Privacy Policy

Alavo (“we”, “us”, “Data Fiduciary”) operates alavo.cc and app.alavo.cc (together, the “Service”). This Privacy Policy explains how we process personal data in compliance with the Information Technology Act, 2000 (including rules framed thereunder), the Digital Personal Data Protection Act (DPDP), 2023, and due-diligence obligations applicable to intermediaries under guidelines issued by the Ministry of Electronics and Information Technology (MeitY), including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Policy version: 2026-08-18. Last updated: August 18, 2026.

1. Roles and applicability

When you create an account and use the habit-tracking app, we act as a Data Fiduciary under the DPDP Act for the personal data you provide. You are the Data Principal. Where we use third-party processors listed below, they process data only on our documented instructions and contractual safeguards.

The Service is intended for users in India who are at least 18 years of age. We do not knowingly process personal data of children in violation of applicable law.

2. Personal data we collect

• Identity and account data — email address, sign-in method (email or Google OAuth), email verification status, timezone, and account creation timestamps.
• Habit and wellness data — habits you create, completion logs, streaks, optional notes, and journal reflections you choose to store.
• Preferences and consent records — notification settings, push subscription endpoints (when enabled), email report preferences, and a record of your privacy consent (version, timestamp, and purposes accepted).
• Technical data — information necessary to operate the Service securely (for example session identifiers, server logs, and device/browser characteristics). On alavo.cc, optional Google Analytics is loaded only after cookie consent.
• Payment data — if you buy Pro monthly, Pro yearly, lifetime, or an add-on, Razorpay processes the payment. We store payment identifiers, SKU, amount, and status — not your full card number.

We do not sell or rent your personal data.

3. Lawful purposes and consent

Under the DPDP Act, we process personal data for specified, explicit, and legitimate purposes:

• Essential service delivery (consent at signup) — account creation, authentication, habit tracking, journal storage, streak calculation, and customer support.
• Optional notifications (separate opt-in) — browser push reminders and optional email summaries you enable in Settings.
• Website analytics (separate cookie consent on alavo.cc) — aggregated traffic measurement via Google Analytics when you choose “Accept analytics”.
• Legal and security — fraud prevention, abuse response, compliance with lawful orders, and protection of the Service and users (including MeitY intermediary due diligence).

You may withdraw optional processing (push, email reports, analytics) through Settings or cookie controls without affecting core habit tracking, subject to technical limitations.

4. Data processors

We engage the following categories of processors. Each processes data only to provide services to us:

• Supabase — Authentication, session management, and PostgreSQL database hosting. Data: Email, authentication tokens, habit and journal data.
• Vercel — Application hosting, edge delivery, and scheduled jobs. Data: Technical logs required to operate the service.
• Google — Optional Google sign-in (OAuth) and optional website analytics. Data: Email and basic profile when you choose Google sign-in; usage data on alavo.cc if analytics consent is given.
• Gmail SMTP (Google) — Optional habit summary emails you enable in Settings. Data: Email address and report content.
• Razorpay — Optional paid upgrades (Pro monthly, Pro yearly, lifetime, and add-ons). Data: Email, payment identifiers, and amount when you choose to pay.

Some processors may store or process data outside India. Where required, we implement appropriate contractual and technical safeguards consistent with the DPDP Act and applicable cross-border transfer rules.

5. Retention

We retain personal data while your account is active and as needed to provide the Service. When you delete your account from Settings, we erase associated application data from our primary database, including habits, logs, journal entries, and push subscriptions. Short-lived backups and security logs may persist for a limited period before automatic deletion, unless a longer retention period is required by law or a valid government order.

6. Your rights as a Data Principal

Under the DPDP Act, you may:

• Access — export your data from Settings (JSON or CSV), including profile, habits, logs, journal, and subscription metadata.
• Correction — update timezone and notification preferences in Settings; contact us to correct account email where technically feasible.
• Erasure — delete your account from Settings → Advanced account options.
• Grievance redressal — contact our Grievance Officer (see Section 9). We aim to respond within 30 days.
• Nominate — you may nominate another individual to exercise your rights in the event of death or incapacity, as permitted under the DPDP Act, by writing to us with supporting details.

7. Intermediary obligations (MeitY)

As an intermediary hosting user-generated content (habit names, notes, journal entries), we:

• Publish this Privacy Policy and Terms of Service with clear contact details.
• Provide a grievance redressal mechanism and designated contact for lawful requests.
• Act on valid court orders or notifications from appropriate government agencies as required by law.
• Reserve the right to remove content or suspend accounts that violate our Terms or applicable Indian law, including unlawful, harmful, or infringing material.

To report abuse or illegal content, email hi@alavo.cc with sufficient detail for us to assess the report.

8. Security and personal data breach

We implement reasonable security safeguards appropriate to the nature of the data, including encryption in transit (HTTPS), access controls, and secure authentication via Supabase. No method of transmission or storage is completely secure. If we become aware of a personal data breach likely to affect your rights, we will notify you and the Data Protection Board of India as required under the DPDP Act.

9. Grievance Officer

In accordance with the DPDP Act and IT Rules, grievances relating to personal data processing may be sent to:

• Email: hi@alavo.cc
• Response timeline: within 30 days

General product questions may also be sent to hi@alavo.cc.

10. Changes to this policy

We may update this Privacy Policy when laws, our processors, or product features change. Material updates will be reflected by revising the policy version and “Last updated” date. Where required, we will seek renewed consent before applying changes to existing users.

11. Contact

Privacy and DPDP queries: privacy@alavo.cc