Law-Enforcement and Government Request Guidelines

Effective date: 16 August 2026

Last updated: 16 August 2026

Version: 3.0

These guidelines explain how authorized authorities may request information, preservation, or content action from Hudood.

1. Contact

Send legal process to legal@hudood.com with the subject Law-Enforcement Request.

• Correspondence address: HD-706, WeWork, Vaswani Chambers, Prabhadevi Road, Government Colony, Mumbai, Maharashtra 400051, India
• Telephone: +91 88288 88664

Email is the fastest route. Submission does not waive any objection to jurisdiction, validity, service, scope, or legality.

2. Required information

A request should:

• identify the requesting agency, officer, official contact information, and authority;
• be signed and dated and cite the legal basis;
• clearly state the purpose and the records, account, URL, or content sought;
• specify the applicable time period and response deadline;
• state any non-disclosure requirement and its legal basis; and
• use an official government email domain where available.

Hudood may seek clarification, narrow an overbroad request, verify authenticity, or challenge a request that is invalid, disproportionate, technically impossible, or inconsistent with law.

3. Content-removal orders

Under Rule 3(1)(d) of India's IT Rules, qualifying actual knowledge arises from an order of a competent court or a properly authorized, reasoned government intimation that identifies the legal basis, unlawful act, and specific electronic location. Hudood will remove or disable access within 3 hours of receiving qualifying actual knowledge.

A user complaint is handled through the Grievance Redressal Policy; it is not automatically treated as a government order.

4. Information and assistance requests

For a written order from a government agency lawfully authorized for investigative, protective, or cyber-security activity, Hudood will provide information under its control or assistance as soon as possible and no later than 72 hours, as required by Rule 3(1)(j), unless another lawful deadline applies.

Hudood can provide only data it actually holds. Hudood does not create new records, break encryption it does not control, or provide another provider's records.

4.1 What Hudood holds, and what it does not

Stating this up front saves a round trip on every request that asks for something that does not exist. "We do not collect it" is a complete answer, and it is a stronger one than declining to provide it.

Hudood holds:

• account records - the registered email address, display name, username, and the dates the account was created, deactivated or cancelled
• content the account published: posts, reels, comments, captions and uploaded media, with timestamps
• direct message content and timestamps, and who the participants were
• reports made by or about the account, and the moderation decisions taken
• IP address records, stored hashed and encrypted, never in plain text, with the country derived at our network edge
• device platform and app version as reported by the app
• a mobile number only where the account holder supplied one. The current sign-up flows do not ask for one and the platform uses neither SMS nor phone-number sign-in, but the legacy finance-hub registration accepted an optional number and those records persist. Assume nothing either way: ask, and we will say whether that account has one

Hudood does not hold, and therefore cannot provide:

• GPS or any precise location. The app requests no location permission and stores no coordinates. Country is the finest geographic granularity that exists in our records, and it is derived from the IP address rather than collected from the device
• date of birth or gender - age is confirmed as 18 or over at sign-up and the date itself is not stored
• contact lists, address books or call logs
• browsing history outside Hudood, and no search history within it
• payment instruments or card details. The launch carries no purchase path, and any future purchase runs through the app stores, whose records are theirs and not ours
• passwords in any readable form. Authentication is delegated, and no plaintext password exists to disclose

An IP record can be decrypted only for a request that has been verified under section 2, by a named officer holding the legal role, and every such decryption is logged with a hash of what was produced. There is no general-purpose view of IP addresses in the moderation tools, deliberately: reading one is meant to be an event.

5. Preservation

A preservation request must identify the account or content and the legal authority and duration. Removed or disabled content and associated records are preserved for 180 days for investigation under Rule 3(1)(h), or longer where a competent court or lawfully authorized government agency requires it. Registration information is separately retained for 180 days after an account is cancelled or withdrawn, under Rule 3(1)(g). Other preservation is bounded to the request and applicable law.

6. Emergencies

For an imminent risk of death, serious physical injury, or child sexual abuse, use the subject Emergency Disclosure Request and describe the emergency, the person at risk, the requested data, and why ordinary process is inadequate. Hudood may make a limited emergency disclosure where lawful and necessary. Emergency disclosure does not replace formal process for non-urgent or continuing access.

7. User notice and confidentiality

Hudood may notify the affected user before or after disclosure unless prohibited by law, the request would be compromised, or notice would create a safety risk. Non-disclosure requests must state their legal basis and duration. Hudood may later notify the user when the restriction expires or is withdrawn.

8. Cost, format, and authenticity

Hudood may seek reimbursement where law permits for unusually burdensome production. Records may be produced electronically with a custodian declaration where appropriate. Authorities should independently verify that a message claiming to come from Hudood uses a channel confirmed through https://hudood.com.