Privacy Policy

This policy explains what personal data Shadow & Sun (shadowandsun.app) collects, why, and the choices you have. It is written to comply with India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 and its rules. Shadow & Sun is the data fiduciary for the data described here.

1. What we collect

• Account data — your name and email address, managed through Supabase Auth (including Google sign-in if you use it).
• Assessment data — your answers, the name the report is for, your current and target locations, and the scored results and generated narrative.
• Payment data — order amount, status, and a payment reference from Cashfree. We never see or store your card, UPI, or bank details; those go directly to Cashfree.
• Usage data — chat questions you ask Dawn or Dusk (our free helper), report feedback you submit, and standard technical logs (IP address, timestamps) used for security and rate limiting. When you create an account we record the IP address it was created from and derive an approximate city/country from it, for fraud prevention and to understand where our users are.
• Analytics — anonymous product-usage events (pages viewed, assessment started, payment started) so we can see where people get stuck. We use explicit events only — no session recording, no advertising trackers, and your assessment answers are never sent to analytics.

2. Why we collect it (purpose limitation)

We process personal data only to: create and secure your account, generate and deliver the report you purchased, process payments and prevent fraud or coupon abuse, answer your questions, and improve the Service using aggregate statistics. We do not sell your data or use it for third-party advertising.

3. Consent and children

You provide data by consent when you sign up, take an assessment, or make a payment. Assessments for anyone under 18 must be administered by a parent or legal guardian from their own account, with verifiable consent recorded before the assessment starts — as the DPDP Act requires for processing children’s data. Only the minor’s first name is stored with the results, and we do not use minors’ data for tracking or targeted advertising.

4. Who processes your data

We use a small set of processors, each bound by their own contractual and security obligations: Supabase (authentication and database hosting), Cashfree Payments (payment processing, an RBI-regulated Indian payment aggregator), OpenAI(generating the narrative section of your report and Dawn’s answers — sent with your first name and assessment results, never your email or payment details), PostHog (product analytics), and Sentry (error monitoring — receives crash details, never your assessment answers). Some processors store data outside India; where they do, transfers happen under their standard safeguards, consistent with current DPDP Act rules.

5. Retention

Your account, reports, and order history are kept while your account exists, so you can return to your report at any time. Technical logs are kept only as long as needed for security. When your account is deleted, your personal data is deleted or anonymised, except records we must keep under Indian tax and payment regulations.

6. Your rights

Under the DPDP Act you may: access a summary of the personal data we hold about you, request correction of inaccurate data, request erasure of your data and account, withdraw consent (which ends further processing but doesn’t affect what was lawfully done before), and nominate a person to exercise these rights for you. To exercise any of these, email connect@shadowandsun.app from your registered address — we respond within 30 days.

7. Grievances

If you believe your data has been mishandled, contact our grievance officer at connect@shadowandsun.app with the subject “Grievance”. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

8. Security and changes

Data is encrypted in transit (TLS), access to production systems is restricted, and payment credentials never touch our servers. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the Data Protection Board as the DPDP Act requires. Material changes to this policy will be posted here with a new date. See also our Terms of Service and Refund Policy.