Privacy Policy

cursus

Last Updated: August 31, 2026

Effective Date: August 31, 2026

---

This Privacy Policy describes how cursus collects, uses, stores, protects, and discloses personal data in connection with its public marketing website (cursus.in) and main application (app.cursus.in). It is drafted to satisfy applicable current privacy obligations and, where relevant, to adopt the standards of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules") ahead of their applicable commencement dates.

As of the Last Updated date, the DPDP Act and Rules are subject to a phased commencement schedule. This Policy therefore distinguishes between obligations that are currently in force and standards that cursus has adopted voluntarily in preparation for future commencement. Nothing in this Policy is intended to state that a future provision is already legally operative.

Where applicable, this Policy also addresses the EU General Data Protection Regulation (EU) 2016/679 ("EU GDPR") and the UK data protection regime, including the UK GDPR as amended by the Data (Use and Access) Act 2025 ("DUAA") and applicable privacy/electronic-communications rules. References to EU GDPR provisions are not intended to imply that the same provisions or tests apply identically under UK law.

cursus is the Data Fiduciary under the DPDP Act and, where the relevant territorial and material requirements are met, the Data Controller under the EU GDPR or UK GDPR. References in this Policy to "Data Principal" use the DPDP Act terminology; "Data Subject" is used where EU/UK law applies.

Who this Policy is for. This Policy is intended for users and visitors of cursus globally. The applicability of a particular legal regime depends on its territorial and material scope. Where a right, safeguard, or procedure is offered as a voluntary cursus practice beyond a statutory minimum, that is stated or described accordingly.

This Privacy Policy must be read in conjunction with our Terms & Conditions and Cookie & Local Storage Policy.

---

1. Identity of the Data Fiduciary / Data Controller

For purposes of this Policy, the responsible legal entity and Data Fiduciary/Data Controller is cursus.

The contact above is the principal point of contact for privacy questions, rights requests, grievances, and other communications concerning the processing described in this Policy.

1.1 GDPR Data Protection Officer

cursus has not appointed a formal Data Protection Officer under Article 37 of the EU GDPR. Based on the current scale, nature, purposes, and territorial scope of processing described in this Policy, cursus presently assesses that the mandatory Article 37 appointment criteria are not met. This assessment will be reviewed if the scale, nature, territorial scope, or purposes of monitoring or special-category processing materially change.

The privacy contact listed above remains the operational privacy contact for EU/UK matters. Nothing in this section prevents cursus from appointing a formal DPO if required or otherwise considered appropriate.

1.2 EU and UK Representative

cursus does not currently maintain an establishment in the EU or UK, has no current EU/UK application user base to the best of its present knowledge, and does not currently intentionally market or target the application to users in those regions. The public website and application may nevertheless be technically accessible from those regions.

If the territorial scope of the EU GDPR or UK GDPR applies to a relevant processing activity and an Article 27 representative is legally required, cursus will designate the applicable representative and update this Policy with the representative's contact details. Accessibility of the service from the EU or UK, without more, is not by itself treated as an admission that Article 3 applies. The absence of a representative designation in this Policy is not intended to waive or negate any obligation that may apply.

1.3 Platforms and Scope of This Policy

cursus operates two distinct web surfaces with materially different data-processing practices.

cursus.in — Public Marketing Website

cursus.in is the public marketing and landing website. No cursus account is required to browse it, and visitors may access it anonymously. We do not operate an age-verification system for anonymous marketing-site visitors, so we may not know whether a particular anonymous visitor is a child or an adult.

Before optional or non-essential analytics cookies are activated on cursus.in, the website presents its cookie-consent mechanism. PostHog is used only on cursus.in for website analytics and marketing-site measurement, and only after the applicable analytics consent is obtained. PostHog is not used on app.cursus.in.

app.cursus.in — Main Application

app.cursus.in is the main productivity and life-management application. Using app.cursus.in requires a cursus account. The application does not use PostHog, third-party product analytics, or advertising analytics. It does not engage in Targeted Advertising. It also does not use Tracking or Behavioural Monitoring for advertising, profiling, or commercial purposes.

The application's ordinary first-party functions — such as tasks, habits, goals, time records, progress calculations, authentication, rate limiting, security logging, account management, and user-entered activity records — are operational/product functions. The application does not use those functions as product-usage analytics, Targeted Advertising, or behavioural profiling.

2. Applicability

2.1 India — Current and Future DPDP Framework

The DPDP Act, 2023 and the DPDP Rules, 2025 have a staggered commencement schedule. As of August 30, 2026, the provisions of the Act that have commenced include Sections 2, 18–26, 35, 38–43 and sub-sections (1) and (3) of Section 44. The Rules that are already in force include Rules 1, 2 and 17–21. Section 6(9) and clause (d) of Section 27(1) are scheduled to commence on November 13, 2026. The principal substantive provisions in Sections 3–5, Sections 6(1)–(8) and 6(10), Sections 7–17, Section 27 except clause (d), Sections 28–34, Sections 36–37 and Section 44(2), together with Rules 3, 5–16, 22 and 23, are scheduled to commence on May 13, 2027. Rule 4 is scheduled to commence on November 13, 2026. This Policy therefore does not describe later-commencing provisions as current statutory obligations merely because they have already been enacted or notified.

cursus nevertheless intends to maintain a privacy framework that is substantially aligned with the future DPDP requirements in advance of their applicable commencement dates, where reasonably practicable.

The future-ready approach described above includes preparing for requirements concerning notice, consent, children's data, security, breach handling, rights, retention, and grievance mechanisms.

The current Indian privacy framework may also include other laws and rules that remain applicable to the processing described in this Policy. In particular, to the extent applicable, the Information Technology Act, 2000, Section 43A, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 remain relevant to sensitive personal data and reasonable security practices until displaced or otherwise made inapplicable by the applicable commencement of later legislation. cursus intends this Policy to also serve as its privacy policy for those purposes to the extent those requirements apply.

2.2 EU GDPR

Where the EU GDPR applies, including where its territorial scope is triggered through an applicable EU establishment, offering of services, or monitoring of behaviour, cursus applies the relevant GDPR requirements described in this Policy.

cursus does not currently intentionally market or target the cursus application to users in the EU/EEA and has no current EU/EEA application user base to the best of its present knowledge. The public marketing website may nevertheless be technically reachable from the EU/EEA.

The fact that a website is technically accessible from the EU/EEA does not, by itself, establish that the EU GDPR applies. Applicability depends on the circumstances and the territorial criteria in Article 3.

2.3 UK Data Protection Law

Where the UK GDPR and associated UK data-protection law apply, cursus applies the requirements relevant to the UK regime.

cursus does not currently intentionally market or target the cursus application to users in the UK and has no current UK application user base to the best of its present knowledge. The public marketing website may nevertheless be technically reachable from the UK.

The UK regime is treated separately from the EU GDPR because the UK data-protection framework has been amended by the DUAA and related commencement changes.

2.4 Marketing-Site Cookies and Similar Technologies

On cursus.in, optional or non-essential analytics cookies or similar storage/access technologies are not activated before the site's cookie-consent mechanism is presented and the relevant consent is obtained, according to the current implementation.

Where applicable law imposes additional requirements for cookies or similar technologies, cursus intends to comply with those requirements. The separate Cookie & Local Storage Policy provides the detailed cookie inventory and preference-management information.

2.5 United States and Other Jurisdictions

cursus has not yet commercially launched the application and does not currently process personal data at a scale that cursus assesses as triggering a US state comprehensive privacy law, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), or comparable laws in other US states. This assessment will be reviewed as cursus's user base and processing scale grow.

cursus does not sell personal data and does not share personal data for cross-context behavioural advertising, as those terms are used under CCPA/CPRA.

If and when cursus's processing meets the applicable threshold under CCPA/CPRA or another US state privacy law, cursus intends to provide the additional notices and rights required by that law, which may include rights to know, delete, correct, or opt out of the sale or sharing of personal information, and additional protections specific to the personal information of minors.

This section does not limit the rights described elsewhere in this Policy for users located in India, the EU/EEA, or the UK.

3. Grounds for Processing Your Personal Data

3.1 India — DPDP Alignment and Current Indian Law

The DPDP Act's substantive provisions concerning lawful purposes and consent are scheduled for later commencement under the notified implementation timeline. This Policy therefore does not state that those provisions are already operative as of the Last Updated date.

For future DPDP alignment, cursus distinguishes between processing that is consent-based and processing that may fall within the "certain legitimate uses" described in Section 7 of the DPDP Act once the relevant provisions commence.

For current Indian processing, cursus also considers applicable existing law, including the Information Technology Act, 2000 and the 2011 SPDI Rules to the extent applicable. Where consent is required for the processing of sensitive personal data or information, cursus obtains it before the relevant processing.

3.2 Lawful Bases Under the EU GDPR and UK GDPR

Where the EU GDPR or UK GDPR applies, cursus identifies an appropriate lawful basis for each processing activity. The bases below are stated by purpose rather than as a blanket basis for all processing:

cursus does not rely on a user's general consent as a substitute for a separate lawful basis where another lawful basis is appropriate.

3.3 Contract and Consent Are Separate

Creating an account and agreeing to the Terms & Conditions are separate from consenting to optional processing.

Where cursus relies on Article 6(1)(b) for core account/service processing, withdrawal of consent does not by itself invalidate the contractual basis for processing that is objectively necessary to provide the service. Where processing is genuinely based on consent, that consent may be withdrawn as described in Section 5.

3.4 Optional Special-Category Features

The Forge and Mindfulness modules are optional. Where their data is special-category data under the EU GDPR, cursus obtains the separate explicit consent described in this Policy before relying on that consent basis.

Users may delete the relevant Forge or Mindfulness data through the corresponding application features without having to delete unrelated parts of their cursus account.

4. Notice Regarding Personal Data Collected and Purpose of Processing

This section describes the categories of data processed by cursus and the purposes for which the data is used. Some of the legal requirements referenced elsewhere in this Policy are future-facing because of the phased commencement of the DPDP Act and DPDP Rules.

4.1 Standard Personal Data

4.2 Special Categories of Personal Data

The DPDP Act does not use the same "special category" terminology as the EU GDPR. To the extent the Indian SPDI Rules or other applicable Indian law apply, specified categories such as passwords, financial information, and certain health-related information may receive specific protection under that separate framework. Under the EU GDPR, the following categories may constitute special-category data where the information falls within Article 9:

These fields are optional. cursus does not intentionally infer these categories from other activity on the Platform. Where a user enters information that falls within a protected category under applicable law, the relevant safeguards described in this Policy apply.

4.3 Data We Do NOT Collect

cursus does not intentionally collect, process, or store:

• Biometric data such as fingerprints, facial-recognition templates, retinal scans, or voice prints.
• Payment-instrument credentials such as full card numbers, bank-account credentials, or UPI authentication credentials.
• Precise or approximate geolocation for the purpose of tracking a user's location.
• Device sensor data such as accelerometer or gyroscope data.
• Phone contact lists or address-book data.
• Camera or microphone recordings through the application.
• Social-media profiles or unrelated social-media account content.
• Browsing history from websites other than cursus.in through PostHog.
• Google Calendar, Google Tasks, Google Drive/Docs, Google Fit, or other Google product content beyond the information required for the selected sign-in method.

This section does not mean that cursus receives no technical data from third parties or automated systems. For example, Razorpay provides limited billing/subscription metadata, Google may provide basic sign-in information, and operational systems generate technical security and diagnostic records as described elsewhere in this Policy.

4.4 Data Minimisation

cursus limits collection to information reasonably required for the relevant function, account administration, security, billing, consent evidence, legal obligations, or other specified purposes described in this Policy. Optional modules are not required for use of unrelated parts of the application.

4.5 Google Sign-In — Scope and Revocation

Google OAuth 2.0 is used solely as an alternative sign-in method using the standard account/profile scope required for that authentication flow. cursus does not request special or unrelated Google product scopes and does not access or synchronise Google Calendar, Google Tasks, Google Drive/Docs, Google Fit, or other Google product content through the sign-in integration.

If you disconnect Google sign-in from your account, cursus revokes and deletes the associated OAuth credential(s) that it controls where technically applicable. The remainder of your account is not deleted merely because you disconnect the Google sign-in method.

4.6 Marketing Website Analytics (cursus.in)

The public marketing website, cursus.in, uses an EU-hosted PostHog Cloud deployment for ordinary website analytics and marketing-site measurement. The implementation uses standard website analytics only; it does not use session replay, screen recording, surveys, or similar session-observation features. The PostHog implementation is limited to cursus.in and is not deployed in the main application.

The analytics are intended to help cursus understand how the public website performs, including:

• which marketing pages are viewed;
• where visitors came from or which referral/source information led them to the site, where available;
• which buttons, links, and sections are interacted with;
• which sections are viewed, skipped, or navigated away from;
• how long visitors spend on pages or sections; and
• general browser/device and navigation information.

PostHog is activated on cursus.in only after the relevant cookie-consent choice has been obtained through the marketing site's consent mechanism.

PostHog is not used on app.cursus.in.

PostHog analytics are not used for Targeted Advertising, cross-site advertising, or observation of what a visitor does on unrelated websites. The analytics are intended to describe activity on cursus.in itself, such as referral source, page or section views, clicks, time spent, navigation, and skipped or abandoned sections.

cursus does not intentionally configure PostHog to collect the categories of sensitive information listed in Section 4.2. PostHog is used for website analytics rather than for collecting or inferring health, financial, biometric, religious, political, sexual, or other sensitive categories of information. The precise data received remains dependent on the live analytics configuration, and cursus will keep this description aligned with that configuration.

4.7 Operational Monitoring — Sentry, Datadog, and Security Infrastructure

cursus uses Sentry and Datadog for operational monitoring, error diagnostics, API health, availability, and request-failure troubleshooting.

These systems are used for technical service monitoring, not product analytics, behavioural advertising, or user-profile construction. Sentry and Datadog may receive technical API/error information, including request/response and diagnostic information needed to investigate failures, but cursus excludes cookies and user-submitted request payload data from that telemetry. They are not used to measure which application features, buttons, pages, or other user activities a person uses.

Application infrastructure may also generate security, authentication, rate-limiting, abuse-prevention, or API diagnostic records. Such records exist to secure and operate the service and are not used for product-usage analytics, Targeted Advertising, or behavioural advertising.

4.8 Marketing-Site and Security Technologies

Google Fonts: cursus.in may load font resources from Google-hosted servers. This is a presentation/website-functionality dependency and is not used by cursus for analytics or advertising. Because the browser requests these resources directly from Google's servers, Google may receive technical request information under Google's own privacy terms.

Social links: cursus.in may contain links to cursus's social-media accounts. These are links to external sites, not embedded social-media widgets operated by those platforms within the cursus page. Clicking a social link takes you to the external service, which then processes information under its own policies.

Cloudflare Turnstile: Cloudflare Turnstile is used at the Cloudflare layer to protect app.cursus.in APIs against automated abuse and bots. cursus does not use Turnstile for analytics, advertising, or product-usage measurement. Cloudflare may process technical signals required to provide the anti-bot service under its own privacy terms; cursus does not use those signals to profile or advertise to users.

4.9 In-App Community and Squad Messaging

app.cursus.in includes an in-app community feature (organised into shared spaces and channels) and a separate "Squad" feature limited to groups of up to 10 members. cursus does not offer private, one-to-one direct messaging.

Content posted in the community or in a Squad is visible to other members of that community or Squad respectively; it is not private personal content belonging only to the posting user.

Moderation. Messages are screened by an automated abuse filter before being sent. The safeguards are applied to users generally, including adults and minors, and are designed to block abusive or sexually exploitative content and prevent spam or message flooding. Depending on the content, a message may be partially masked, blocked outright with the sender notified, or allowed to send. Repeated violations may lead to escalating restrictions on a user's ability to send messages, up to a temporary or extended suspension of messaging privileges, determined by the automated system or by a human moderator reviewing the matter. Users may also report content or other users to moderators, who may take further action. Users may also block other users. When a user blocks another user, the blocked user cannot interact with the blocking user through the relevant community features, including viewing the blocking user's messages, mentioning the blocking user, messaging the blocking user, or sending the blocking user Squad invites, and cannot view the blocking user's profile. The blocking user's other community access remains available, subject to the blocking controls. These blocking controls are provided through the application.

Retention. Community and Squad content is not deleted when a user deletes their account, because it is shared content visible to other members rather than personal content exclusive to that user. Separately, community and Squad content is subject to a rolling retention process under which older messages may be removed once a channel or Squad's message volume passes an internal threshold. Content that has been reported for moderation is excluded from this rolling removal and is retained for up to one (1) year, unless deleted earlier by an authorised moderator or a longer period is required for a legal or safety purpose. This supports moderation review, misuse investigations, and cursus's ability to respond to legal or safety obligations.

5. Consent

5.1 Account Consent

Where cursus relies on consent as the applicable legal basis, consent is obtained through a clear affirmative action.

For registered app.cursus.in accounts, the account-registration consent record may include the timestamp, IP address, screen-size information, consent method, and other technical metadata captured by the registration flow, together with the relevant policy/version information.

Consent is:

• Free — not obtained through coercion or deception and not used as a condition for processing that does not require consent.
• Specific — tied to specified processing purposes.
• Informed — preceded by the relevant privacy information.
• Unambiguous — given through a clear affirmative action.

Consent is not used as a substitute for contract necessity, legal obligation, legitimate interest, or another appropriate lawful basis where that basis properly applies.

5.2 Consent Logging

For registered application users, cursus maintains an auditable record of consent actions where consent is relied upon. Depending on the relevant flow, the record may include:

• timestamp;
• IP address;
• consent method;
• screen-size information and other technical metadata collected by the consent/account flow;
• the relevant Privacy Policy or consent version; and
• separate records for distinct explicit consent where applicable.

The current internal retention period for account-level consent records is three (3) years after account closure or withdrawal of the relevant consent, unless a longer period is required by applicable law or necessary for the establishment, exercise, or defence of legal claims. The three-year period is an internal retention policy and is not represented as a universal statutory retention requirement.

Anonymous cookie-consent interactions on cursus.in are handled through the site's cookie-consent mechanism. cursus does not create or maintain an individual account-level database record for each anonymous visitor's cookie-consent choice.

5.3 Consent Manager

The statutory Consent Manager framework under the DPDP Rules is subject to its own commencement date. cursus will use or integrate with a registered Consent Manager where required by applicable law and when the relevant provisions are in force.

Until then, consent for registered app.cursus.in processing is managed through the account settings and privacy-contact mechanisms described in this Policy.

5.4 Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent at any time.

For optional Forge or Mindfulness processing, you may delete the relevant data through the corresponding module controls or contact raushankumar@cursus.in.

Withdrawal of consent does not invalidate processing that was lawfully completed before withdrawal and does not automatically terminate processing that is based on a different lawful basis, such as contract necessity or legal obligation.

Deleting your cursus account remains separately available through the application.

5.5 Marketing-Site Cookie Consent

On cursus.in, optional or non-essential analytics cookies and similar technologies are activated only after the visitor is presented with the cookie-consent mechanism and provides the relevant consent.

Cookie consent is separate from account consent and is separate from parental consent.

Accepting the cookie banner does not establish that the visitor is an adult and does not constitute verifiable parental consent unless applicable law expressly provides otherwise.

The separate Cookie & Local Storage Policy contains the more detailed description of the technologies used on cursus.in and the available preference controls.

6. Children's Privacy

6.0 Separate Treatment of the Two Surfaces

The child-privacy analysis differs between the public marketing website (cursus.in) and the account-based application (app.cursus.in).

Anonymous visitors to cursus.in may be children, adults, or persons whose age is unknown to us. We do not operate a reliable age-verification system for anonymous marketing-site visitors.

By contrast, app.cursus.in is an account-based application in which the registration flow requires the user to provide their date of birth. The registration flow uses the date of birth provided by the user to apply the applicable age and parental-consent process. cursus does not permit account registration by anyone under the age of 13. Where the date of birth provided indicates the user is 13 or older but under 18, the current account flow requests the email address of a parent or lawful guardian and sends a consent request to that address.

6.1 app.cursus.in — Child Account Consent

The cursus application is available to users aged 13 and older. Registration by anyone under 13 is not permitted, as described in Section 6.0.

Where the date of birth provided at registration indicates the user is 13 or older but under 18, the current implementation:

1. asks the user to provide a parent or lawful guardian's email address;
2. sends a consent request to that address containing relevant information and an affirmative consent mechanism;
3. activates the child account only after the parent/guardian completes that consent action; and
4. records evidence of the consent action, including the timestamp, IP address, screen-size information, consent version, child/account identifier, consent method, and other technical metadata captured by the consent flow.

Where the registration information indicates that an account belongs to a user under 13, cursus does not permit that account to remain active and will delete the associated personal data, subject to any information that must lawfully be retained.

This email-based mechanism is the current implementation. It should not be described as equivalent to every future identity-verification requirement that may become operative under the DPDP Rules.

The DPDP Rules, 2025 contain additional standards for verifying parental consent that are scheduled for later commencement. cursus intends to align its child-consent mechanism with those requirements before their applicable commencement date. The current email-consent flow is not represented as satisfying those future verification standards.

6.2 Age Threshold

cursus voluntarily uses 18 years as its global account age threshold for child-protection purposes, and separately applies a hard minimum registration age of 13 years below which account creation is not permitted at all, as described in Section 6.1. This is a product policy and internal safeguard; it is not represented as a universal statutory age threshold in every jurisdiction.

For the EU GDPR and UK GDPR, child-consent rules are jurisdiction-specific and depend on the applicable lawful basis and territorial scope. The use of an 18-year internal threshold does not by itself establish that every child-related legal obligation in every jurisdiction has been satisfied. cursus will apply the stricter internal threshold where appropriate while separately complying with any mandatory jurisdiction-specific requirements that apply.

6.3 No Detrimental Processing

cursus does not intentionally design app.cursus.in to process children's personal data in a manner likely to cause a detrimental effect on a child's well-being.

The application does not intentionally use anxiety-inducing, manipulative, or fear-based notifications to increase engagement, and does not intentionally use dark patterns designed to increase screen time or compulsive usage.

Gamification features such as Aura scores, streaks, badges, and progress indicators are intended as first-party product functionality rather than advertising or behavioural advertising.

The in-app community and Squad messaging feature described in Section 4.9 is accessible to users aged 13–17 with an activated account on the same basis as other users; cursus does not currently operate a separate age-segregated version of this feature. The automated abuse and sexual-content screening, spam/flooding prevention, user reporting, blocking, and moderator-review safeguards described in Section 4.9 apply to users generally, including both adults and minors. Blocking prevents the blocked user from interacting with the blocking user through the relevant community features, including sending Squad invites.

6.4 No Tracking, Behavioural Monitoring, or Targeted Advertising on app.cursus.in

app.cursus.in does not use:

• PostHog;
• Google Analytics;
• third-party product-analytics systems;
• third-party advertising trackers;
• Targeted Advertising; or
• behavioural monitoring for advertising, profiling, or commercial purposes.

This is a platform-wide design choice and is not limited only to users who identify as children.

Ordinary first-party application functionality, authentication, security logging, rate limiting, API diagnostics, and user-entered productivity records are not used for Targeted Advertising.

6.5 cursus.in — Public Marketing Website

The public marketing website is materially different from app.cursus.in.

• Anonymous visitors: a visitor may browse without an account, and cursus may not know whether that visitor is a child or an adult.
• Cookie consent: optional/non-essential analytics cookies are presented behind the site's cookie-consent mechanism.
• PostHog: used only on cursus.in and only after the applicable analytics consent.
• No Targeted Advertising: cursus does not use PostHog or any other system on cursus.in for Targeted Advertising.
• No cross-site tracking: PostHog is configured for analytics of cursus.in and is not used to observe what a visitor does on unrelated websites.
• No age-verification claim: cursus does not claim to identify every anonymous marketing-site visitor as a child or adult.
• Consent distinction: accepting the cookie banner is not treated by cursus as proof that the visitor is an adult or as verifiable parental consent.

cursus does not rely solely on the fact that age is unknown as a legal justification for processing. The legality of any particular marketing-site processing depends on the actual technology, the data processed, the consent obtained, and the applicable law.

6.6 Rights of Parents and Guardians

A parent or lawful guardian who believes that a child has an account or whose child has provided personal data to cursus may contact raushankumar@cursus.in regarding access, correction, deletion, consent withdrawal, or other applicable rights.

6.7 Future DPDP Child-Protection Requirements

The DPDP Act's child-specific obligations and the corresponding detailed Rules are subject to the statutory commencement schedule. cursus will review and update the child-account consent mechanism before the relevant provisions become operative and will not represent future Rule 10 verification standards as already implemented when they are not.

7. Data Processor Disclosure and Third-Party Services

7.1 Responsibility

cursus is responsible for processing carried out by us or on our behalf by a processor, subject to the applicable legal framework and the contractual allocation of responsibilities with each provider.

7.2 Third-Party Services and Subprocessors

Provider roles may vary for different data flows because a vendor can act as a controller for its own independent purposes and a processor for other services. This Policy therefore does not assume that every vendor is a processor for every category of processing.

7.3 Supabase and Application Data

cursus uses Supabase for database storage and authentication infrastructure. A DPA is in place with Supabase.

Row-level security is enabled for the application database, and the application is designed so that users cannot ordinarily access another user's data through the normal application interface.

7.4 Operational Monitoring and Logging

Sentry and Datadog are used for technical service monitoring, including API failure diagnosis, request/response diagnostics, debugging, and service availability. cursus does not use these tools as product analytics systems and does not use them to measure feature usage or user behaviour in the application.

Where infrastructure generates logs for authentication, rate limiting, security, abuse prevention, API diagnostics, or similar operational purposes, such data is used to secure and operate the service rather than for advertising or behavioural profiling.

8. Security Safeguards

8.1 Technical and Organisational Measures

cursus maintains technical and organisational measures appropriate to the nature and risks of the processing described in this Policy, including:

• Encryption in Transit: Data transmitted between your device and our servers uses HTTPS/TLS.
• Encryption at Rest: Personal data stored in the primary application database is encrypted at rest using the security capabilities provided by the underlying infrastructure.
• Row Level Security (RLS): Database policies are enabled to restrict authenticated users' ordinary database access to their own data.
• Cookie-Based Authentication: Authentication and session management for app.cursus.in use server-issued cookies.
• Password Security: Passwords are stored only in cryptographically protected form and are not stored in plaintext.
• Access Controls: Administrative production-database access is restricted to authorised personnel and logged.
• Operational Monitoring: Sentry and Datadog are used for technical/API diagnostics and service reliability.
• Rate Limiting and Abuse Prevention: Infrastructure-level controls are used to manage request volume and prevent abuse.

No security measure can guarantee that unauthorised access, loss, or compromise will never occur.

8.2 Security and Applicable Law

cursus maintains reasonable security safeguards and reviews them periodically in light of applicable law and the evolving risks of the service. Where an applicable law prescribes a specific security standard or reporting duty, cursus will follow that requirement when it is legally operative.

9. Personal Data Breach Notification

9.1 India

Where an applicable Indian law requires notification of a personal-data or cyber-security incident, cursus will notify the relevant authority and affected individuals within the applicable form and timelines.

The DPDP Act and Rules contain a future-facing breach-notification framework whose detailed provisions are subject to the statutory commencement schedule. cursus will comply with those provisions when they become operative.

Nothing in this Section is intended to displace other currently applicable Indian incident-reporting requirements, including applicable CERT-In directions.

9.2 EU GDPR

Where the EU GDPR applies, cursus will assess personal-data breaches under Articles 33 and 34 and will notify the competent supervisory authority without undue delay and, where required, within 72 hours of becoming aware of a notifiable breach. Affected data subjects will be notified without undue delay where Article 34's high-risk threshold is met.

9.3 UK

Where UK data-protection law applies, cursus will follow the applicable UK breach-notification requirements and any applicable ICO reporting obligations.

9.4 Incident Response

cursus maintains an internal incident-response process to detect, contain, investigate, document, and respond to security and personal-data incidents.

Where more than one legal regime applies, cursus will comply with each applicable requirement rather than assuming that one jurisdiction's notification threshold or timing automatically governs all affected populations. Applicable Indian cyber-incident reporting duties, including CERT-In requirements where applicable to the incident and entity, remain separate from privacy-regulator notification duties.

10. Data Retention and Erasure

10.0 Retention Principle

cursus retains personal data only for as long as reasonably necessary for the purpose for which it is processed, for legitimate operational needs, or where retention is required or permitted by applicable law.

The specific periods below are cursus retention practices, not statements that every corresponding period is universally prescribed by statute.

10.1 Active Accounts

We retain account and product data while the account remains active and the relevant service purposes continue.

10.2 Automatic Erasure for Inactive Accounts

cursus currently applies the following account-retention practices:

1. Incomplete Registration — 3 days: Accounts that are initiated but do not complete required onboarding, email verification, or required parental-consent steps within three (3) days may be permanently erased.
2. Unpaid Abandonment — 30 days: Unpaid accounts with no login or interaction for thirty consecutive days may be treated as abandoned and permanently erased.
3. Paid Subscription — 60-day grace period: Following expiry or cancellation of a paid subscription, account data is retained for up to sixty days to allow data export or reactivation. After that period, the account data is permanently erased subject to the exceptions below.

These timelines are internal retention rules adopted by cursus and are not represented as universal statutory deadlines.

10.3 Deletion Requests and Consent Withdrawal

Upon an account-deletion request, cursus immediately deletes the relevant personal data from the production database and active production systems, including account credentials, OAuth credentials controlled by cursus, application account data, billing/subscription references stored by cursus, and account-level consent records, subject to data that must lawfully be retained or shared content that remains under Section 4.9.

Community and Squad messaging content described in Section 4.9 is not deleted as part of account deletion, because it is shared content visible to other members rather than personal content exclusive to the deleting user; it remains subject to the separate retention process described in Section 4.9. Blocking another user does not itself delete previously posted community or Squad content; it only affects what the blocking user can see from the blocked user and whether the blocked user can send Squad invites to the blocking user.

Data contained in backups is deleted or expires through the applicable backup lifecycle, with the objective that the relevant data is removed from backups within 30 days.

Optional Forge and Mindfulness data may also be deleted independently through the relevant module controls.

Where a user withdraws consent for consent-based processing, cursus stops further processing on that consent basis, subject to lawful alternative bases and applicable retention requirements.

10.4 Statutory and Legal-Retention Exceptions

Data may be retained where required by applicable law, including tax, accounting, payment, fraud-prevention, security, or legal-claims requirements. Where an exception applies, cursus will retain only the information reasonably necessary for that purpose and delete it when the retention requirement ends.

10.5 Backup Deletion

Production deletion and backup deletion are separate technical operations. cursus does not represent that a deleted record is simultaneously removed from every backup snapshot at the exact moment of production deletion. The current backup lifecycle is designed to remove relevant deleted data from backups within 30 days, subject to technical restoration and disaster-recovery requirements. This is a technical lifecycle commitment of cursus and does not imply immediate deletion from every backup snapshot at the same instant as production deletion.

11. Your Rights as a Data Principal / Data Subject

This section describes rights available under the DPDP Act, EU GDPR, UK GDPR, and applicable law. Some DPDP rights are future-facing because the corresponding provisions are subject to the statutory commencement schedule.

11.1 Access

You may request information about your personal data and its processing as provided by applicable law.

The Download My Data feature provides a structured JSON export for active accounts. If a paid subscription has ended and dashboard access is restricted, you may request the relevant export by emailing raushankumar@cursus.in. We may verify your identity before disclosing account information. Account deletion does not create a refund entitlement for a subscription that has already been paid for; subscription and refund matters are governed by the Terms & Conditions.

11.2 Correction / Rectification

You may correct or update inaccurate account information through the relevant account settings or by contacting raushankumar@cursus.in.

11.3 Erasure

You may request deletion of your personal data by using the account-deletion feature or by contacting raushankumar@cursus.in, subject to applicable retention exceptions.

11.4 Grievance and Complaints

Contact: raushankumar@cursus.in

For India, cursus will operate a grievance mechanism consistent with the requirements applicable when the relevant DPDP provisions are in force.

As a voluntary service commitment, cursus aims to acknowledge privacy complaints within 48 hours and aims to provide a substantive response within 30 days, subject to the complexity of the matter and any different statutory deadline that applies.

For UK users, applicable UK law currently requires organisations to provide a clear means of making data-protection complaints, acknowledge them within 30 days, take appropriate steps without undue delay, keep the complainant informed, and communicate the outcome without undue delay. cursus will meet the applicable UK requirements where the UK regime applies.

11.5 EU GDPR — Additional Rights

Where the EU GDPR applies, you may have rights including:

• access;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection to processing based on legitimate interests;
• objection to direct marketing;
• and rights concerning solely automated decisions that produce legal or similarly significant effects.

Where consent is the lawful basis, you may withdraw it at any time.

11.6 UK GDPR — Additional Rights

Where UK data-protection law applies, you may have corresponding UK rights, subject to the current UK statutory framework and applicable exemptions.

11.7 Nomination Under the DPDP Act

When the relevant DPDP provision is operative, a Data Principal may nominate another individual to exercise rights in the event of death or incapacity in accordance with applicable law.

11.8 Automated Decision-Making

cursus does not use personal data to make solely automated decisions that produce legal effects or similarly significant effects on you.

Features such as Aura scores, streaks, and productivity statistics are first-party product outputs intended for the user's own use and are not used to make significant legal or similarly significant decisions about access to the service.

11.9 Authentication and Identity Verification

To protect account data, cursus may verify identity before fulfilling certain requests. This may require using information already associated with the account, and is designed to prevent unauthorised disclosure of personal data.

12. Your Duties as a Data Principal

Where the relevant provisions of the DPDP Act are in force, Data Principals have the duties specified by applicable law, including the duty to comply with applicable law, avoid impersonation, avoid materially false information, and provide authentic information in connection with rights requests.

Nothing in this Section creates a separate criminal offence merely because a person provides inaccurate information. Any consequence depends on the law actually applicable to the conduct.

cursus may refuse or limit a rights request where necessary to protect another person's rights, prevent fraud or impersonation, protect security, or comply with applicable law.

13. International Data Transfers

13.1 India

Primary application database storage is in AWS ap-south-1 (Mumbai, India) through Supabase. Other service providers may process limited data through infrastructure outside India, including Google, PostHog, Sentry, Datadog, Razorpay, Google-hosted fonts used on cursus.in, Cloudflare Turnstile used to protect app.cursus.in APIs, or ancillary infrastructure used by Supabase, depending on the relevant service and configuration.

Where Indian law restricts transfers or prescribes transfer conditions once the relevant provisions are operative, cursus will comply with those requirements.

13.2 EU/UK Transfers

If EU or UK personal data is processed and transferred to India or another third country, cursus will use an applicable lawful transfer mechanism required by the relevant regime.

For EU GDPR transfers, where an adequacy decision does not apply, this may include European Commission Standard Contractual Clauses and appropriate supplementary measures where required.

For UK transfers, cursus will use the applicable UK transfer mechanism, which may include the UK International Data Transfer Addendum or another valid mechanism under the UK regime, together with any transfer-risk assessment required by current UK law.

Transfer arrangements will be reviewed against the current destination, vendor contracts, applicable safeguards, and actual processing locations. A representative appointment under Article 27 is legally distinct from an international-transfer mechanism and is not itself a transfer safeguard.

13.3 PostHog

PostHog analytics used by cursus are deployed on the EU-hosted PostHog Cloud environment for cursus.in. The implementation is consent-gated and limited to on-site analytics for cursus.in. PostHog is not used on app.cursus.in. The exact processing and subprocessors are governed by the applicable PostHog contractual/privacy documentation and cursus's vendor arrangements.

14. Significant Data Fiduciary

cursus has not been designated as a Significant Data Fiduciary by the Central Government as of the date of this Policy.

If cursus is designated as a Significant Data Fiduciary, or if obligations applicable to Significant Data Fiduciaries otherwise become relevant, cursus will implement the additional requirements applicable to it, including those concerning a Data Protection Officer, independent data auditor, impact assessments, audits, and other prescribed measures.

15. Exemptions

The DPDP Act permits certain exemptions and allows the Central Government to prescribe classes or circumstances in which specific provisions may not apply.

cursus does not presently rely on a startup or other exemption unless and until a legally applicable exemption is confirmed.

Where an exemption becomes applicable, cursus will document its scope and avoid representing exempt processing as subject to obligations that do not apply. Where no exemption applies, cursus will comply with the applicable law.

16. Right to Lodge a Complaint with a Regulator

16.1 India

When the relevant DPDP grievance and Board provisions are operative and applicable, a Data Principal may have the right to approach the Data Protection Board of India in accordance with the applicable statutory procedure.

16.2 EU GDPR

Where the EU GDPR applies, you have the right to lodge a complaint with a supervisory authority, including the supervisory authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement, subject to the GDPR's rules.

16.3 UK

Where UK data-protection law applies, you may complain to the Information Commissioner's Office (ICO) or other applicable regulator.

You do not need to abandon your statutory right to complain merely because you have first contacted cursus.

17. Consistency with Other Laws

This Policy is not intended to exclude rights or obligations arising under other applicable laws.

Where more than one legal regime applies, cursus will assess and comply with the requirements applicable to the relevant processing rather than assuming that one regime automatically overrides another in every circumstance.

18. Accuracy of This Policy

This Policy describes cursus's data practices, vendors, storage locations, retention practices, and security measures as of the Last Updated date above.

Because technical and legal requirements can change, cursus reviews this Policy periodically and updates it when there is a material change to:

• the categories of personal data processed;
• the purposes of processing;
• the vendors or subprocessors used;
• storage or transfer arrangements;
• retention periods;
• security practices materially described in this Policy; or
• the legal framework applicable to the processing.

If you believe that a statement in this Policy does not reflect our actual practice, please contact privacy@cursus.in.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Where a change materially alters the categories of personal data processed, purposes of processing, or other material aspects of the processing, we will provide notice as required by applicable law.

Where consent is the lawful basis for a materially changed processing purpose, cursus will obtain fresh consent before commencing that new consent-based processing when legally required.

Policy updates do not by themselves create a right for cursus to switch to a new lawful basis without the transparency and legal requirements applicable to that change.

The current version of this Policy will be posted with its revised Last Updated date.

20. Contact Information

For privacy questions, rights requests, grievances, complaints, or questions about the processing described in this Policy:

---

© 2026 cursus. All rights reserved.

This Privacy Policy is governed by applicable law in the jurisdiction relevant to the processing and the person to whom the processing relates. For Indian processing, this includes applicable Indian law and, when operative and applicable, the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. For EU/UK processing within their respective territorial scopes, the applicable EU GDPR, UK GDPR, and other applicable EU/UK privacy law govern to the extent relevant.