The short version: the course needs no account, and your reading progress never leaves your browser. If you do create an account, we hold your email address and nothing else of consequence.
Who is responsible
In Five Lines ("we", "us") operates Five Lines at https://infivelines.com/ and is the data fiduciary for the personal data described here, under the Digital Personal Data Protection Act, 2023 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Postal address: Pune, Maharashtra, India
- Email: rohan@infivelines.com
What we collect
If you never create an account
Nothing that identifies you. The whole course (every card, every in-depth page, every concept page and every graded test) is available without signing in, and reading it sends us nothing about you beyond the ordinary server request logs described below.
If you create an account
| What | Why | Where it is kept |
|---|---|---|
| Email address | To identify the account, sign you in, and send confirmation and password-reset emails | Supabase |
| Display name, if you give one | So the site can address you by name. Optional, and you may leave it blank | Supabase |
| Password, hashed | To sign you in. We never see or store the password itself | Supabase |
| Account timestamps | When the account was created, confirmed and last signed in | Supabase |
That is the entire list. We do not ask for your phone number, your date of birth beyond the age confirmation, your address, your institution, or any payment details.
What stays in your browser and is never sent to us
These are stored on your own device using your browser's local storage, and no copy reaches our servers:
- Your reading progress, under the key
five-lines-v1(andtraining-run-v2from an earlier version of the site). Which cards you have read, which tests you have taken and what you scored. - Your sign-in session, under the key
five-lines-auth, if you have an account. - A small display hint, under the key
five-lines-account, holding your email address, your display name and the time your session expires, so a page can show "Your account" instead of "Sign in" without loading the whole sign-in library. It contains no access token.
Two consequences worth stating plainly, because they surprise people:
- Signing in does not upload your progress, and signing out does not erase it. Progress belongs to the browser, not to the account. Study on a second device and it starts empty.
- Clearing your browser data deletes your progress permanently. We have no copy, so we cannot restore it.
Server logs
Our host, Cloudflare Pages, and Supabase keep ordinary technical logs of requests (IP address, time, page requested, browser user-agent) for security and reliability. These are kept by those providers under their own retention schedules and are not used to build any profile of you.
Visit counts
Our host also keeps an anonymous count of visits for us (Cloudflare Web Analytics): which pages are read, which site sent the reader, the country and the kind of device. It sets no cookie and stores nothing that identifies a visitor, so it can count you but cannot follow you.
What we do not do
- No advertising, and no advertising trackers. There are none on any page.
- No third-party analytics that identify or follow you.
- No profiling and no behavioural tracking of anyone, and specifically not of anyone under 18.
- We do not sell, rent or trade personal data. There is no circumstance in which we would, and no arrangement under which we could.
Cookies
Five Lines sets no cookies for advertising, analytics or tracking. The browser storage described above is strictly necessary to provide the features you asked for: remembering where you are in the course, and keeping you signed in. That is why the site shows no cookie banner. If that ever changes, this policy changes with it and you will be asked first.
Who else touches your data
We use a small number of processors, and no others:
| Processor | What it does | Where |
|---|---|---|
| Supabase Inc. | Runs the authentication service and the database holding your account | AWS ap-south-1 (Mumbai, India) |
| Cloudflare Pages | Serves the website's files and keeps the anonymous visit count | Global content network |
| Resend, Inc. | Sends confirmation and password-reset email on Supabase's behalf, so it handles your address and those messages | AWS ap-northeast-1 (Tokyo, Japan) |
We have a data processing agreement in place with each. Choosing a region does not settle every question of where data sits: backups, logs and the providers' own subprocessors may be handled elsewhere, and we say so here rather than imply a guarantee we cannot give.
How long we keep it
- Account data: for as long as the account exists, and for up to 30 days after you ask us to delete it, while the deletion works through backups.
- Progress data: until you clear your browser. We never had a copy to keep.
- Server logs: on our providers' schedules, typically a small number of weeks.
How we protect it
- Every page and every request is served over HTTPS.
- The database enforces row level security: a signed-in reader can reach their own row and no other, and the public key the site ships cannot reach the table at all.
- The pages where a password is typed carry a strict Content Security Policy with no inline script permitted, and are only allowed to talk to our own origin and our authentication provider, so injected code on those pages has nowhere to send anything it steals.
- The authentication library is served from our own domain rather than a third-party CDN, so a compromised CDN cannot compromise a sign-in.
No system is perfect. If we ever become aware of a personal data breach affecting you, we will notify you and the Data Protection Board of India as the law requires.
Your rights
Under the DPDP Act you may:
- Access the personal data we hold about you
- Correct anything inaccurate, incomplete or out of date
- Erase your account and the data attached to it
- Withdraw consent at any time, as easily as you gave it. Withdrawing consent means closing the account, and you keep full access to the free course
- Nominate someone to exercise these rights on your behalf if you die or become incapacitated
- Complain to us, and then to the Data Protection Board of India
To exercise any of these, email rohan@infivelines.com, or write to the Grievance Officer at Contact and Grievance Redressal. We answer within 48 hours and resolve within 30 days.
Deleting your account
Email rohan@infivelines.com from the address the account uses, asking for deletion. We will delete the account and its data within 30 days and confirm when it is done. A self-service delete button is being built; until it exists, this email route is the mechanism, and it is honoured.
Deleting your account does not clear your reading progress, because that lives in your browser and we cannot reach it. Clear your browser's site data to remove it.
Age
Accounts are for people aged 18 and over. The DPDP Act treats everyone under 18 as a child and requires verifiable parental consent before their data may be processed, which we do not currently collect, so we do not knowingly create accounts for under-18 readers. This costs a younger reader nothing: the entire course is free and needs no account. If you believe a child has created an account, email rohan@infivelines.com and we will delete it.
Readers outside India
The site is operated from India and your data is processed here and in the regions named above. If you are in the European Economic Area or the United Kingdom, we rely on your consent as the lawful basis for holding your account data, and on our processors' standard contractual clauses for the transfer.
Changes
If this policy changes materially, we will update the date at the top and, for account holders, say so by email before the change takes effect.
Grievances
Our Grievance Officer under rule 5(9) of the IT (SPDI) Rules, 2011:
- In Five Lines, Grievance Officer
- Email: rohan@infivelines.com
- Post: Pune, Maharashtra, India
- Hours: Monday to Friday, 10:00 to 18:00 IST
Complaints are acknowledged within 48 hours and resolved within 30 days. Full detail at Contact and Grievance Redressal.