WrindhaOS Privacy Policy

1. Introduction

This Privacy Policy explains how WrindhaOS ("we," "us," "our") collects, uses, discloses, and protects information when you use the WrindhaOS mobile application and the wrindhaos.in website (together, the "Service").

This policy is drafted with reference to India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Information Technology Act, 2000 and its associated rules, and Google Play's Developer Program Policies.

2. Information We Collect

2.1 Information you provide

• Account information: Full name, email address, and/or phone number (used for OTP-based sign-in), and optionally a profile image.
• Journal entries: Title, content, mood rating, and entry date, if you use the Journal feature. Journal content is stored encrypted (see Section 6).
• Productivity data you create: Habits, to-dos, Eisenhower/priority-matrix tasks, goals and milestones, subjects/units/topics, study sessions, timetable slots, and calendar events.
• Personal finance data you choose to enter: Expense records, categories, and monthly budget amounts. This is self-reported budgeting data — WrindhaOS does not process real payment transactions on your behalf.
• Support communications: Content of support tickets you raise and any correspondence with our team.
• Consent records: Your acceptance of this Privacy Policy, the Terms & Conditions, the Cookie Policy, and any marketing opt-in, each logged with a policy version, timestamp, IP address, and device/browser user agent.

2.2 Information collected automatically

• Usage and performance data: Daily counts of tasks/habits completed, study duration, focus scores, and similar in-app analytics used to power your own dashboards.
• Device and log data: IP address and user-agent string (captured with consent records and administrative actions), app version, and general diagnostic information.
• Subscription and billing metadata: Plan type, purchase token, order ID, subscription status, and renewal dates, received from Google Play Billing. We do not receive or store your card, UPI, or bank details — these are handled entirely by Google Play.

3. How We Use Your Information

• To create and operate your account and provide the Service's features.
• To sync your data across your devices via our backend.
• To send in-app and push notifications you have enabled (e.g., habit reminders, study reminders, expense alerts), based on your notification settings.
• To provide customer support and respond to grievances.
• To detect misuse, enforce our Acceptable Use Policy, and maintain platform safety (e.g., account suspension for policy violations).
• To generate de-identified, aggregate analytics (e.g., total users, active subscriptions) for product and business planning. Aggregate analytics do not expose your individual private content.
• To comply with legal obligations and respond to lawful requests from authorities.

4. Legal Basis / Consent

We process your personal data on the basis of your consent, provided at sign-up and recorded against the specific version of this Policy, the Terms & Conditions, and the Cookie Policy you accepted. You may withdraw consent at any time by deleting your account, subject to Section 8 (Data Retention).

The table below maps each category of data we process to the lawful basis on which we process it:

5. Who Can See Your Data

WrindhaOS's database enforces owner-only Row-Level Security (RLS) on your personal productivity tables — including your journal, habits, goals, subjects, to-dos, calendar, and study sessions. This means these records are readable only by your authenticated account; our internal administrative roles do not have a standing policy granting them read access to this content.

Our administrative ("backoffice") accounts are limited by role to a defined set of permissions, such as reading account and subscription metadata, reading aggregate analytics, managing support tickets, and managing account status (e.g., suspending an account for a policy violation). These roles do not include a general right to read your journal entries or other private content.

We may share limited data with:

• Google Play: Billing, distribution, and app services — see our Data Processing / Third-Party Services Register.
• Backend infrastructure provider (Supabase): Hosts our database and authentication on our behalf under a data-processing arrangement.
• Law enforcement or regulators: Where required by law, court order, or to protect the rights, safety, or property of our users or the team.
• Successor entity: In the event of a merger, acquisition, or asset sale, subject to equivalent privacy protections.

6. How We Protect Your Data

• AES-256 Journal Encryption: Journal content is encrypted using AES-256 symmetric encryption before storage, with decryption available only through authenticated, server-side functions.
• Row-Level Security: All personal productivity tables are protected by owner-only Row-Level Security policies at the database layer, in addition to standard authentication tokens.
• Encryption in Transit: All data transmitted between your device and our servers is encrypted via TLS/HTTPS.
• Internal Audit Trail: Administrative actions (e.g., account status changes) are logged in an internal audit trail.

See our Security & Data Protection Statement for further technical detail.

7. Children and Minors

WrindhaOS is intended for competitive-exam aspirants, some of whom may be under 18 years of age. Under the DPDP Act, 2023, processing the personal data of a child (under 18) requires verifiable parental or guardian consent.

If you are under 18, you may use WrindhaOS only with the involvement and consent of a parent or legal guardian, who accepts this Privacy Policy and our Terms & Conditions on your behalf. We do not knowingly enable tracking or behavioural advertising directed at children, and we do not knowingly process children's data in a manner likely to cause harm.

8. Data Retention

We retain your personal data for as long as your account is active. When you request account deletion, we process your request under the lifecycle described in our Account Deletion Policy and Data Retention & Deletion Policy, including any limited retention required for legal, tax, fraud-prevention, or dispute-resolution purposes.

9. Your Rights

Subject to applicable law under the DPDP Act, you have the right to:

• Access and export a copy of your personal data.
• Correct inaccurate account information.
• Withdraw consent and request deletion of your account and data.
• Manage notification and communication preferences in-app.
• Lodge a grievance with our Grievance Officer, and thereafter, if unresolved, with the applicable data protection authority.

To exercise any of these rights, please write to us at wrindhaos@gmail.com.

9.1 How Quickly We Respond

*Complex requests (for example, those requiring us to distinguish your data from another user's, or involving a legal hold) may take longer; if so, we will communicate the reason and expected timeline within the initial acknowledgement period.

10. International Data Transfers

Our backend infrastructure may process and store data on servers located outside India, depending on our infrastructure provider's hosting regions. Where this occurs, we require our providers to maintain safeguards consistent with applicable law.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app and/or via the email associated with your account, and the updated version and its effective date will be published at wrindhaos.in/privacy-policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data handling practices, please reach out to: