Privacy Policy

1. Data we collect

• Account and profile: your name, email address, and city/state, provided when you sign up or complete your profile.
• Shipping and contact details: the postal address and mobile number you provide so we can deliver your medal and send you transactional updates about your registration and order - by email and, if your number is on WhatsApp, by WhatsApp.
• Activity proof: the screenshots you upload from your tracking app, and the distance, date, and duration they show.
• Payment metadata: order number, amount, payment status, and Razorpay's payment identifiers. Your card number, UPI PIN, and banking credentials are handled entirely by Razorpay and are never received or stored by us.
• Waitlist contacts: the email address, and optionally the mobile number, you leave on our home page when you ask to be told about the next challenge.
• Technical data: the session cookies and logs needed to keep you signed in and the platform secure, plus the anonymous usage measurement described in sections 4 and 11.

2. Why we collect it

• Running your account, registrations, and challenge progress.
• Verifying activity proof so certificates and medals are genuinely earned.
• Processing payments, issuing GST invoices, and handling refunds.
• Shipping medals and merchandise and telling you where your parcel is.
• Sending transactional email - registration confirmations, verification results, dispatch updates.
• Sending the same transactional updates on WhatsApp - registration confirmations today; verification results and dispatch updates as we add them. Reply STOP to any message to turn WhatsApp updates off, and START to turn them back on. We do not send marketing on WhatsApp.
• Telling you when a new challenge opens, if you joined the waitlist - that is the only thing we use waitlist details for.
• Rendering leaderboards for participants who have opted in.
• Preventing fraud and abuse, and meeting our legal and tax obligations.

3. Legal basis and consent

We process your data on the basis of the consent you give when creating an account and registering for a challenge, for the purposes stated in this policy, and - for invoices, tax records, and fraud prevention - for legitimate uses recognised by the DPDP Act. You may withdraw consent at any time by closing your account; withdrawal does not affect processing already carried out, and we may retain what the law requires us to keep (see Retention below).

4. Processors we use

We share data only with the service providers that run the platform, each bound to process it solely for us:

• Supabase - our database and authentication provider; stores account, registration, and progress data.
• Razorpay - our payment gateway; processes all payments and holds your payment instrument details.
• Cloudinary - media storage for activity proofs, certificates, and challenge imagery.
• Resend - delivers our transactional email.
• Meta Platforms (WhatsApp Business): delivers transactional WhatsApp messages. Meta receives your mobile number and the message content; see WhatsApp's own privacy policy for how it handles messages.
• Google reCAPTCHA - protects our sign-up and sign-in forms from automated abuse. reCAPTCHA collects device and interaction signals, and its use is subject to Google's Privacy Policy and Terms of Service.
• Google Analytics - measures how pages are used so we can improve them. It sets its own cookies and receives your IP address, which Google truncates before storage. It is configured for measurement only: advertising and personalisation storage are switched off, so nothing here is used to advertise to you.
• Vercel - hosts the platform and serves it to your browser.

We do not sell your personal data, and we do not share it with advertisers.

5. Activity proofs are private

The screenshots you upload as activity proof are stored as private assets. They are never published, never appear on your profile or any leaderboard, and are viewable only by you and by our verification staff, through short-lived signed URLs that expire after minutes.

6. Leaderboards and certificates

Leaderboard visibility is off by default. Only if you opt in to a public profile will your full name appear on leaderboards, and you can opt out again at any time. Digital certificates are the one deliberately public artifact: each carries a permanent verification link showing your name, the challenge, and the completion date, because a certificate anyone can check is what makes it worth earning.

7. Retention

We keep your account data for as long as your account is active. When you close your account we delete or anonymise your personal data, except what we must retain: invoices and payment records are kept as required by Indian tax law (generally eight years), and issued certificates remain verifiable as records of a completed challenge. Activity proofs for closed accounts are deleted once no verification dispute is open on them. Waitlist contacts are kept until we have announced the challenge they signed up to hear about, or until you ask us to remove them - write to support@milestoearn.in and we will.

8. Your rights under the DPDP Act

• Access a summary of the personal data we hold about you and how it is processed.
• Correct data that is inaccurate or incomplete - most of it directly from your dashboard.
• Request erasure of your data, subject to the retention obligations above.
• Have your grievance heard and resolved (see below), and escalate to the Data Protection Board of India if we fail to resolve it.
• Nominate a person to exercise these rights on your behalf in case of death or incapacity.

To exercise any of these rights, write to the Grievance Officer below or to support@milestoearn.in from your registered email address.

9. Grievance Officer

Name: PLACEHOLDER - no officer appointed
Email: grievance@milestoearn.in
Address: PLACEHOLDER ADDRESS - NOT A REAL OFFICE, 1 Example Road, Bengaluru, Karnataka 560001

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

10. Children's data

Accounts are for adults (18+). Where a parent or guardian registers a child for a challenge, the guardian provides the data, holds the consent, and exercises the rights in this policy on the child's behalf. We do not knowingly collect data directly from children, and we do not use children's data for tracking or advertising of any kind.

11. Cookies

We use session cookies - the cookies that keep you signed in and keep the platform secure - and Google Analytics cookies, which count visits and page views so we can see what is working. We set no advertising cookies and run no third-party ad trackers.

12. Breach notification

If a breach of personal data occurs, we will notify the Data Protection Board of India and the affected users as required by the DPDP Act, describing what happened, what data was involved, and what we are doing about it.

13. Changes to this policy

We may update this policy as the platform or the law changes. The "Last updated" date above always reflects the current version, and material changes will be notified by email or a notice on the platform.