Privacy Policy

1. Who we are

Koomo is run by Sanket Panchal, an individual based in Gandhinagar, Gujarat, India ("Koomo", "we", "us"). For your personal data, Koomo is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (DPDP Act). You can reach us at [email protected].

2. What we collect

When you create an account

• Your email address, the name you want to be called, and your password (stored only as a one-way hash we can't read).
• Your time zone, so reminders and days line up with your clock.
• The version of our Terms you agreed to, and when.
• If you log in with Google: your name, email address and your Google account's ID, from Google. We don't receive your Google password, and we never post anything to your Google account.

What you create and do in Koomo

• Your profile: username, bio and picture, and whether your account is private.
• Your commitments (goals, habits and challenges), daily check-ins, notes, reflections, pauses and wrap-ups.
• Posts, replies, reactions, mentions, nudges, circles you create or join, and who you follow, block or mute.
• Points you earn and coupons you redeem.
• Support requests and reports you send us, including any attachment.
• Your settings: reminder time, quiet hours, email choices and theme.

Collected automatically

• Sign-in details: the browser you use, a scrambled (hashed) form of your internet address and of your device, so we can keep you signed in, show your active sessions and warn you about a login from a new device.
• Security records: failed logins, blocked attempts and alerts, so we can stop people breaking into accounts.
• Usage events: which screens and features are used, recorded by Koomo itself. We don't use outside analytics or advertising trackers.
• When you send a protected form (sign-up, login, password reset, support, early access), Google reCAPTCHA receives information about your browser and how the form was used, to tell people from bots. Google'sPrivacy Policy andTerms apply to that check.

On the website

• If you join the early-access list: your name, email, focus area, what you want to change, country, how you heard about us, any invite reference, your consent and when you gave it, plus the page you came from and campaign tags in the link.

Cookies and browser storage

We use only what Koomo needs to work: a secure cookie that keeps you signed in, and your browser's storage to remember your light or dark choice. We also use Google Analytics and Microsoft Clarity to see how people use Koomo (pages visited, clicks, scrolling, anonymised session recordings). They set analytics cookies. We do not use advertising cookies, and Clarity masks what you type.

3. Why we use it

• To run your account and the features you use: commitments, check-ins, reminders, circles, posts, points and coupons.
• To send emails you need (verification, password reset, security alerts) and the ones you choose (reminders, updates).
• To keep Koomo safe: preventing fraud, spam, abuse and break-ins, and enforcing our Terms and Community Guidelines.
• To answer your support requests and reports.
• To understand which parts of Koomo help people, and improve them.
• To meet our legal obligations.

We process your data on the basis of the consent you give when you create an account or join the early-access list, and for the legitimate uses the DPDP Act allows, such as meeting a legal obligation. You can withdraw consent at any time (see section 8); that won't affect what was done before, but we won't be able to keep running your account.

4. Who can see your information

• Other Koomo users see what you choose to share. With a public account, your profile, public commitments and posts can be seen by other users. With a private account, only people you approve can. Circle members see that circle's activity. Your private notes and the reasons you give for a missed day are never shown to anyone else.
• Koomo's admin (the owner) can see account and support details when needed to run and protect the service.
• Service providers process data for us only to run Koomo (section 5).
• Authorities, when Indian law requires us to share it, such as a valid order from a court or government agency.

We don't sell your personal data, and we don't share it for advertising.

5. Service providers and where your data is stored

The Koomo database and app server are in Singapore. Some providers below store or process data in other countries; we transfer data abroad only as the DPDP Act permits, and only to providers who need it to run Koomo.

6. How long we keep it

When an account is erased, we remove your email, password, profile, settings, devices, sessions, notes, reflections and the text of your posts, and your connections to other people. A few records stay without your email address, because we need them: an anonymous placeholder so other people's replies and circles still make sense, the points history (it can't be changed, to keep points fair), security events and the admin audit log for their periods above, and support tickets we may still need to answer a complaint.

7. Children

Koomo has no minimum age: anyone can set a goal. If you're under 18, please use Koomo with your parent or guardian's knowledge. We don't show advertising, and we don't track children's behaviour for advertising. A parent or guardian can ask us to delete a child's account by emailing [email protected] from the account's email address or with enough detail for us to find it.

8. Your rights

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you and how we use it, and who we've shared it with.
• Correct, complete or update it. Most of it you can change yourself in Settings.
• Delete your account in Settings, or ask us to erase your data. Deletion takes effect after 14 days, so you can change your mind. How to delete your data has the steps, including for Google logins.
• Withdraw your consent at any time, as easily as you gave it.
• Choose emails: reminders and other optional app emails can be turned off in Settings. Early-access emails from the website have an unsubscribe link.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Raise a grievance with us (section 10), and then with the Data Protection Board of India.

Email [email protected] from your account's email address. We'll confirm we've received your request and respond within the time the law sets.

9. How we protect it

• Everything travels over encrypted connections. Passwords are stored as one-way hashes.
• Coupon codes and the admin's sign-in secrets are encrypted in the database. Backups are encrypted.
• The admin account requires a password and an authenticator-app code.
• Forms are protected against bots and repeated guessing.

No system is perfectly secure. If a breach affects your personal data, we'll tell you and the Data Protection Board of India as the law requires.

10. Grievance Officer

If you have a complaint about your personal data, or about content on Koomo, contact our Grievance Officer:

• Name: Sanket Panchal
• Email: [email protected]
• Location: Gandhinagar, Gujarat, India

We'll acknowledge your complaint within 24 hours and resolve it within 15 days, as the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require. If you're not satisfied, you can approach the Data Protection Board of India.

11. Changes to this policy

If we change this policy, we'll update the date at the top. If the change is significant, we'll also tell you by email or in the app before it takes effect.