Privacy Policy

21today ("21today", "we", "us") is a habit-challenge app that helps you run 21-day sprints, check in daily, earn rewards, and share progress with a community. The service is operated by Shalini Nemchand Mahajan, Shalini Nemchand Mahajan / 21today, at Indis One City, KPHB, Hyderabad, India.

For the purposes of the DPDP Act, we are the Data Fiduciary that decides how and why your personal data is processed, and you are the Data Principal. This policy explains what we collect, why, your rights, and how to reach us. It should be read with our Terms of Service.

21today is intended for the Indian market and for users aged 18 and over only. By creating an account you confirm you are 18 or older and you consent to the processing described here. We process your personal data on the basis of your consent and, where permitted by law, for certain legitimate uses (for example, keeping the service secure and preventing fraud).

Your consent is specific to the purposes in Section 4. You can withdraw consent at any time, as easily as you gave it, from in-app settings or by contacting our Grievance Officer (Section 14). Withdrawing consent does not affect processing already carried out, and may mean parts of the service can no longer function.

We currently serve users in India. If we begin offering the service in the EU, UK, or other regions, we will publish region-specific terms (for example, GDPR legal bases and rights) at that time.

• Account & identity — your mobile number (our primary sign-in, verified by a one-time code sent via WhatsApp or SMS) or, if you use Google Sign-In, your Google account name, email address and profile picture. We do not use passwords.
• Profile data — display name, username, avatar, focus areas, level, and coin balance.
• Challenge & wellness activity — challenges you create, daily task completions, streaks, badges, and the goal areas you choose (which may include fitness, sleep, nutrition, mindfulness and similar). Some of this can indicate aspects of your health or lifestyle; we process it only to run the service.
• Check-in photos — selfies or proof photos you capture using your device camera. These are private by default and are not used for facial recognition or any biometric identification.
• Community content — posts, comments, reactions, and follows.
• Payment & wallet data — plan purchases, transaction records, coins earned, and in-app credit. Card and bank details are collected and processed directly by our payment gateway (Cashfree) and are never stored on our servers.
• AI coach interactions — the messages and plan inputs you provide to "Coach GOAT" (see Section 6).
• Technical data — device type, app version, push-notification token, IP address, and error/diagnostic logs needed to operate and secure the app.

• To create and run your account, challenges, streaks, badges and reminders.
• To calculate coins, earn-back credit, and referral rewards, and to process payments.
• To provide AI-generated plans and coaching (Section 6).
• To show your posts and public profile to others only when you explicitly choose to share.
• To send you service messages (e.g. OTPs, reminders you enable, important notices).
• To fix bugs, prevent abuse and fraud, and keep the service secure (a legitimate use).
• To comply with law and enforce our Terms.

We use your data only for these purposes. We do not sell your personal data, and we do not run third-party advertising or ad-tracking.

After a check-in photo is captured, you choose whether to keep it private or share it. Private photos are visible only to you. If you share a post, its content (and your display name, username, avatar and level) appears in the community feed and on your public profile page at 21today.in/u/… until you delete it. Deleting a post removes it from the feed. Your mobile number, email, and date of birth are never shown publicly.

Coach GOAT is powered by Google's Gemini models (Gemini 2.5 Flash and Flash-Lite), accessed through the Lovable AI Gateway. When you use the coach, your message, up to your 30 or 100 (depending on the plan) most recent coach messages, and a system prompt are transmitted to that service to generate a reply. Your coach messages are stored in your account under access rules that restrict them to you.

The AI coach is available on eligible paid plans (Resolve 41 and above). If you prefer not to use AI processing, simply do not open the Coach GOAT screen — the rest of the app works without it. Coach replies are informational only and are not medical, psychological, financial, or other professional advice. Please do not share sensitive personal information with Coach GOAT. Please treat messages to Coach GOAT as potentially processed by the provider for service improvement.

We share personal data with service providers ("Data Processors") who process it on our behalf under contract, only to run 21today:

We may also disclose data if required by law, to enforce our Terms, or to protect our rights, users, or the public. If the business is transferred (e.g. a sale or merger), data may transfer to the successor under this policy.

Your account and activity data are stored in the Asia-Pacific (Sydney, Australia) region through our managed cloud backend. AI coach interactions are additionally processed by the providers listed in Section 7, which may be located in other countries. If you access 21today from outside Australia — including from India — your data will be transferred to and processed in these locations. We transfer only to countries not restricted by the Government of India, and rely on contractual and security safeguards to protect it. By using 21today you consent to these transfers.

We keep personal data only for as long as needed for the purposes above, or as required by law:

• You can delete individual challenges and posts inside the app at any time.
• You can request deletion of your entire account from in-app settings or via our Grievance Officer. We will action verified requests within 90 days.
• After deletion or withdrawal of consent, we erase your personal data except where we must retain it — for example, payment and tax records (kept for the period required under Indian law, generally up to 8 years) and limited records needed to prevent fraud or resolve disputes.
• Backups are purged on our normal rotation cycle.

We use reasonable security safeguards, including transport encryption (HTTPS), row-level access rules so users can only read their own private records, one-time-code authentication, and access controls. No system is perfectly secure; you are responsible for keeping access to your mobile number and Google account secure. In the event of a personal-data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act (Section 13).

Under the DPDP Act you have the following rights, which you can exercise from in-app settings or by contacting our Grievance Officer:

• Access — a summary of the personal data we process about you.
• Correction & update — correct or complete inaccurate data.
• Erasure — delete your data where no longer needed.
• Withdraw consent — as easily as you gave it.
• Grievance redressal — have complaints addressed by us first.
• Nomination — nominate someone to exercise your rights if you die or become incapacitated.

We will respond to verified requests within the timelines required by law. We may need to verify your identity before acting.

21today is only for users aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that a person under 18 has created an account, we will suspend it and delete the associated data. If you believe a minor is using the service, contact our Grievance Officer.

If a personal-data breach occurs, we will assess it promptly and notify the Data Protection Board of India and the affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and its Rules.

For any questions, requests, or complaints about your personal data, contact our Grievance Officer:

• Name: Shalini Nemchand Mahajan
• Email: care@21today.in
• Address: Indis One City, KPHB, Hyderabad, India

We aim to acknowledge grievances within 7 working days and resolve them within the statutory period. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.

We use essential cookies and browser storage to keep you signed in and to remember preferences such as your theme. We do not use them for advertising or cross-site tracking. If we later offer the service in regions requiring cookie consent (e.g. the EU/UK), we will present a consent banner there.

We may update this policy. For material changes, we will give reasonable notice — for example, by in-app notice or email — before they take effect, in addition to updating the "last updated" date. Continued use after changes take effect means you accept the updated policy.

You use 21today voluntarily. You decide whether to register, which information to provide, what to post publicly, and what to enter into Coach GOAT. You are responsible for keeping access to your mobile number and Google account secure.

We apply reasonable security safeguards (Section 10), but — as with any online service — we cannot guarantee absolute security, and some risks (such as unauthorised access, interception, or events beyond our reasonable control) cannot be entirely eliminated.

To the maximum extent permitted by law, and provided we have met our legal obligations, 21today and its operator will not be liable for indirect, incidental, special, or consequential loss, or for loss arising from causes beyond our reasonable control. Where liability cannot be excluded, our total aggregate liability is limited to the amount you paid us in the 12 months before the event giving rise to the claim or ₹612 (Monthly Unbreakable 51 plan for 1 year), whichever is lower.

You agree to indemnify 21today and its operator against claims, losses, and costs arising from your misuse of the service, the content you post, or your breach of this policy or our Terms. These limitations are set out more fully in, and governed by, our Terms of Service.

This policy is governed by the laws of India, and any disputes are subject to the exclusive jurisdiction of the courts at Hyderabad, Telangana, India.