Privacy Policy

1. Introduction

This Privacy Policy ("Policy") governs the collection, use, processing, storage, disclosure, and protection of personal data by Carpe Diem India ("we," "us," "our," or "Data Fiduciary") in relation to the mobile application My Goals Planner ("Application" or "App").

The Application is developed and maintained by SDK Infinity Technologies ("Technology Service Provider" or "Data Processor"), acting on behalf of Carpe Diem India.

This Policy is issued in compliance with:

• The Digital Personal Data Protection Act, 2023 ("DPDP Act")
• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• Google Play User Data Policy (2026)
• Apple App Store Privacy Guidelines (2026)

By creating an account, accessing, or using the Application, you ("User," "you," "your," or "Data Principal") acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

2. Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed to them below:

• Data Principal: An individual to whom personal data relates, including users of the Application.
• Data Fiduciary: Carpe Diem India, the entity that determines the purpose and means of processing personal data.
• Data Processor: SDK Infinity Technologies, the entity that processes personal data on behalf of the Data Fiduciary.
• Personal Data: Any data that relates to an individual who is identifiable by or in relation to such data.
• Sensitive Personal Data or Information (SPDI): Personal data consisting of information relating to passwords, financial information, health information, biometric information, or any other category specified under the SPDI Rules.
• Processing: Any operation or set of operations performed on personal data, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, or erasure.

3. Scope of this Policy

This Privacy Policy applies to:

• All users of the My Goals Planner mobile application;
• Personal data collected, processed, and stored through the Application;
• Services provided by Carpe Diem India through the Application;
• Data processing activities conducted by SDK Infinity Technologies as Data Processor.

This Policy does not apply to third-party websites, applications, or services that may be linked from the Application.

4. Nature of the Application

My Goals Planner is a goal planning and productivity mobile application that enables users to:

• Create secure user accounts with username and password authentication;
• Log in to the Application using registered credentials;
• Create, edit, manage, and delete personal goals;
• Store goal-related information on secure backend servers;
• Receive reminder notifications for goal tracking and updates;
• Track progress and receive service-related notifications.

The Application stores user account data and user-generated content on secure backend infrastructure operated by the Technology Service Provider on behalf of the Data Fiduciary.

5. Categories of Personal Data Collected

The Application collects and processes the following categories of personal data:

5.1 Account Information

• Username
• Email address
• Password (stored in encrypted and hashed form only)
• Account preferences and settings

5.2 User-Generated Content

• Goals created by users
• Goal descriptions and details
• Progress data and updates
• Reminder schedules and preferences

5.3 Technical Information

• Device information (model, operating system version, device identifiers)
• IP address
• Application usage logs
• Notification tokens for push notification delivery

Important Clarifications:

• User passwords are never stored in plain text. All passwords are securely encrypted and hashed using industry-standard cryptographic algorithms before storage.
• The Application does not collect biometric data, financial information, health information, or precise geolocation data.
• Data is processed solely to provide core application functionality and is not used for advertising purposes.
• Personal data is not sold or shared for commercial marketing purposes.

6. Purpose of Processing Personal Data

Personal data is collected and processed for the following lawful purposes:

• Account Creation and Management: To enable users to create, access, and manage their accounts;
• Authentication and Security: To verify user identity and secure account access through encrypted credential storage;
• Service Delivery: To provide goal planning, tracking, and management functionality;
• Notification Services: To send goal reminders, progress updates, and service-related notifications;
• Data Storage and Retrieval: To securely store and retrieve user-generated content and account information;
• Application Performance and Analytics: To monitor, analyze, and improve application performance and user experience;
• Technical Support: To respond to user inquiries and provide technical assistance;
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.

Personal data is not processed for:

• Cross-app tracking or behavioral advertising;
• Sale to third parties for commercial purposes;
• Profiling for marketing purposes;
• Any purpose unrelated to the core functionality of the Application.

7. Legal Basis for Processing

The legal basis for processing personal data under this Policy is:

• Consent: By creating an account and using the Application, you provide explicit, informed, and voluntary consent for the processing of your personal data in accordance with the DPDP Act, 2023.
• Contractual Necessity: Processing is necessary for the performance of the contract between you and Carpe Diem India for the provision of Application services.
• Legitimate Interest: Processing is necessary for the legitimate interests of ensuring application security, preventing fraud, and improving service quality, provided such interests do not override your fundamental rights.

8. Permissions Requested by the Application

The Application requests only the following permission from your device:

8.1 Notification Permission

This permission is used solely for:

• Sending goal reminders to help you track your objectives;
• Sending application-related updates and announcements;
• Delivering service notifications regarding your account and goals.

User Control: You may disable notifications at any time through your device settings. Disabling notifications will not affect your ability to use core application features.

8.2 Permissions NOT Requested

The Application does NOT request or access the following permissions:

• Camera or photo library access
• Microphone or audio recording
• Precise location or GPS data
• Device storage or media files (beyond app-specific storage)
• Contacts or calendar access
• SMS or telephony functions

9. Account and Credential Security

The security and confidentiality of user credentials are of paramount importance to us. The following measures are implemented:

• Password Encryption: All user passwords are encrypted using industry-standard cryptographic hashing algorithms (such as bcrypt or Argon2) before storage. Passwords are never stored in plain text.
• Secure Transmission: All data transmitted between your device and our servers is encrypted using Transport Layer Security (TLS) protocols.
• Access Controls: Access to backend systems containing user data is restricted to authorized personnel only, with role-based access controls.
• Regular Security Audits: Our systems undergo periodic security assessments and vulnerability testing.

User Responsibility: You are responsible for maintaining the confidentiality of your account credentials. You must immediately notify us of any unauthorized access or security breach.

10. Notification Data Processing

When you grant notification permission, the Application processes the following data:

• Device notification token (a unique identifier assigned by your device's operating system);
• Notification delivery status;
• User interaction with notifications (e.g., opened, dismissed).

Purpose Limitation: Notification tokens are used exclusively for delivering push notifications related to the Application's core functionality. They are not shared with third-party advertising networks or used for cross-app tracking.

Data Retention: Notification tokens are retained only for the duration of your active account. Upon account deletion or opt-out from notifications, tokens are permanently removed from our systems.

11. Data Sharing and Disclosure

We do not sell, rent, or lease your personal data to third parties for commercial purposes. Your personal data may be shared only in the following limited circumstances:

11.1 With the Data Processor

SDK Infinity Technologies acts as the Data Processor and processes personal data on behalf of Carpe Diem India for the purposes outlined in this Policy. SDK Infinity Technologies is contractually bound to:

• Process data only in accordance with our instructions;
• Implement appropriate technical and organizational security measures;
• Not use personal data for any purpose other than providing services to the Data Fiduciary;
• Ensure compliance with applicable data protection laws.

11.2 With Third-Party Service Providers

We may engage trusted third-party service providers for the following purposes:

• Cloud hosting and infrastructure services;
• Push notification delivery services;
• Application performance monitoring and analytics.

All third-party service providers are carefully vetted and contractually obligated to maintain data confidentiality and security standards consistent with this Policy.

11.3 Legal and Regulatory Compliance

We may disclose personal data when required to do so by law, court order, or governmental authority, or when necessary to:

• Comply with legal obligations;
• Protect and defend our legal rights or property;
• Prevent fraud or other illegal activities;
• Protect the safety of users or the public.

11.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, personal data may be transferred to the acquiring entity, subject to the same protections outlined in this Policy.

12. Cross-App Tracking

The Application does NOT engage in cross-app tracking. We do not:

• Track your activities across third-party applications or websites;
• Use third-party advertising SDKs or tracking technologies;
• Share your personal data with advertising networks for behavioral advertising;
• Create user profiles for marketing purposes based on cross-app activity.

This Application is designed solely to provide goal planning and productivity services and does not engage in any form of cross-contextual behavioral advertising.

13. Data Retention Policy

Personal data is retained only for as long as necessary to fulfill the purposes outlined in this Policy, or as required by applicable law.

13.1 Account Data

Account information and user-generated content are retained for the duration of your active account. Upon account deletion, data is permanently erased within 30 days, except where retention is required by law.

13.2 Technical Logs

Technical logs and usage data are retained for a maximum of 90 days for security and operational purposes, after which they are automatically deleted.

13.3 Legal Retention Requirements

Certain data may be retained for longer periods to comply with legal, regulatory, tax, or accounting requirements, or to resolve disputes and enforce agreements.

14. Security Safeguards

We implement industry-standard technical and organizational measures to protect personal data from unauthorized access, disclosure, alteration, or destruction:

• Encryption: Data is encrypted in transit (using TLS) and at rest (using AES-256 encryption);
• Access Controls: Role-based access controls and multi-factor authentication for administrative access;
• Firewalls and Intrusion Detection: Network security measures to prevent unauthorized access;
• Regular Backups: Automated backups with secure, encrypted storage;
• Security Audits: Periodic security assessments, vulnerability scans, and penetration testing;
• Employee Training: Regular training for personnel handling personal data on security best practices and data protection obligations.

While we strive to protect personal data, no security system is impenetrable. Users are advised to use strong passwords and safeguard their account credentials.

15. Cross-Border Data Transfers

Your personal data is primarily stored and processed on servers located in India. In certain circumstances, data may be transferred to or accessed from jurisdictions outside India for the following purposes:

• Cloud infrastructure services (subject to data localization compliance);
• Technical support and maintenance.

Where personal data is transferred outside India, we ensure that:

• Such transfers comply with the requirements of the DPDP Act, 2023;
• Appropriate contractual safeguards (such as Standard Contractual Clauses) are in place;
• The receiving jurisdiction provides an adequate level of data protection.

16. Rights of Data Principals under the DPDP Act, 2023

As a Data Principal, you have the following rights under the Digital Personal Data Protection Act, 2023:

16.1 Right to Access

You have the right to obtain a summary of personal data being processed and information about the processing activities.

16.2 Right to Correction

You have the right to request correction of inaccurate, incomplete, or outdated personal data.

16.3 Right to Erasure

You have the right to request deletion of your personal data where:

• The purpose of processing has been fulfilled;
• Consent has been withdrawn;
• Retention is no longer necessary for legal compliance.

16.4 Right to Nominate

You have the right to nominate another individual to exercise your rights in the event of your death or incapacity.

16.5 Right to Grievance Redressal

You have the right to file a complaint regarding the processing of your personal data with our Grievance Officer or the Data Protection Board of India.

Exercising Your Rights: To exercise any of these rights, please contact our Grievance Officer at the contact details provided in Section 23.

17. Withdrawal of Consent

You have the right to withdraw your consent at any time for the processing of your personal data. Withdrawal of consent may be effected by:

• Deleting your account through the Application settings;
• Sending a written request to our Grievance Officer;
• Disabling specific permissions (such as notifications) through your device settings.

Consequences of Withdrawal: Withdrawal of consent may result in the inability to access certain features or services of the Application. Upon withdrawal of consent and account deletion, your personal data will be permanently erased within 30 days, except where retention is required by law.

18. Account Deletion and Data Erasure Process

You may request deletion of your account and associated personal data at any time through the following process:

1. In-App Deletion: Navigate to Account Settings > Delete Account, and follow the on-screen instructions;
2. Email Request: Send an account deletion request to goalsplanner.sdk@gmail.com with your registered email address and username;
3. Verification: For security purposes, we may request identity verification before processing the deletion request;
4. Deletion Timeline: Upon verification, your account and all associated personal data will be permanently deleted within 30 days.

Post-Deletion: After deletion, your data cannot be recovered. Certain anonymized or aggregated data that does not identify you personally may be retained for statistical or analytical purposes.

19. Children's Privacy

The Application is intended for users aged 13 years and above. We do not knowingly collect personal data from children under the age of 13 without verifiable parental consent.

If we become aware that we have inadvertently collected personal data from a child under 13 without appropriate consent, we will take immediate steps to delete such data from our systems.

Parental Rights: Parents or legal guardians may contact us to:

• Review personal data collected from their child;
• Request deletion of such data;
• Refuse further collection or use of their child's personal data.

20. Grievance Redressal Mechanism

In accordance with the DPDP Act, 2023, and the IT Act, 2000, we have appointed a Grievance Officer to address complaints and grievances related to personal data processing.

Complaint Procedure:

1. Submit your complaint in writing to the Grievance Officer via email;
2. Include your name, contact information, and a detailed description of your grievance;
3. The Grievance Officer will acknowledge receipt of your complaint within 48 hours;
4. Your complaint will be resolved within 30 days from the date of receipt.

If you are not satisfied with the resolution, you may escalate your complaint to the Data Protection Board of India as established under the DPDP Act, 2023.

21. Google Play Store Compliance Statement

This Application complies with the Google Play User Data Policy (2026). Specifically:

• We collect only the minimum personal data necessary to provide core application functionality;
• Personal data is used solely for purposes disclosed in this Privacy Policy;
• We do not sell personal data to third parties;
• We do not use personal data for advertising purposes;
• All data collection and usage practices are transparently disclosed to users;
• Users have the ability to access, correct, and delete their personal data;
• Data is transmitted securely using encryption;
• We do not request permissions that are not essential for core functionality;
• We comply with all relevant data protection regulations in India.

22. Apple App Store Privacy Compliance Statement

This Application complies with the Apple App Store Privacy Guidelines (2026). Specifically:

• We have provided a clear and comprehensive privacy policy accessible to users;
• We request only the permissions necessary for core application functionality;
• We do not access user data without explicit permission;
• We do not engage in cross-app tracking or data sharing with third-party advertisers;
• All data collection practices are disclosed prior to collection;
• Users have the ability to delete their account and associated data;
• We implement appropriate security measures to protect user data;
• We comply with data minimization principles and purpose limitation;
• We respect user privacy rights as outlined in applicable laws.

The Application's privacy nutrition label on the App Store accurately reflects our data collection and usage practices as described in this Policy.

23. Changes to this Privacy Policy

We reserve the right to modify or update this Privacy Policy at any time to reflect changes in our practices, legal requirements, or technological advancements.

Notification of Changes:

• Material changes to this Policy will be communicated to users via email or in-app notification;
• The "Last Updated" date at the top of this Policy will be revised to reflect the date of the most recent changes;
• Continued use of the Application after notification of changes constitutes acceptance of the updated Policy.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

24. Contact Information

For questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, please contact:

25. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of India. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Chennai, Tamil Nadu, India.

26. Acknowledgment and Acceptance

By creating an account and using the My Goals Planner Application, you acknowledge that:

• You have read and understood this Privacy Policy in its entirety;
• You consent to the collection, use, processing, storage, and disclosure of your personal data as described herein;
• You understand your rights as a Data Principal under the DPDP Act, 2023, and other applicable laws;
• You have the right to withdraw your consent and delete your account at any time.