PRIVACY.md

# ControlMT — Privacy & Data Collection

ControlMT v2.3 runs as a downloadable model AND as a hosted demo at
[anandkaman/controlmt-demo](https://huggingface.co/spaces/anandkaman/controlmt-demo).

This document covers what the hosted demo collects, when, and how it's used.
**The downloadable model itself collects nothing** — it's a local Apache 2.0 binary.

---

## TL;DR

| | |
|---|---|
| **Default state** | A clearly-visible **checkbox inside the Settings panel** controls whether each translation is logged. Default state is **checked (on)**. |
| **Opt-out mechanism** | Uncheck the "*Share this translation for v2.4 research*" box in the Settings panel before pressing Translate. When unchecked, nothing is logged. |
| **What's logged when opted in** | Your input text, the model's output, direction, beam size, latency, timestamp |
| **What's NOT logged** | IP address, user agent, HF username, session ID, geolocation, any identifier |
| **PII protection** | Inputs and outputs are **automatically regex-redacted** for PAN, Aadhar, phone numbers, emails, and card numbers before storage |
| **Destination** | A **private** HuggingFace dataset (`anandkaman/controlmt-translations`) accessible only to the model author |
| **Retention** | 6 months from collection, then deleted |
| **Purpose** | Identifying edge cases for v2.4 training improvements |

---

## What we log when you opt in

When the checkbox is checked and you press Translate, one row is buffered:

```json
{
  "ts": "2026-06-23T19:42:18Z",
  "direction": "kn2en",
  "beam": 2,
  "input": "<your input — after PII redaction>",
  "output": "<the translation — after PII redaction>",
  "latency_s": 8.3,
  "status": "ok",
  "src_length": 47
}
```

Rows are batched in memory and uploaded to the private dataset every 10 rows
or every 90 seconds — whichever comes first.

## PII redaction (always on, even with opt-in)

Before any logging, the following patterns are stripped from both input and output:

| Pattern | Example match | Replaced with |
|---|---|---|
| Indian PAN (5 letters + 4 digits + 1 letter) | `ABCDE1234F` | `[PAN_REDACTED]` |
| Aadhar (12 digits, Latin or Kannada numerals) | `1234 5678 9012` or `೧೨೩೪ ೫೬೭೮ ೯೦೧೨` | `[AADHAR_REDACTED]` |
| Indian mobile (+91 / 10-digit starting 6-9) | `+91 98765 43210` | `[PHONE_REDACTED]` |
| Email | `user@example.com` | `[EMAIL_REDACTED]` |
| Card number (13-19 digits in 4-group format) | `4111 1111 1111 1111` | `[CARD_REDACTED]` |

The regex coverage is best-effort. **For high-sensitivity production use, do not rely on the
hosted demo for any data classified as PII** — run the model locally instead
(see [DEPLOYMENT.md](DEPLOYMENT.md)).

## What we explicitly do NOT log

- IP addresses (HuggingFace Spaces does receive them at the network layer but our
  application code never reads or stores them)
- User-Agent strings
- HuggingFace usernames / OAuth tokens
- Browser fingerprints
- Geolocation
- Session or tracking cookies
- The order in which your translations occurred (timestamps are recorded but rows
  are not session-linked)

## Why we collect it

v2.3 is a 139M-parameter model with known weak spots (modern tech jargon, idioms,
regional dialects). v2.4's training data will be augmented based on the categories
of inputs that trip up v2.3 most often. Opt-in user contributions are the most
realistic source of those edge cases.

When v2.4 ships, we may publish a **deduplicated, further-PII-stripped subset** of
the collected dataset under CC-BY-4.0 so other Indic-MT researchers can reproduce
our augmentation work. We will not include rows where the redaction would have
left meaningful identifiable content — those are dropped, not published.

## Retention

Raw collected rows are kept for **6 months** from the date of collection. After
that they are deleted from the private dataset.

Any publicly released subset (if produced for the v2.4 release) is released under
CC-BY-4.0 and is permanent.

## Your rights

You can request deletion of rows you submitted by emailing the model author
(see Citation in the [model card](README.md)) with a reasonable description of
when and what you submitted. Because we don't link rows to user identifiers,
we can't always find your specific rows — best-effort applies.

You can also simply **uncheck the box** in the Settings panel before pressing
Translate. When unchecked, nothing is stored anywhere — translation works
exactly the same way.

## Legal basis (India: DPDPA-2023; EU: GDPR Article 6(1)(a))

Collection is based on **informed consent** captured via the prominently-placed
share toggle in the Settings panel, displayed alongside this disclosure and the
PRIVACY.md link before each translate action. The default state is "share on",
which is clearly visible to the user and easily togglable off in a single click.

## Changes to this policy

Any change to what is collected, how, or for how long will be reflected in this
file with a dated note below.

| Date | Change |
|---|---|
| 2026-06-23 | Initial policy published with v2.3 demo launch |