Quitzen Studio LLP ("Quitzen", "we", "us") operates the Nicoxit mobile app and website at nicoxit.app (together, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have.
Under the Digital Personal Data Protection Act, 2023 ("DPDPA"), we are the Data Fiduciary for the personal data we process about you.
If you do not agree with this Policy, please do not use the Service.
1. Who We Are
- Legal name: Quitzen Studio LLP
- LLPIN: ACY-6551
- Registered office: B-7 Sarvodaya Vilas, Kuldeep Vihar, 1st Floor, Quarsi Police Station, Aligarh – 202001, Uttar Pradesh, India
- Grievance Officer: Suman Sharma, Designated Partner — grievance@nicoxit.app
- General support: support@nicoxit.app
2. Data We Collect
We collect only what we need. The table below is the full inventory.
2.1 Data you give us directly
| Category | Examples | When we collect it |
|---|---|---|
| Account data | Name (or nickname), email address, hashed password. Any additional profile fields we may offer (for example, phone number) are optional and collected only if you provide them. | Sign-up, profile edits |
| Course activity ("Your Content") | First Sentence, Belief Inventory, Awareness Logs, Journal entries, Breakup Letter, Anchor Statement, Future Self Letter, mood inputs, exercise responses | As you use the course |
| AI Coach conversations | Your messages to the in-app AI coach and its replies | Each Coach interaction |
| Payment data | Billing name, subscription tier, transaction ID, receipt (via Apple, Google, or our payment gateway). We do not store your full card number, CVV, or bank credentials. | At purchase and renewal |
| Communications | Support emails, in-app messages, survey responses, quiz responses (pre-launch waitlist), grievance submissions | When you contact us |
| Referral data | Your referral code, the codes you have used, the referrer and referred user linkage | If you use the referral programme |
2.2 Data we collect automatically
| Category | Examples |
|---|---|
| Device and technical data | Device model, operating system, app version, language, time zone, crash reports, approximate IP-derived region |
| Usage data | Screens visited, features used, module completions, tool usage, session duration, timestamps, referrer URLs |
| Trackers and progress | Course day, days-free counter, streaks, milestones earned, sessions avoided, urge-surf counts, mood trend |
| Advertising and campaign data (with consent, where applicable) | Ad-click identifiers, conversion events, and audience-membership signals used by advertising platforms such as Meta and Google to measure and improve the campaigns we run. Where the applicable law requires consent (for example, cookies on our website), we collect this only if you have consented. See Section 10 |
| Cookies and similar tech (website only) | See Section 10 |
2.3 Data we do NOT collect
- We do not collect government-issued IDs (Aadhaar, PAN, passport) from users.
- We do not collect biometric data.
- We do not collect precise (GPS) location.
- We do not collect from anyone under 18. See Section 11.
3. Why We Collect It (Purposes and Lawful Bases)
Under DPDPA, we process personal data for specified, lawful purposes on the basis of either your consent or the legitimate uses the Act recognises (chiefly, performance of the contract you enter into with us when you use the Service).
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account | Account data | Consent + contract performance |
| Delivering the course, tools, and trackers | Course activity, usage data | Contract performance |
| Personalising the in-app AI coach | AI coach conversations, course activity, trackers | Consent + contract performance |
| Billing, renewals, receipts, refunds | Payment data | Contract performance + legal obligation |
| Sending scheduled emails you opted into (e.g., Future Self Letter at 30/90/180/365 days) | Course activity, email | Consent |
| Product analytics and improvement | Usage data, device data (de-identified where possible) | Legitimate use |
| Fraud prevention, security, abuse detection | Account, device, usage, referral data | Legitimate use |
| Customer support and grievance handling | Communications | Contract performance + legal obligation |
| Advertising, campaign measurement, and marketing | Advertising and campaign data, cookies, pixels, SDK events (where applicable) | Consent where the applicable law requires it (for example, marketing cookies on our website). You can withdraw consent at any time. |
| Legal and regulatory compliance | As required | Legal obligation |
We do not use your in-app content — Your Content, AI coach conversations, mood inputs, journals, Belief Inventory — for advertising, and we do not share it with advertising platforms. Advertising and campaign measurement rely on the pseudonymous interaction data described in Section 4 (Meta and Google rows) and, on our website, on cookies you have consented to (Section 10).
4. Who We Share It With (Sub-Processors)
We share the minimum data needed with vetted third-party providers ("Data Processors") who are contractually bound to process it only on our instructions and to keep it secure. The current sub-processor list is below.
| Sub-processor | Function | Data shared | Region |
|---|---|---|---|
| Anthropic | In-app AI coach — large-language-model inference | AI coach prompts, minimum context needed for a reply. PII redacted before send where practicable. | US region; API calls governed by Anthropic commercial terms |
| Cloud infrastructure and application hosting provider | Application servers, database, backups, and object storage for the mobile app and its backend | All application data | India cloud region |
| Website hosting provider | Hosting nicoxit.app | Website request logs, IP addresses | Provider-controlled region |
| Payment gateway provider | Card / UPI / wallet processing | Billing name, email, transaction data | India or overseas, depending on provider — the specific provider is named at checkout |
| Apple and Google | App-store purchase and subscription management | Purchase receipts | Platform-controlled |
| Transactional email provider | Transactional and lifecycle email (account, receipts, course-triggered emails) | Email address, name, campaign engagement | Provider-controlled region |
| AI coach conversation-memory provider | Auto-summarised conversation memory for the in-app AI coach | AI coach turns and derived summaries | Provider-controlled region |
| Product-analytics provider | Event analytics for product improvement | Pseudonymous event data — no journals, beliefs, or AI coach content | Provider-controlled region; India data-residency configured where offered |
| Observability provider | Crash reports and prompt-trace observability | Error events, redacted trace data | Provider-controlled region |
| Meta Platforms Ireland Ltd. / Meta Platforms, Inc. | Advertising, campaign measurement, retargeting, and lookalike / custom audiences for Facebook and Instagram — through Meta Pixel on our website and, where applicable, Meta SDKs or server-side integrations we may use to run and measure ads | Interaction events, pseudonymous identifiers, hashed email if you provided it | US / EU |
| Google LLC / Google India Pvt. Ltd. | Google Ads conversion tracking and remarketing, Google Analytics, and related Google measurement products — through pixels, tags, SDKs, and server-side integrations we may use across our website and, where applicable, other surfaces where you interact with our brand | Interaction events, pseudonymous identifiers, hashed email if you provided it | US / EU |
| iCall / Vandrevala Foundation / Kiran | Crisis-escalation content — helpline numbers surfaced in-app. No user data is shared with these organisations by us. | — | India |
The specific commercial names of the providers used at any given time are available on request and are disclosed at points of interaction where they matter (for example, the payment gateway is named at checkout). We update this table when we add or change sub-processor categories or add advertising partners. Material changes are notified in-app or by email.
We do not sell your personal data. We share limited, pseudonymous interaction data with the advertising platforms named above (Meta and Google) for the sole purpose of measuring and improving the ads and campaigns we run. Where the applicable law requires consent (for example, marketing cookies on our website), this sharing runs only if you have consented (Section 10). We do not share your in-app content — Your Content, AI coach conversations, mood, journals, Belief Inventory — with any advertising network.
We may disclose personal data if required by law, court order, or a valid request from a competent authority — and, where legally permitted, only after we have tested the legitimacy of the request.
5. AI Training — What We Do Not Allow
The Nicoxit in-app AI coach uses third-party large-language-model APIs (currently Anthropic). We contract with these providers on commercial API terms, which prohibit the provider from using our inputs and outputs to train their generally available models.
- We do not use Your Content or your AI coach conversations to train any third-party AI model.
- We do not allow our sub-processors to use Your Content or your AI coach conversations to train their models.
- If we ever build our own model or fine-tune one on user data, we will notify you in advance, explain what we are doing, and ask for your specific consent. That has not happened as of the effective date of this Policy.
6. Data Residency and International Transfers
The primary datastore for Nicoxit — the application database, backups, and the AI coach conversation-memory store — is hosted in an India cloud region operated by a major cloud infrastructure provider.
Some sub-processors (see Section 4) process data outside India — typically for large-language-model inference, transactional email, product analytics, observability, and advertising-platform integrations. Where personal data is transferred outside India, we rely on the transfer mechanisms permitted under the DPDPA and on the sub-processor's contractual commitments to protect that data at a standard comparable to the DPDPA. You consent to these transfers by using the Service.
7. How Long We Keep Data
| Data | Retention |
|---|---|
| Active account data and Your Content | For as long as your account is active |
| Your Content after account deletion | Deleted within 30 days, except items required for scheduled deliveries you opted into (for example, a Future Self Letter you sealed with a scheduled return date). Those are marked, isolated, delivered, and then deleted. |
| Payment records | Retained as required by Indian law — including the Companies Act, 2013 and applicable tax and GST laws (currently up to 8 years) |
| Support tickets and grievance records | Retained for as long as the matter is active, and thereafter for the period we are required to keep them under applicable law and for legitimate audit and dispute-defence purposes |
| De-identified analytics | Retained indefinitely (cannot be linked back to you) |
| AI coach conversation memory | Deleted with the account; you may also clear coach history from within the app at any time |
| Backups | Overwritten on a rolling basis, typically within 35 days |
If you close your account, we retain the minimum needed to comply with law, resolve disputes, and enforce our agreements — no more.
8. Your Rights
Subject to conditions in the DPDPA, you have the right to:
- Access — obtain a summary of the personal data we hold about you and the sub-processors we have shared it with.
- Correction — ask us to correct inaccurate, misleading, or incomplete data.
- Erasure — ask us to delete your personal data, subject to the retention exceptions in Section 7.
- Grievance redressal — raise a complaint with our Grievance Officer, as set out in Section 14.
- Nomination — nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
- Withdraw consent — where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
You can exercise most of these rights from within the app (Profile → Privacy). For anything else, write to grievance@nicoxit.app. We will verify your identity before acting on a request. There is no charge for reasonable requests; we may refuse or charge for requests that are manifestly unfounded or repetitive.
We aim to respond to requests within 30 days of verification. If we cannot meet that timeline, we will tell you why and give you an expected response date.
9. How We Secure Data
We use commercially reasonable and industry-standard measures to protect your data, including:
- Encryption in transit (TLS 1.2 or higher);
- Encryption at rest for databases and backups;
- Hashed and salted passwords (bcrypt or equivalent);
- Least-privilege access controls and audit logging for engineers and support staff;
- Regular dependency and vulnerability scanning;
- Redaction of personally identifying tokens from data sent to third-party LLM APIs, where practicable.
No system is perfectly secure. If we become aware of a personal-data breach that meets the DPDPA notification threshold, we will notify the Data Protection Board of India and affected users without undue delay, in the manner prescribed by law.
10. Cookies and Similar Technologies (Website)
Mobile app. Our app does not use browser cookies. It uses locally stored identifiers strictly to keep you signed in and to remember app preferences.
Website (nicoxit.app). We use cookies and similar technologies (including advertising pixels loaded from Meta and Google) in four categories:
| Category | Purpose | On by default? | Providers |
|---|---|---|---|
| Strictly necessary | Session, security, load balancing, checkout flow | Yes — the site will not work without these. Not subject to consent. | Us |
| Preferences | Language, theme, cookie-banner choice | Off; enabled when you use the relevant setting | Us |
| Analytics | Pseudonymous product analytics used to improve the website (aggregate traffic, page performance, funnel steps) | Off by default. On only if you consent via the cookie banner. | Our product-analytics provider |
| Marketing | Advertising, campaign measurement, retargeting on Facebook, Instagram, and Google, and conversion tracking for ads we run on Meta and Google platforms | Off by default. On only if you consent via the cookie banner. | Meta Pixel; Google Ads / Google Analytics |
How consent works. On your first visit to nicoxit.app, we show a cookie banner with three choices: Accept all, Reject non-essential, and Manage preferences (where you can toggle Analytics and Marketing independently). Only "Strictly necessary" cookies run before you make a choice.
Withdrawing consent. You can change your choices at any time from the "Cookie preferences" link in the website footer. Withdrawal is as easy as consent.
What the ad pixels do. If you consent to marketing cookies, Meta Pixel and Google's tags may:
- Record that you visited certain pages of nicoxit.app;
- Report back to Meta or Google when you take a conversion action (for example, sign up, subscribe);
- Add you to a custom audience for retargeting; or
- Contribute pseudonymously to a lookalike audience.
Meta and Google act as independent Data Fiduciaries for the data they process about you through their platforms; their privacy notices govern that processing.
No cross-context selling. We do not sell information collected via cookies. We do not share your in-app content — journals, beliefs, AI coach conversations — with advertising platforms.
You can also control cookies in your browser settings.
11. Children
The Service is intended only for adults aged 18 and above. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from someone under 18, we will delete it and terminate the account. If you believe a child has provided us with personal data, please contact grievance@nicoxit.app.
12. Changes to This Policy
We may update this Policy from time to time. If we make a material change — for example, adding a new category of data or a new sub-processor category — we will notify you in-app or by email before the change takes effect. Non-material changes take effect on posting. The current version and effective date are always shown at the top.
13. Third-Party Links
The Service may link to third-party websites or services (for example, helpline websites in the crisis card, or store listings). Those third parties operate under their own privacy policies. We are not responsible for their practices; please review their policies before providing personal data to them.
14. Grievance Officer and Contact
Under the DPDPA and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed the following Grievance Officer:
Suman Sharma Designated Partner, Quitzen Studio LLP Email: grievance@nicoxit.app Address: B-7 Sarvodaya Vilas, Kuldeep Vihar, 1st Floor, Quarsi Police Station, Aligarh – 202001, Uttar Pradesh, India
Acknowledgement window: 48 hours from receipt. Resolution window: 30 days from receipt, in line with applicable law.
If you are not satisfied with our response, you may escalate your grievance to the Data Protection Board of India in the manner notified under the DPDPA.
For general questions or support, email support@nicoxit.app.
Thank you for trusting Nicoxit with something as personal as the belief you're testing. We take that seriously.