. The 72 hours is for our response. It does not create data that does not exist. Orders under sections 69 and 69B of the Information Technology Act, 2000 are answered as those provisions and their rules require. A private litigant must obtain a court order. Where a court orders us to produce information in a civil case, we respond to the court.

6. What we can and cannot produce

We can produce, if it exists at the time of the request:

• published stories, including held and removed stories, and report records;
• account records: account number, creation date, keyed login hash, passkey public key and credential ID, session hashes and expiry;
• reaction and report marks (keyed hashes), and whether posting is suspended for an account;
• appeals made with a claim code, with the story number and month;
• security and system logs kept for 180 days, which record administrator sign-in events, firewall blocks and service errors, and may include network addresses and times for those events;
• database backup history held by the cloud storage provider for about 7 days, with timestamps of database changes accurate to about 3 seconds;
• complaints and correspondence.

We cannot produce:

• the author of a story. Posting needs an account, but nothing we store links a story to an account, a session, a network address or any value derived from them, and we do not know who wrote it. The only thing kept beside a story is a hash of its claim code, which is random and not derived from any account;
• a record of who visited or read which story. The web server keeps no access log and the app keeps no reading history on disk;
• your email address, from our database. We keep only a keyed hash;
• information held only by others, such as an email delivery service, an email-checking service, an identity provider, a hosting provider or a cloud backup service. A request for those goes to them. We may be asked to ask them. We will tell the requester who holds it.

The Privacy Policy, section 9, explains how the timing of backups and an outside party's own logs, such as an employer's, could in practice narrow down the author of a story. We do not carry out that analysis on our own initiative, but we cannot refuse to produce backup history that a valid order covers.

7. Telling the user

We cannot tell an author, because we cannot contact them. For an account holder, we tell them of a request about their account unless the law or the order forbids it or we think it would harm someone or the investigation. Some laws, including the Information Technology Act, 2000 and the DPDP Rules, 2025, allow the government to require confidentiality. We do not promise to tell any person before disclosure. Where we are allowed to publish aggregate numbers of requests, we will.

8. Requests from outside India

A request from a foreign court, agency or private party has no binding force on us by itself. We do not provide data in response to it. We may tell the requester to use the Indian process, such as a letter rogatory or mutual legal assistance. We may act on a valid Indian order that results. We may in our discretion act voluntarily to prevent imminent danger to life, and we will keep a record.

9. Emergencies

If a person's life or safety is at imminent risk, tell the police first. The police can send a written request to the contact in section 2, marked urgent. We will treat it as quickly as we can.

Version history

1. Scope

This page gives the contact details of the Grievance Officer of LoggedOut, which is operated by Kexa Labs (Udyam Reg. No. UDYAM-GJ-22-0652675). It is published as Rule 3(2)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules") requires. It is also the contact for questions and requests about personal data (Digital Personal Data Protection Act, 2023) and for court and authority orders.

2. Grievance Officer

Use email. No account is needed, and you do not need to be a user of LoggedOut.

3. What this page covers

• complaints about a story or about how we handled a report (Content, Reporting and Takedown Policy);
• defamation, privacy, impersonation and copyright complaints;
• requests to access, correct or erase personal data, and questions about the Privacy Policy;
• court orders and notices from authorities (Legal Requests Policy);
• questions about the Terms of Service.

4. How to file a complaint

Write to the email above. Put "Complaint" or "Legal order" in the subject. Include:

1. your name and a way to reach you (we cannot contact anyone who does not give one);
2. the story: its link, or the company name and the exact passage;
3. what you want done (for example removal) and why: the rule or law you say it breaks;
4. any evidence you want us to consider;
5. for a copyright complaint, the matters listed in section 11 of the Content, Reporting and Takedown Policy;
6. for a complaint about content that shows a private area, nudity, a sexual act or an impersonation of you, say so in the subject; this is dealt with in 2 hours;
7. for a data request, the email address or sign-in method you used.

We may ask for more detail. Do not send passwords, identity documents, or government identifiers unless we ask. We may decline complaints that are repeated or abusive.

5. Our timelines

These timelines follow Rules 3(1)(d), 3(1)(j) and 3(2) of the IT Rules as amended in 2025 and 2026, and the 90-day outer limit in the DPDP Rules, 2025. We commit to them. Clocks start when your email reaches us. We acknowledge by email. We tell you our decision and the reason.

6. If you are not satisfied

1. Ask us to reconsider. Write to the Grievance Officer within 30 days, giving the new reason.
2. Appeal to the Grievance Appellate Committee. If you are not satisfied with the decision, or if we do not resolve your complaint in time, you may appeal to the Grievance Appellate Committee established under Rule 3A of the IT Rules, within 30 days. We will comply with its orders. The Committee works through the Government of India's online process; we do not control it.
3. Data Protection Board. For personal data, after you have used our grievance process, you may complain to the Data Protection Board of India once it is operating as the DPDP Act provides.
4. Courts. You can go to a court at any time.

7. What not to use this page for

This page cannot identify the author of a story, because we do not know the author. For emergencies, contact the police or emergency services.

Version history