Privacy Policy

MakeYou is built for reflection, so privacy matters. This policy explains what we collect, why, and the control you have. We do not sell your data and we do not show ads.

What we collect

• Account: your name, email and a securely hashed password (we never store it in plain text). You must be 18 or older to use MakeYou; it is not directed at children.
• Profile (optional): a profile photo and a mobile number, only if you add them. The number is used only to help you recover your account, never for sign-in codes or marketing; remove either at any time in Profile.
• Google or Apple sign-in: if you choose it, your name, email and an account identifier from Google or Apple. We never receive your Google or Apple password.
• What you create: identities, habits, votes, reflections, journal entries, notes, books, quotes, the activities you log (type, date, duration, and any distance, calories or notes you add) and settings. Logged activities are stored only to show you your own progress; they are never shared and never used for ads.
• Devices: the browser and device type of each signed-in device, so you can see and sign out your devices.
• Notifications: if you turn on push notifications, a push address for your device and your time zone.
• Payments: the plan, amount, date and payment IDs. Card, UPI and bank details are handled by our licensed payment processor, never by us.
• Security logs: sign-ins, failed sign-ins and important account actions.
• Crash reports: if the app hits an error, it sends a short error message and stack trace, the screen name, app version and platform (and your account id if you are signed in) so we can fix it. No habit content is included. These reports are kept for up to 180 days, then deleted, and are deleted with your account if they are linked to it.
• IP addresses: used only for rate limiting and security (to stop password guessing and abuse). We store them only as a one-way hash, never in readable form, and never for advertising or profiling.
• Face ID / fingerprint app lock: if you turn it on, unlocking is done by your phone’s own biometric system, on your device only. We never receive or store your face or fingerprint data.

We show no ads, use no third-party analytics or advertising trackers, and never sell your data. Product statistics (for example, how many members cast a vote this week) are calculated from the data above and never shared.

How we use it

Only to run MakeYou for you: showing your progress, sending the reminders and emails you ask for (verification codes, password resets, receipts, security alerts), processing payments, keeping the service secure, and replying when you contact us. We rely on your consent, given when you create your account, and you can withdraw it at any time by deleting your account.

Who processes it, and where

• Supabase: our database, with your data stored in Mumbai, India.
• Vercel: hosting of the website and servers, in the Mumbai region.
• Resend: sends our emails (verification codes, password resets, receipts, security alerts), so it processes your email address.
• RevenueCat: receives your MakeYou account id and the store’s purchase records so your Plus subscription status works on every device.
• Razorpay: processes web payments. Card, UPI and bank details go to Razorpay, never to us.
• Apple and Google: sign-in (only if you choose it), in-app purchases through the App Store and Google Play, and push notifications through APNs (Apple) and FCM (Google).

Some processors may process limited data outside India, as permitted under the Digital Personal Data Protection Act, 2023.

Each provider acts on our behalf, under contract and its own security standards, and only as needed to run MakeYou. We do not sell your data or share it for advertising.

How long we keep it

• Your account and content: until you delete your account.
• Security logs and crash reports: 180 days.
• Verification codes and password-reset links: deleted after they expire (within 30 days).
• Payment records: 8 years, as Indian tax law requires.
• Backups: overwritten within 30 days.

Cookies and device storage

We use one essential cookie to keep you signed in, and a short-lived (10 minute) security cookie while you sign in with Google or Apple. The app also keeps a copy of your recent data on your device so it opens fast and works offline; your journal and reflections are not stored this way, and everything is cleared when you log out. No tracking or advertising cookies.

Your rights

• Access and portability: export everything at any time from You → Your data → Export data.
• Correction: edit your name, content and settings in the app, or ask us.
• Deletion: You → Account → Delete account deletes your account and data immediately (details).
• Withdraw consent / stop notifications: turn reminders off in You, or delete your account.
• Nominate someone to exercise these rights for you if you are unable to, by writing to us.

Security and breaches

Data is encrypted in transit, passwords are hashed, and every signed-in device can be signed out. If a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

Grievance Officer and contact

For questions, requests or complaints under the Digital Personal Data Protection Act, 2023, write to our Grievance Officer. We respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.

Grievance Officer: Narmada Mishra, Diloni Technologies Private Limited, Hyderabad, Telangana, India
Email: team@dilonitechnologies.in

If we change this policy in a meaningful way, we’ll tell you in the app.