SPACE App · Effective July 1, 2025 · Developer: Jakkula Shiva Kumar · spaceapp.page@gmail.com
How SPACE collects, uses, and protects your personal data.
This Privacy Policy describes how Jakkula Shiva Kumar ("we," "us," "our," or "Developer") collects, uses, discloses, and safeguards your personal information when you use the SPACE mobile application ("App") available on the Google Play Store. SPACE is a social habit-tracking app that lets users connect with groups who share similar habits and goals.
This Policy primarily applies to users in India and complies with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Digital Personal Data Protection Act, 2023 ("DPDPA 2023"). We also maintain voluntary compliance with international standards (GDPR, CCPA) for future global expansion.
Under the DPDPA 2023, the "Data Fiduciary" responsible for your personal data is:
Account Information (email address, display name); Profile Information (optional avatar, photo, bio, location); Habit Data (habit names, descriptions, emojis, schedules, completion logs); Social Interaction Data (messages, reactions, nudges, snap photos, and captions within shared spaces); User-Generated Content (photos you upload).
With your explicit consent: Location Data (coordinates for Discover features); Usage Data (habit completion timestamps, streak data); Device Information (push notification tokens only).
Under the SPDI Rules, 2011, certain data qualifies as "Sensitive Personal Data." From the categories defined in the Rules, we collect: passwords (stored as hashed/encrypted values only) and location information (with your explicit consent). We do not collect financial information, health data, biometric data, or sexual orientation. Any SPDI is collected only with your free, informed, specific, and clear consent.
We do not collect your full legal name (unless used as display name), use third-party analytics SDKs, collect payment card details (handled entirely by Google Play Billing), or access device contacts, camera roll, or microphone beyond what you explicitly grant.
Under DPDPA 2023 (India): We process your personal data based on your free, specific, informed, unconditional, and unambiguous consent ("consent" as defined under Section 6 of DPDPA 2023). You may withdraw consent at any time. Withdrawal of consent will not affect the lawfulness of processing prior to withdrawal but may result in reduced App functionality.
Under GDPR (EU/EEA — for future users): Performance of a Contract (Article 6(1)(b)) for core features; Legitimate Interests (Article 6(1)(f)) for security; Consent (Article 6(1)(a)) for location, photos, and push notifications; Legal Obligation (Article 6(1)(c)) for applicable laws.
Under CCPA/CPRA (California — for future users): We do not sell personal information. California residents may request disclosure of data collected and request deletion.
We use your data to: create and maintain your account; provide core App features (habit tracking, streaks, couple/group spaces, challenges, leaderboards, progress calendars); provide location-based Discover features; display your profile to members of shared spaces; deliver push notifications; enforce our Terms of Service; maintain App security; and comply with legal obligations under Indian law. We do not use your data for advertising or automated decision-making that produces legal or similarly significant effects.
Your data is stored on servers operated by Supabase, Inc. in the South Asia (Mumbai, India) region. Supabase is ISO 27001 certified. Profile photos and habit snaps are stored in Supabase Storage.
Note for Indian users: Your data is stored within India, in compliance with applicable data localisation expectations under the DPDPA 2023 and IT Act 2000. We will continue to align with any further data localisation requirements as notified by the Central Government.
As required under the SPDI Rules, 2011, we maintain reasonable security practices including: all data in transit is encrypted using TLS; all data at rest is encrypted by Supabase's infrastructure; access is controlled by Row Level Security (RLS) policies; authentication uses JWT tokens via Supabase Auth; habit snap photos automatically expire and are deleted daily.
We do not sell, rent, or trade your personal information to any third party. We share data only with:
Any third-party data processors are contractually obligated to handle your data with equivalent protection standards.
Your location coordinates are used exclusively for proximity-based recommendations in the Discover section. They are never used for advertising or sold to third parties. Location collection requires your explicit consent via your device's permission system. You may revoke this permission at any time via your device settings, after which location-based features will be unavailable.
Snaps are visible to all members of the shared space in which they are posted. Snaps automatically expire at midnight IST daily and are permanently deleted from our servers. Your display name, avatar, and habit activity are visible to other members of spaces you join.
Account data: retained until account deletion. Habit snaps: deleted daily at midnight IST. Profile photographs: deleted upon replacement or account deletion. Push notification tokens: retained until permission is revoked or account deleted. Legal/financial records: up to 7 years where required by Indian law (e.g., IT Act, GST records if applicable).
Under the Digital Personal Data Protection Act, 2023, you have the following rights as a "Data Principal":
EU/EEA users additionally retain rights to data portability and lodging complaints with their local Data Protection Authority. California users retain CCPA/CPRA rights.
To exercise any right, contact: spaceapp.page@gmail.com. We will respond within 30 days as required under DPDPA 2023.
As required under Rule 5(9) of the SPDI Rules, 2011, we have designated a Grievance Officer to address complaints regarding the processing of your personal data:
You may delete your account via the App (Settings > Account > Delete Account) or by emailing spaceapp.page@gmail.com. We will permanently delete your personal data within 30 days. Certain records may be retained for up to 7 years where required by Indian law. Account deletion is irreversible.
SPACE is intended for users aged 18 and older. Under the DPDPA 2023, processing of personal data of children (under 18) requires verifiable parental consent. We do not knowingly collect data from minors under 18 without such consent. If you are a parent or guardian and believe your child has provided data without consent, contact us at spaceapp.page@gmail.com and we will delete the data promptly.
Note: If you intend to allow users aged 13–17, you must implement a verifiable parental consent mechanism as required under Section 9 of the DPDPA 2023 before doing so.
Your data is stored within India (Supabase's Mumbai data centre). No international transfer of your personal data currently takes place. If future infrastructure changes require cross-border transfers, we will ensure compliance with any restricted country notifications under DPDPA 2023. For future EU/EEA users, transfers will be made in accordance with GDPR requirements including Standard Contractual Clauses (SCCs) where applicable.
Material changes will be posted at this URL with an updated Effective Date, and communicated via in-app notification or email at least 7 days before taking effect. Continued use of the App after changes constitutes acceptance of the updated Policy.
Developer & Data Fiduciary: Jakkula Shiva Kumar
Email: spaceapp.page@gmail.com
We will respond to all privacy-related queries within 30 days.