Privacy Policy

1. WHO WE ARE

TruCitizen (the "Platform") is owned and operated by CreJik Technologies Private Limited ("CreJik", "we", "us"), a company incorporated in India with its registered office at A6-A9, New Haven, Palghar, Maharashtra - 401501, India. CreJik is the Data Fiduciary for the personal data described in this Policy under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the rules made under it. This Policy applies to the TruCitizen mobile application, the TruCitizen website and every related service (together, the "Services").

2. WHAT TRUCITIZEN IS

TruCitizen is a social platform that celebrates India. Citizens prove their knowledge of India, its states, communities, institutions and achievements through timed challenges, earn badges and rankings, and build competence that helps them stand out in today's competitive environment. The Platform encourages social collaboration and brings citizens closer to one another to promote the spirit of nationalism and to accept and endorse India's many cultures, beliefs, traditions and languages. Our purpose is to promote socially responsible behaviour by promoting India and its core values so that every citizen feels prouder of their motherland.

3. PERSONAL DATA WE COLLECT

(a) Account data: when you sign in with Google (available on Android and iOS) we receive your Google account identifier, name, email address and profile picture. When you sign in with Apple (available on iOS) we receive your Apple user identifier, name and email address or, if you choose Apple's Hide My Email option, Apple's private relay email address. (b) Profile data you provide: username, preferred language, bio, optional link, profile photo, state and community affiliations, and privacy settings. (c) Activity data: challenges started and completed, answers, scores, rankings, badges, referrals, follows, follow requests, nominations, stories you view and share, and in-app interactions. (d) Transaction data: when you buy a plan we receive the plan purchased, amount, taxes, currency, purchase date, payment or refund status and the transaction identifier issued by our secure payment partner or by the app store through which you purchased. We never receive or store your card number, UPI PIN, CVV, bank credentials, billing address or app-store account payment details — these are handled solely by the payment partner or app store. (e) Technical data: device type, operating system, app version, language, approximate region derived from IP address, crash and diagnostic logs, and security signals used to detect fraud and abuse. (f) Communications: messages you send to support and your responses to surveys or notices.

App Store and Google Play data: Google Play and the Apple App Store may collect their own data about your use of the app — such as crash reports, purchase history and device identifiers — under their own privacy policies, which CreJik does not control. Please see Google's Privacy Policy at https://policies.google.com/privacy and Apple's Privacy Policy at https://www.apple.com/legal/privacy/ for details.

4. PURPOSES AND LAWFUL BASIS

We process personal data (i) to create and operate your account and deliver the Services you request; (ii) to run challenges, compute scores, rankings and badges and publish leaderboards; (iii) to enable social features such as profiles, follows, stories, referrals and sharing; (iv) to process paid-plan purchases and issue tax invoices; (v) to localise the Services into your chosen language; (vi) to keep the Platform secure, prevent fraud, enforce our Terms and protect the rights of other citizens; (vii) to comply with applicable law, regulatory requests and legal process; and (viii) to analyse aggregated usage so we can improve the Services. Our lawful basis is your consent, obtained when you sign in and when you turn on optional features, and the legitimate uses permitted by Section 7 of the DPDP Act (for example, processing needed to provide a service you have asked for, to comply with law or to respond to a security incident). We do not sell personal data and we do not use it for behavioural advertising.

5. NOTICE, CONSENT AND WITHDRAWAL

We give you notice of the personal data we collect and the purpose of processing at the time of collection, in plain language and in the languages supported by the app. Optional features — profile photo, stories, referrals, notifications and public profiles — are processed only when you enable or use them. You may withdraw consent at any time by disabling the feature, changing your privacy settings or deleting your account; withdrawal is as easy as giving consent and does not affect processing already carried out lawfully. Where processing is necessary to provide the Services, withdrawing consent may mean that part of the Services can no longer be provided to you.

6. SHARING OF PERSONAL DATA AND DATA PROCESSORS

We share personal data only with Data Processors who act on our documented instructions under written contracts, and only to the extent needed to deliver the Services. Our Data Processors are: Google (Google Sign-In, distribution of the Android app through Google Play, and Firebase Cloud Messaging for push notifications); Apple (Sign in with Apple and distribution of the iOS app through the App Store); our secure payment partners and the app stores' purchase systems (processing of in-app purchases — the app shows you which one applies to your purchase); MongoDB Atlas (database hosting in the Mumbai (India) region); our app hosting provider (running the Platform's servers); and our support-email provider. Machine translation of app content is performed in advance by CreJik's own systems and is not applied to any personal data at runtime. We may disclose personal data where required by law, court order or a government authority, or where reasonably necessary to protect the safety, rights or property of citizens, the public or CreJik. Public parts of your profile (username, display name, photo, badges, rankings and, if your profile is public, your activity) are visible to other citizens and, where you choose to share them, to third-party platforms such as WhatsApp or Instagram. Sharing to such platforms is governed by their own policies.

7. CROSS-BORDER TRANSFERS

Personal data is stored on servers located in India. Certain Data Processors (for example Google sign-in or crash-reporting services) may process limited technical data outside India. Any such transfer is made only to countries not restricted by the Central Government under the DPDP Act and under contractual safeguards requiring protection at least equivalent to this Policy.

8. DATA SECURITY

CreJik implements reasonable security safeguards appropriate to the nature of the data, including encryption in transit (TLS 1.2 or higher), encryption at rest for databases and backups, hashed session tokens, role-based access controls, audit logging of administrative actions, rate limiting, network isolation and regular review of our security posture. Access to personal data is restricted to authorised personnel bound by confidentiality obligations. No method of transmission or storage is completely secure; in the event of a personal data breach we will notify the Data Protection Board of India and affected citizens in the form and within the timelines prescribed under the DPDP Act.

9. RETENTION AND DELETION

We retain personal data only for as long as it is needed for the purpose for which it was collected or as required by law. When you delete your account (Profile → Delete account), your profile is anonymised and your personal identifiers, photo, bio and social connections are removed from the Platform without undue delay. Historical challenge results may be retained in anonymised form to preserve the integrity of rankings. Transaction, tax and accounting records are retained for the periods mandated under Indian law (including the Income-tax Act, GST laws and the Companies Act) and are then securely deleted. Transaction records are retained for 8 years from the end of the relevant financial year, as required by Indian tax and accounting law, even after your account is deleted; where possible they are kept in anonymised or aggregated form. Accounts inactive for an extended period may be deleted after notice.

10. YOUR RIGHTS AS A DATA PRINCIPAL

Under the DPDP Act you have the right to: (a) access a summary of the personal data we process about you and the processing activities undertaken; (b) correct, complete or update inaccurate or incomplete data (Edit Profile); (c) request erasure of personal data that is no longer necessary (Delete account); (d) nominate a person to exercise your rights in the event of death or incapacity; (e) withdraw consent; and (f) have a readily available means of grievance redressal. To exercise any right, write to support@crejik.com with the subject line "[TruCitizen] Data Principal Request". We verify identity before acting on a request and respond within the timelines prescribed under the DPDP Act. If you are not satisfied with our response you may approach the Data Protection Board of India. Refund requests: write to CreJik support at support@crejik.com with the subject line "[TruCitizen] Refund Request" within 7 days of the transaction. Where your purchase was made through an app store's own purchase system, the refund is requested from and decided by that app store under its terms; the app shows you the correct refund route for your purchase.

11. CHILDREN

TruCitizen is intended for citizens aged 18 years and above. We do not knowingly process the personal data of children (persons under 18) and we do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we learn that an account belongs to a child without verifiable parental consent as required by the DPDP Act, we will delete it. Parents or guardians who believe a child has created an account should contact us at the address below.

12. SCREEN-CAPTURE PROTECTION

The TruCitizen app contains technical measures that prevent screenshots, screen recording, screen mirroring and screen casting on supported Android and iOS devices. We apply these measures throughout the app in order to protect the privacy of every citizen whose profile, activity or personal data may appear on a screen, and to protect the confidentiality and integrity of challenge content. If your device nevertheless reports that a screenshot was attempted, the app only displays a notice on your device reminding you that capture is not permitted. CreJik does not receive, store or view any image or recording of your screen, and no information about such an attempt is transmitted to CreJik. These measures rely on features provided by the device operating system; CreJik does not guarantee that they will function on every device, operating-system version, modified device or external display, and their failure on a particular device does not constitute a breach of this Policy by CreJik. By using the app you acknowledge these measures and agree that you will not attempt to bypass or disable them, and that you will not capture, record, reproduce or redistribute the profile, activity or personal data of any other citizen by any means. A citizen who believes that his or her personal data has been captured or shared from the app without authorisation may report the matter to the Grievance Officer at the contact details given below.

13. COOKIES AND SIMILAR TECHNOLOGIES

The mobile app uses secure device storage for your session token and language preference. The website uses strictly necessary cookies for sign-in and security and privacy-respecting analytics in aggregated form. You can clear these from your device or browser settings; doing so will sign you out.

14. GRIEVANCE OFFICER AND CONTACT

Grievance Officer, CreJik Technologies Private Limited, A6-A9, New Haven, Palghar, Maharashtra - 401501, India. Email: support@crejik.com (please include "[TruCitizen]" in the subject). We acknowledge grievances promptly and endeavour to resolve them within the period prescribed under applicable law.

15. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in law, technology or the Services. Material changes will be notified in the app or by email before they take effect, and the "Last updated" date below will be revised. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

CONTACT

CreJik Technologies Private Limited A6-A9, New Haven, Palghar, Maharashtra - 401501, India Email: support@crejik.com