Privacy Policy

1. Data we collect

• Account and profile: your name, email address, and city/state, provided when you sign up or complete your profile.
• Shipping and contact details: the postal address and mobile number you provide so we can deliver your medal and send you transactional updates about your registration and order - by email and, if your number is on WhatsApp, by WhatsApp.
• Activity proof: the screenshots you upload from your tracking app, and the distance, date, and duration they show.
• Feedback on your medal: after your medal is delivered, the ratings, tags and written story you give about the challenge and the medal, whether it arrived damaged, an optional photo of yourself with it, and whether you consent to that feedback being featured and how you want to be credited.
• Gallery photos: a photo of yourself with your medal, if you send us one and agree to it being shown on our public gallery.
• Payment metadata: order number, amount, payment status, and Razorpay's payment identifiers. Your card number, UPI PIN, and banking credentials are handled entirely by Razorpay and are never received or stored by us.
• Waitlist contacts: the email address, and optionally the mobile number, you leave on our website when you ask to hear about new challenges and offers, and whether you asked for those messages on WhatsApp.
• Email preferences: whether you have unsubscribed from promotional email, and when.
• Technical data: the session cookies and logs needed to keep you signed in and the platform secure, plus the anonymous usage measurement described in sections 4 and 11.
• WhatsApp messages you send us: if you message us on WhatsApp, we store your message so our support team can read and reply to it.

2. Why we collect it

• Running your account, registrations, and challenge progress.
• Verifying activity proof so certificates and medals are genuinely earned.
• Processing payments, issuing GST invoices, and handling refunds.
• Shipping medals and merchandise and telling you where your parcel is.
• Sending transactional email - registration confirmations, verification results, dispatch updates.
• Sending the same transactional updates on WhatsApp - registration confirmations, challenge completion with your certificate, and a dispatch update with your courier tracking link when your medal is picked up, and - once it has been delivered - a request for your feedback on that challenge and medal, with a link to the feedback form. Reply STOP to any message to turn WhatsApp updates off, and START to turn them back on. Responding to messages you send us on WhatsApp, and letting our support team message you directly there when needed for your registration or order.
• Using your feedback to improve our medals, packaging, delivery and the service. Your feedback is read by our staff and is featured on our website or social pages only if you tick the consent box when you give it, credited the way you chose. You can withdraw that consent at any time from your Profile, after which we stop featuring it.
• Showing finisher photos on our public gallery page. A photo of you with your medal is published there only after you have agreed, by message to us, to it being shown. The gallery shows the photo alone, with no name or caption. Ask us to remove yours at any time and we will take it down.
• Telling you when a new challenge opens, if you joined the waitlist.
• Sending you news about new challenges and offers on WhatsApp, if you gave us your mobile number on the waitlist before we added a WhatsApp box to the form, or ticked that box when you joined. Reply STOP to any of these messages to stop them. We do not send WhatsApp marketing to anyone else.
• Sending you news about new challenges and offers by email. You are subscribed when you create an account or join the waitlist; unsubscribe any time with the link in any promotional email or from your dashboard. Emails about a challenge you have registered for are part of that registration and are sent regardless.
• Rendering leaderboards for participants who have opted in.
• Preventing fraud and abuse, and meeting our legal and tax obligations.

3. Legal basis and consent

We process your data on the basis of the consent you give when creating an account and registering for a challenge, for the purposes stated in this policy, and - for invoices, tax records, and fraud prevention - for legitimate uses recognised by the DPDP Act. You may withdraw consent at any time by closing your account; withdrawal does not affect processing already carried out, and we may retain what the law requires us to keep (see Retention below).

4. Processors we use

We share data only with the service providers that run the platform, each bound to process it solely for us:

• Supabase - our database and authentication provider; stores account, registration, and progress data.
• Razorpay - our payment gateway; processes all payments and holds your payment instrument details.
• Cloudinary - media storage for activity proofs, certificates, and challenge imagery. Activity proofs and feedback photos are stored privately and are visible only to our staff; gallery photos you have agreed to share are stored publicly so the gallery page can show them.
• Zoho Corporation (Zoho CPaaS Email) - delivers our transactional and sign-in email from its India data centre.
• Delhivery - one of our couriers. To deliver your medal, Delhivery receives your name, delivery address and mobile number, and may contact you by SMS, WhatsApp or phone about that delivery.
• KloudShip (Impledge Technologies) - one of our couriers, which books your parcel with a delivery partner it assigns. To deliver your medal, KloudShip and that delivery partner receive your name, delivery address and mobile number, and may contact you by SMS, WhatsApp or phone about that delivery.
• Meta Platforms (WhatsApp Business): delivers our WhatsApp messages. Meta receives your mobile number and the message content; see WhatsApp's own privacy policy for how it handles messages.
• Google reCAPTCHA - protects our sign-up and sign-in forms from automated abuse. reCAPTCHA collects device and interaction signals, and its use is subject to Google's Privacy Policy and Terms of Service.
• Google Analytics - measures how pages are used so we can improve them. It sets its own cookies and receives your IP address, which Google truncates before storage. It is configured for measurement only: advertising and personalisation storage are switched off, so nothing here is used to advertise to you.
• Vercel - hosts the platform and serves it to your browser.

We do not sell your personal data, and we do not share it with advertisers.

5. Activity proofs are private

The screenshots you upload as activity proof are stored as private assets. They are never published, never appear on your profile or any leaderboard, and are viewable only by you and by our verification staff, through short-lived signed URLs that expire after minutes.

6. Leaderboards and certificates

Leaderboard visibility is off by default. Only if you opt in to a public profile will your full name appear on leaderboards, and you can opt out again at any time. Digital certificates are the one deliberately public artifact: each carries a permanent verification link showing your name, the challenge, and the completion date, because a certificate anyone can check is what makes it worth earning.

7. Retention

We keep your account data for as long as your account is active. When you close your account we delete or anonymise your personal data, except what we must retain: invoices and payment records are kept as required by Indian tax law (generally eight years), and issued certificates remain verifiable as records of a completed challenge. Activity proofs for closed accounts are deleted once no verification dispute is open on them. Waitlist contacts are kept until you ask us to remove them - write to support@milestoearn.in and we will.

8. Your rights under the DPDP Act

• Access a summary of the personal data we hold about you and how it is processed.
• Correct data that is inaccurate or incomplete - most of it directly from your dashboard.
• Request erasure of your data, subject to the retention obligations above.
• Have your grievance heard and resolved (see below), and escalate to the Data Protection Board of India if we fail to resolve it.
• Nominate a person to exercise these rights on your behalf in case of death or incapacity.

To exercise any of these rights, write to the Grievance Officer below or to support@milestoearn.in from your registered email address.

9. Grievance Officer

Name: Vinoth
Email: support@milestoearn.in

We acknowledge grievances within 48 hours and aim to resolve them within 30 days.

10. Children's data

Accounts are for adults (18+). Where a parent or guardian registers a child for a challenge, the guardian provides the data, holds the consent, and exercises the rights in this policy on the child's behalf. We do not knowingly collect data directly from children, and we do not use children's data for tracking or advertising of any kind.

11. Cookies

We use session cookies - the cookies that keep you signed in and keep the platform secure - and Google Analytics cookies, which count visits and page views so we can see what is working. We set no advertising cookies and run no third-party ad trackers.

12. Breach notification

If a breach of personal data occurs, we will notify the Data Protection Board of India and the affected users as required by the DPDP Act, describing what happened, what data was involved, and what we are doing about it.

13. Changes to this policy

We may update this policy as the platform or the law changes. The "Last updated" date above always reflects the current version, and material changes will be notified by email or a notice on the platform.