PRIVACY.md

ControlMT — Privacy & Data Collection

ControlMT v2.3 runs as a downloadable model AND as a hosted demo at anandkaman/controlmt-demo.

This document covers what the hosted demo collects, when, and how it's used. The downloadable model itself collects nothing — it's a local Apache 2.0 binary.

---

TL;DR

Default state	A clearly-visible checkbox inside the Settings panel controls whether each translation is logged. Default state is checked (on).
Opt-out mechanism	Uncheck the "Share this translation for v2.4 research" box in the Settings panel before pressing Translate. When unchecked, nothing is logged.
What's logged when opted in	Your input text, the model's output, direction, beam size, latency, timestamp
What's NOT logged	IP address, user agent, HF username, session ID, geolocation, any identifier
PII protection	Inputs and outputs are automatically regex-redacted for PAN, Aadhar, phone numbers, emails, and card numbers before storage
Destination	A private HuggingFace dataset (anandkaman/controlmt-translations) accessible only to the model author
Retention	6 months from collection, then deleted
Purpose	Identifying edge cases for v2.4 training improvements

---

What we log when you opt in

When the checkbox is checked and you press Translate, one row is buffered:

{
  "ts": "2026-06-23T19:42:18Z",
  "direction": "kn2en",
  "beam": 2,
  "input": "<your input — after PII redaction>",
  "output": "<the translation — after PII redaction>",
  "latency_s": 8.3,
  "status": "ok",
  "src_length": 47
}

Rows are batched in memory and uploaded to the private dataset every 10 rows or every 90 seconds — whichever comes first.

PII redaction (always on, even with opt-in)

Before any logging, the following patterns are stripped from both input and output:

Pattern	Example match	Replaced with
Indian PAN (5 letters + 4 digits + 1 letter)	ABCDE1234F	[PAN_REDACTED]
Aadhar (12 digits, Latin or Kannada numerals)	1234 5678 9012 or ೧೨೩೪ ೫೬೭೮ ೯೦೧೨	[AADHAR_REDACTED]
Indian mobile (+91 / 10-digit starting 6-9)	+91 98765 43210	[PHONE_REDACTED]
Email	user@example.com	[EMAIL_REDACTED]
Card number (13-19 digits in 4-group format)	4111 1111 1111 1111	[CARD_REDACTED]

The regex coverage is best-effort. For high-sensitivity production use, do not rely on the hosted demo for any data classified as PII — run the model locally instead (see DEPLOYMENT.md).

What we explicitly do NOT log

• IP addresses (HuggingFace Spaces does receive them at the network layer but our application code never reads or stores them)
• User-Agent strings
• HuggingFace usernames / OAuth tokens
• Browser fingerprints
• Geolocation
• Session or tracking cookies
• The order in which your translations occurred (timestamps are recorded but rows are not session-linked)

Why we collect it

v2.3 is a 139M-parameter model with known weak spots (modern tech jargon, idioms, regional dialects). v2.4's training data will be augmented based on the categories of inputs that trip up v2.3 most often. Opt-in user contributions are the most realistic source of those edge cases.

When v2.4 ships, we may publish a deduplicated, further-PII-stripped subset of the collected dataset under CC-BY-4.0 so other Indic-MT researchers can reproduce our augmentation work. We will not include rows where the redaction would have left meaningful identifiable content — those are dropped, not published.

Retention

Raw collected rows are kept for 6 months from the date of collection. After that they are deleted from the private dataset.

Any publicly released subset (if produced for the v2.4 release) is released under CC-BY-4.0 and is permanent.

Your rights

You can request deletion of rows you submitted by emailing the model author (see Citation in the model card) with a reasonable description of when and what you submitted. Because we don't link rows to user identifiers, we can't always find your specific rows — best-effort applies.

You can also simply uncheck the box in the Settings panel before pressing Translate. When unchecked, nothing is stored anywhere — translation works exactly the same way.

Legal basis (India: DPDPA-2023; EU: GDPR Article 6(1)(a))

Collection is based on informed consent captured via the prominently-placed share toggle in the Settings panel, displayed alongside this disclosure and the PRIVACY.md link before each translate action. The default state is "share on", which is clearly visible to the user and easily togglable off in a single click.

Changes to this policy

Any change to what is collected, how, or for how long will be reflected in this file with a dated note below.

Date	Change
2026-06-23	Initial policy published with v2.3 demo launch