1.Who this policy covers 

This Privacy Policy explains how Enigma Metaverse Private Limited and its subsidiary and affiliate companies listed in Schedule A (together, “Enigma“, “we“, “us“, “our“) collect, use, store, share and protect personal data. It applies to: 

• Enigma Community, our website, web app and Android and iOS mobile apps, including Notes, Reminders and Tasks, Focus (Pomodoro), AI actions, Cloud Sync, Rewards and Streaks, and Health and Wellbeing features (together, the “Community App“); 

• enigmametaverse.com and every other website, landing page, portal, email or messaging channel run by Enigma or a group company that links to this policy (the “Sites“); 

• our products and services for businesses, including Enigma ERP, CRM, Analytics, HRMS and Helpdesk, and our consulting and delivery services (the “Business Services“); 

• people who contact us, subscribe to updates, attend events, or apply for jobs with us. 

Together these are the “Services“. Where a group company runs a Service with its own privacy notice, that notice applies to the extent it is more specific, and this policy still applies to everything it does not cover. Our employees and contractors are covered by a separate internal notice. 

The data fiduciary (controller) for the Services is Enigma Metaverse Private Limited, Hyderabad, unless a Schedule A company is named as the operator of a particular Service. Our contact details are in Section 16. 

Some features described in this policy, including Secure Notes, AI actions, Cloud Sync, rewards and leaderboards, SMS or WhatsApp reminder escalation, and health-based nudges, are being introduced in phases. The section on a feature applies from the day that feature becomes available to you. Until then, we do not collect the data that feature needs. 

By creating an account or using the Services you confirm that you have read this policy. Where the law requires your consent for a particular use of data, we ask for it separately and you can withdraw it at any time (Section 12). Using the Services does not mean you consent to anything that this policy says needs separate, specific consent. 

2. Plain-language summary 

• We collect only what each feature needs. Core note, task and reminder content is yours. 

• Health and fitness data is optional. We read it from Health Connect (Android) or Apple Health (iOS) only after you grant permission for each data type, and only to run the wellbeing features you turn on. 

• We do not sell personal data, and we never use health data, private notes or vault content for advertising, remarketing or marketing profiles. 

• AI proposes and you confirm. Private notes and health data are processed on your device, or not at all, unless you give separate consent for server-side processing. 

• You can access, correct, export and delete your data, and withdraw consent, from the app or by contacting us. 

• Enigma Community is a wellness and productivity app. It does not diagnose, treat or give medical advice. 
  
  

3. Data we collect 

3.1 Data you give us 

• Account data: name, email address, mobile number, password or social-login identifier, display name, profile photograph, date of birth, gender (where you choose to provide it), language and region. 

• Content you create or save: notes, checklists, tasks, reminders, links and link previews, tags, folders, attachments and images, voice notes and extracted text (where those features are available), and the schedules and actions you attach to items. 

• Secure Notes and vault content (where available): content you store in an encrypted note type or vault. With zero-knowledge encryption we store only ciphertext and cannot read it. 

• Rewards and community data: points, streaks, badges, challenge participation, friend-group membership, and leaderboard entries under the display name you choose. 

• Preference and profile answers you opt into: habits, preferred times of day, motivation style and similar answers used to personalize timing and wording of nudges (“light profiling”, Section 5.6). 

• Wellbeing check-ins: self-reported mood, stress, hydration, meals or sleep entries that you log yourself. 

• Business and support data: enquiry forms, call and chat records, service requests, tickets, feedback, survey answers, event registrations. 

• Job applications: CV, contact details, employment and education history, and interview notes. 

• Payments: transaction identifiers, plan and subscription history and invoice details. Card and bank credentials are collected and held by our payment partners, not by us. 
  
  

3.2 Data collected automatically 

• Device and app data: device model, operating system, app version, language, time zone, device identifiers, crash and performance logs. 

• Usage data: features used, screens viewed, interaction events, notification delivery and response, session times. 

• Network data: IP address, approximate location derived from IP, browser type, referring pages. 

• Precise location only if you enable a feature that needs it and grant the system permission. 

• Cookie, pixel and SDK data, described in Section 11. 
  
  

3.3 Health and fitness data (sensitive) 

If you connect Health Connect on Android or Apple Health on iOS, you choose which of these data types to allow, one by one, in the system permission screen. We may request: 

• steps, distance and activity or exercise sessions; 

• sleep sessions and duration; 

• hydration entries; 

• heart rate and, if your wearable provides it, heart-rate variability; 

• other wellness metrics that you specifically allow in a future feature (we will update this policy and ask again before requesting anything new). 

We also hold wellbeing information that you log yourself inside the app (for example a water tap, a mood or stress check-in, or a breathing exercise you complete). We treat self-reported wellbeing data like health data. 

We do not request health data we do not need, and the app works without it. Section 6 explains how we use and protect it. 

3.4 Data from other sources 

• Social login providers (for example Google, Apple) share the profile details you approve. 

• If you connect Google Drive or another storage provider, we receive an access token and can read and write only the folder or files our permission covers (Section 5.5). 

• Business contacts and leads may reach us through referrals, public business sources, events and partners. We tell you the source when we first contact you if the law requires. 
  
  

4. Why we use your data, and our legal basis 

We process personal data only for the purposes below. Where the law requires a legal basis (for example under GDPR), the basis is shown in brackets. 

1. Provide the Services: create and secure your account, store and sync your content, run reminders and tasks, deliver notifications [contract]. 
2. Run features you turn on: AI actions, Cloud Sync, rewards, health-based nudges [contract or consent, as stated for each feature]. 
3. Health and wellbeing features: only with your explicit consent [explicit consent]. 
4. Security and fraud prevention: protect accounts, detect abuse, enforce our terms [legitimate interests, legal obligation]. 
5. Customer support and communication: respond to requests, send service messages such as security alerts and billing notices [contract, legitimate interests]. 
6. Improve and maintain the Services: diagnose problems, measure reliability and performance, test new features, using aggregated or de-identified data wherever possible [legitimate interests]. 
7. Personalization across our Services: tailor suggestions, content and offers within Enigma Community and our other Services (Section 7) [legitimate interests or consent where required]. 
8. Marketing: send offers, product news and campaigns by email, SMS, WhatsApp or push notification [consent, or legitimate interests where the law allows; you can opt out at any time]. 
9. Business Services: deliver contracted work, manage client relationships, invoice and collect payment [contract]. 
10. Recruitment: evaluate and communicate with applicants [consent, legitimate interests]. 
11. Legal and compliance: meet tax, accounting, regulatory and court obligations, and defend legal claims [legal obligation, legitimate interests]. 

We do not use personal data for a new purpose that is incompatible with these, without telling you and, where required, asking for consent first. 

5. How specific features use your data 

5.1 Notes, tasks and reminders 

Your notes, tasks and reminders are stored on your device first and synced to your Enigma account when you are online. Content is encrypted in transit and at rest. You can mark items private for stronger protection (Section 9). We use content to deliver the feature, to sync it, and, with the AI features described below, to suggest actions. We do not read your notes for advertising. 

5.2 Reminder delivery 

Reminders are scheduled on your device and, as a fallback, on our servers, so a missed local alarm can still reach you. We store the time, time zone and recurrence of each reminder for this purpose. Where we offer SMS or WhatsApp escalation and you turn it on, we may send an SMS or WhatsApp message to the number you gave us; our messaging providers process your number and the message content for delivery.
 

5.3 AI features 

Our AI engine reads what you capture and proposes actions such as a reminder, task, tag or focus session. It works in three tiers: 

• Rules and parsers on your device (dates, times, durations, links, simple math); 

• Small models, on your device where available, otherwise on servers we operate; 

• Larger models on our own servers for summaries, planning and multi-step routines. 

How we handle your data in AI features: 

• AI proposes and you confirm. Actions run only after your confirmation unless you have chosen to automate a specific action type, and every action can be undone. 

• Content marked private, vault content and all health data are never sent to our server-side AI models unless you separately consent for that category. You can turn server-side processing off for any category. 

• Our AI models are self-hosted on infrastructure we operate, so your content is not sent to third-party AI providers for processing. If that ever changes, we will update this policy and ask for your consent first. 

• We do not use your content to train our own models without your separate, explicit opt-in. 

• Saved links and pasted text are treated as untrusted. The AI may extract facts from them, but it does not follow instructions found inside them. The AI can only use a limited set of tools (for example create a reminder, tag, or move an item) and has no access to your vault, payments or messages. 

• We run accuracy testing for the AI engine on sample or consented data, including mixed-language and regional-language examples. 
  
  

5.4 Rewards, streaks and challenges 

We record the actions that earn points and streaks (for example completing a task) so we can calculate rewards. Where we offer them, friend-group streaks and leaderboards are opt-in; others see only your chosen display name and score. Rewards may include premium trial days, themes or partner discounts. We do not offer cash or chance-based rewards. Health data is never used to rank you against others unless you join a specific challenge that says so before you opt in. 

5.5 Cloud Sync and backups 

If you connect Google Drive, Dropbox, OneDrive or another storage provider, we ask only for the narrowest permission that works, normally a folder or app-data area that our app creates. We cannot see your other files. We write mirror and export copies there (for example Markdown, JSON or calendar files) so your data is never trapped. You can disconnect at any time; this stops new syncing and does not delete files already in your storage account. 

Enigma also keeps an encrypted backup of your data. Where we offer end-to-end encrypted backup and you choose it, Enigma holds only ciphertext and the key stays with you, which means we cannot recover your data if you lose the key. 

Our use and transfer of information we receive from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide and improve the user-facing sync feature you enabled. 

5.6 Light profiling 

If you opt in, we use your answers and in-app behavior (for example the times you usually complete tasks and the style of nudge you respond to) to choose better times and wording for reminders and nudges. This does not produce decisions with legal or similarly significant effect on you, does not use health data or private content, and you can switch it off at any time. 

5.7 Notifications 

We send push notifications for reminders, security alerts and, if you allow them, nudges and offers. We apply a daily cap, quiet hours and automatic back-off when you ignore nudges. You can manage notifications in your device settings and, where the app offers category controls, in the app. 

6. Health and fitness data: how we use, share and protect it 

This section applies in addition to the rest of this policy to all health and fitness data and to wellbeing information you log in the app. 

6.1 What we access and why. We access health data only if you grant permission in Health Connect or Apple Health, one data type at a time. We use each type only for the purpose shown when we ask: 

• steps, distance and activity: activity tracking, daily goals, streaks and low-activity nudges; 

• sleep: short-sleep and wind-down reminders and a simple sleep summary; 

• hydration: water reminders and logging; 

• heart rate and heart-rate variability: optional stress and recovery insights if you have a compatible device; 

• self-reported mood and stress check-ins: guided breathing and wellbeing prompts. 
  
  

6.2 What we do not do. 

• We do not sell health data. 

• We do not use health data for advertising, remarketing, interest-based targeting or marketing profiles, and we do not share it with advertising networks or data brokers. 

• We do not use health data to decide pricing, eligibility, credit, insurance, employment or similar matters. 

• We do not combine health data with other data to create ad audiences, and the cross-service personalization in Section 7 excludes health data. 

• We do not diagnose conditions, provide medical advice, or make medical or clinical claims. Enigma Community is a wellness tool and is not a medical device. If you have a health concern, speak to a qualified professional. If you are in distress or in an emergency, contact local emergency services or a crisis line. 

• We do not request health permissions that are not needed for a feature you can see and use. 
  
  

6.3 Sharing. We do not disclose health data to third parties, except: 

• service providers acting on our behalf under confidentiality and data-protection terms, such as secure cloud hosting, solely to deliver the feature to you; 

• when you instruct us to (for example syncing to your own storage); 

• where required by law or valid legal process; 

• as part of a merger, acquisition or restructuring, in which case the successor must honor these limits and we will notify you. 
  
  

6.4 Storage and security. Health data is kept in a separate, minimal and encrypted store, with its own consent record, retention limit and delete control. Wherever possible it is processed on your device and only the minimum summary needed for a feature is kept in your account. Access by our staff is restricted, logged and limited to what is needed to operate and secure the service. 

6.5 Retention and deletion. We keep health data only as long as the feature that needs it is on and your account is active, and in any case no longer than 12 months for detailed readings unless you ask us to keep them longer. Daily summaries needed to show your own history may be kept while your account exists. To have all your health data removed, email info@enigmametaverse.org from the address registered to your account, and we will confirm the request and delete the data. Deleted data is removed from active systems promptly and from backups within 90 days. 

6.6 Your control. You can turn health features off, change or revoke individual permissions in Health Connect or Apple Health at any time, and withdraw consent. Withdrawing consent stops further collection and the features that depend on it; it does not affect earlier use that was lawful. 

6.7 Platform rules. Our use of information received through Health Connect adheres to the Google Play Health Connect and Health apps policies, including limited-use requirements. Data received through Apple HealthKit is used only to provide health and fitness features, is not used for advertising or data mining, and is not disclosed to third parties except as Apple permits. 

7. Cross-service personalization 

Enigma Community brings several services together in one app and one account. To make the experience coherent, we may use your activity and preferences across our Services (for example, saved places, purchases, interests, or the football, travel and finance features you use) to personalize suggestions, content and offers. 

This never includes: 

• health data and wellbeing check-ins; 

• private notes, vault content and the text of your notes; 

• content you have not chosen to share with a feature. 

You can opt out of personalized offers by emailing info@enigmametaverse.org, and you will still receive essential service messages. 

8. Who we share data with 

We do not sell personal data and do not share it for cross-context behavioral advertising. We share personal data only with: 

• Group companies listed in Schedule A, for operating the Services, support, security and the personalization described above, under the same protections; 

• Service providers (processors): cloud hosting and storage, payment gateways, email, SMS and WhatsApp delivery, push notification services, analytics and crash reporting, customer support tools, identity verification; 

• Storage and platform providers you connect, such as Google, Apple, Dropbox or Microsoft, when you instruct us to; 

• Business partners and marketing partners, for offers you have opted into, limited to what is needed, and never health data or private content; 

• Professional advisers, auditors and insurers under confidentiality; 

• Authorities and courts, where required by law, to protect rights, safety and security, or to prevent fraud; 

• A successor business in a merger, acquisition or asset sale, with notice to you. 

We require every processor to protect data under written terms and to use it only on our instructions. 

9. Security 

We protect data with technical, organizational and administrative measures, including encryption in transit and at rest, access controls and least-privilege access, logging, vulnerability management, staff training and vendor reviews. Enigma Metaverse holds ISO/IEC 27001 (information security) and ISO 9001 (quality) certifications. 

Stronger protections apply to higher-risk data: 

• Vault and Secure Notes: end-to-end encrypted with a key derived from your master password. We cannot read or recover them, and the AI engine has no access. 

• Private notes: encrypted with an optional private mode that excludes them from cloud AI and server-side processing. 

• Health data: isolated, minimal and encrypted, as described in Section 6. 

No system is completely secure. If a personal data breach affects you and the law requires it, we will notify you and the relevant authority without undue delay and, where GDPR applies, within 72 hours of becoming aware where required. Please use a strong, unique password and keep your devices updated. 

10. Where your data is stored and international transfers 

Our primary operations are in India, and your data is stored and processed in India and in the data-center regions of our hosting providers. If you use the Services from outside India, your data will be transferred to and processed in India and other countries where our providers operate. 

Where the law restricts international transfers (for example from the EEA, UK or Switzerland), we rely on an appropriate transfer mechanism such as an adequacy decision, standard contractual clauses or your explicit consent, and we apply the same protections described in this policy. You can contact us for a copy of the safeguards we use. 

11. Cookies, SDKs and similar technologies 

The Sites and the Community App use cookies, pixels, local storage and SDKs for: 

• Strictly necessary functions: log-in, security and load balancing; 

• Preferences: language and display settings; 

• Analytics and performance: understanding how the Services are used and fixing problems; 

• Advertising and remarketing on the Sites (for example a remarketing pixel on our marketing pages), only where you consent where the law requires. 

Advertising and remarketing technologies are not used inside the health, wellbeing, vault and private-notes areas of the Community App, and no health data is ever passed to them. We show a consent banner where required and you can change your choices at any time using the cookie settings link or your browser. Blocking some cookies may affect functionality. We do not respond to “Do Not Track” signals in a uniform way, but we honor recognized opt-out preference signals where the law requires. 

12. Your rights and choices 

Subject to the law that applies to you, you have the right to: 

• access the personal data we hold about you and receive a summary of how it is processed; 

• correct inaccurate or incomplete data; 

• erase your data (delete your account and content), subject to retention we must keep by law; 

• export your data in a readable format (for example Markdown, JSON or ICS files); 

• withdraw consent at any time, as easily as you gave it; 

• object to or restrict certain processing, including direct marketing and profiling, and to ask for human review of significant automated decisions; 

• grievance redressal: raise a complaint with our Grievance Officer, and if unresolved, with the Data Protection Board of India under the Digital Personal Data Protection Act, 2023, or with your local supervisory authority (for example in the EU, UK or Canada); 

• nominate another person to exercise your rights in the event of your death or incapacity, where the law provides; 

• if you live in California or another US state with a privacy law: to know, delete, correct and opt out of sale or sharing (we do not sell or share personal data for cross-context behavioral advertising), and to not be discriminated against for exercising rights. 

How to exercise them: email info@enigmametaverse.org from the address registered to your account, or write to the Grievance Officer in Section 16. This is how to request access, correction, export, deletion of your account or health data, withdrawal of consent, or any other right. We may need to verify your identity. We respond within the period required by law and normally within 30 days. We do not charge a fee unless requests are manifestly excessive. 

Marketing choices: unsubscribe using the link in any email or message, reply STOP to SMS, change notification settings on your device, or contact us. 

13. Retention 

We keep personal data only as long as needed for the purposes in this policy, and delete or anonymize it afterwards. 

• Account and content: while your account is active. When you ask us by email to delete your account, we delete your content and profile from active systems within 30 days and from backups within 90 days. 

• Health data: as set out in Section 6.5. 

• Reminders and notification logs: 90 days after the reminder is completed or dismissed. 

• Support records: 3 years after resolution. 

• Transaction and tax records: as required by Indian law, generally 8 years. 

• Marketing preferences and suppression lists: until you ask us to remove them, and then only the minimum needed to honor your opt-out. 

• Security and audit logs: up to 12 months. 

• Job applications: 12 months after the process ends unless you ask us to keep your details for future roles. 

• Business client data: for the term of the contract and as the contract states. 

Some records may be kept longer where law requires or to resolve disputes, in which case we restrict their use. 

14. Children 

The Services are intended for people aged 18 and over, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it. If we ever offer features to minors, we will obtain verifiable consent from a parent or guardian where the law requires it and we will not track or target them with advertising. 

15. Business Services and client data 

When we deliver ERP, CRM, HRMS, analytics, helpdesk, Pega, SAP, Salesforce, BPO or other services to a business client, we usually process their data as a processor under a written agreement and on their instructions. For that data, the client’s privacy notice governs, and we handle it under our contract with them. If you are an individual whose data is held by one of our clients and you want to exercise rights over it, contact that client first; we will help them respond. 

16. Contact and Grievance Officer 

If you have a question, request or complaint about this policy, contact: 

Grievance Officer / Data Protection Contact 
Yashwanth Reddy Yatham, Grievance Officer 
Enigma Metaverse Private Limited 
H.No. 8-3-960/3, 1st Floor, Raghadeep Residency, Sri Nagar Colony, Banjara Hills, Hyderabad, Telangana 500073, India 
Registered office: Plot No. 19, Sri Laxmi Balaji Colony, Gollaguda, Nalgonda, Telangana 508001, India 
Email: info@enigmametaverse.org 
Phone: +91 9441436694 
We acknowledge requests and complaints within 7 business days. 

If you are in the EEA or UK, you can contact the Grievance Officer above for any privacy matter. 

17. Changes to this policy 

We may update this policy when our Services, practices or laws change. We will post the new version with an updated date, and if a change is material or affects how we use health data, we will notify you in the app or by email and ask for fresh consent where the law requires. Earlier versions are available on request. 

Schedule A: Covered group companies and Services 

This policy applies to the following companies and the services they operate: 

• Enigma Metaverse Private Limited (parent): enigmametaverse.com and Business Services 

• Enigma Community: website and mobile apps 

• Enigma Celluloid Private Limited 

• Enigma Sports & Gaming Private Limited 

• Enigma Jaunt Private Limited 

• Enigma Viand Private Limited 

• Hashing Hardware Private Limited 

• Rational Works Private Limited 

• Enigma Capital Solutions Private Limited 

• Vyasa Nexus Foundation Private Limited 

Adding or removing a company or service from this schedule updates this policy under Section 17.