Privacy Policy

This Privacy Policy explains how ExoF ("ExoF", "we", "us") handles your personal data when you use exof.in. It sits alongside our Terms of Service; where the two overlap, this Policy governs data handling.

For the purposes of the Digital Personal Data Protection Act, 2023, ExoF is the Data Fiduciary for the data described here, and you are the Data Principal. We operate from India and this Policy is read under Indian law.

We have written this to be read, not to be survived. If any part of it is unclear, ask us and we will explain it in plain terms.

We collect only what a given feature needs. Most of ExoF works before you have an account at all.

Account data

• Your email address and the name you give us, when you create an account.
• If you sign in with Google, the email address and basic profile name Google returns. We do not receive your Google password, and we do not request access to your Gmail, Drive, contacts, or any other Google data.
• Authentication records — sign-in times and session tokens — held by our authentication provider so you stay signed in.

Assessment answers

• Your answers about your primary goal, diet, activity level, sleep quality, sunlight exposure, dietary fibre intake, monthly budget, and stated preferences.
• These answers describe lifestyle and dietary context rather than a medical history. We do not ask for diagnoses, prescriptions, test results, or clinical records — please do not send them to us.
• We treat these answers as sensitive regardless, because they concern your body and habits, and we do not use them for advertising or sell them to anyone.

Stack and order data

• The ingredients and products you add to your stack.
• For an order: the items, the prices and savings at the time you ordered, your chosen plan, your delivery name, phone number and address, and the version of the Terms you accepted.
• If you order as a guest, the email address you give us so we can send the confirmation and so you can retrieve the order later.

Technical data

• Standard server logs kept by our hosting provider — IP address, request time, page requested, user agent — used to serve the site, diagnose faults, and rate-limit abuse.
• We do not run advertising trackers, third-party analytics pixels, or cross-site profiling on ExoF.

Each purpose below is the only reason the matching data exists on our side:

• To generate your recommendations. Your assessment answers are run through our recommendation and safety engines, which are deterministic — the same answers always produce the same result, and every suggestion can be traced to a rule.
• To keep your work. Your stack, assessment and orders are stored so they survive across your devices once you have an account.
• To fulfil and confirm orders, including sending the confirmation email and honouring the plan you chose.
• To keep accounts secure — sign-in, password reset, and detecting abuse of our email endpoint.
• To meet legal and record-keeping obligations, including retaining proof of the Terms you accepted at checkout.

We do not use your data to train machine-learning models, and we do not sell or rent it. The free layer of ExoF contains no AI at all — recommendations come from versioned rule files, not a model.

We process your personal data on the basis of the consent you give when you use a feature, and for the specific purposes described in Section 3. Giving that consent is a choice, and you can decline any individual step.

• You can browse the catalogue and read every ingredient page without giving us anything.
• You can complete an assessment and build a stack without an account — that work stays in your browser until you choose to sign in.
• You can order as a guest without creating an account; we then hold only what the order requires.
• You can withdraw consent at any time by asking us to delete your account and data (Section 8). Withdrawal does not undo processing already carried out lawfully, and it may mean we can no longer provide parts of the service.

ExoF is anonymous-first, which means some of your data lives on your device rather than with us. We store the following in your browser's local storage:

• Your assessment answers and your stack, before you have an account.
• Orders you have placed, so a confirmation is available offline.
• Your light or dark theme preference.

This is not tracking and it is not shared with us until you sign in, at which point your local work is merged into your account. Clearing your browser data removes it — including guest orders held only there, which is why we also let you retrieve an order by its number and email.

We use cookies strictly to keep you signed in. We do not set advertising or cross-site tracking cookies.

We use a small number of service providers, each engaged as a Data Processor under contract, each limited to a single job:

• Supabase — accounts, authentication, and the storage of your assessment, stack and orders.
• Vercel — hosting and content delivery for the site itself.
• Resend — delivery of transactional email such as order confirmations and password resets.
• Google — only if you choose to sign in with Google, and only for that sign-in.

Beyond these, we disclose personal data only where the law requires it, where it is necessary to establish or defend a legal claim, or where you explicitly ask us to. We do not sell personal data, and we do not share it with advertisers or data brokers.

Our providers operate global infrastructure, so your data may be stored or processed outside India. Where that happens we rely on the provider's contractual data-protection commitments, and we transfer only to countries not restricted for this purpose under Indian law.

Under the Digital Personal Data Protection Act, 2023 you have the following rights over your data, and we will act on any of them free of charge:

• Access — a summary of the personal data we hold about you and how it is being processed.
• Correction — to have inaccurate or incomplete data corrected, and out-of-date data updated.
• Erasure — to have your data deleted, unless we are required by law to keep a specific record such as an order and its Terms acceptance.
• Withdrawal of consent — to stop processing that relies on your consent, going forward.
• Nomination — to nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Grievance redressal — to complain to us and receive an answer, before escalating anywhere else.

Write to support@exof.in from the address on your account and we will respond within 30 days. We may ask you to confirm your identity first — not to obstruct you, but because we should not hand your data to someone else claiming to be you.

If you are not satisfied with our answer, you may escalate to the Data Protection Board of India.

• Account, assessment and stack data: kept while your account is open, and deleted when you close it or ask us to erase it.
• Order records: kept for as long as required for financial, tax and legal record-keeping, then deleted. This is the one category we cannot erase on request while the obligation stands.
• Server logs: kept for a short operational window and then rotated out.
• Rate-limiting records for our email endpoint: held in memory for one hour and never written to disk.

• All traffic to and from ExoF is encrypted in transit over HTTPS.
• Every table holding user data uses row-level security, so one account's rows cannot be read by another.
• We never see or store your password — authentication and password hashing are handled by our authentication provider. Google sign-in never exposes your Google password to us.
• Our transactional email endpoint is rate-limited and its content is fixed server-side, so it cannot be used to send arbitrary mail.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board of India as the Act requires, and tell you plainly what happened and what to do.

ExoF is not intended for anyone under 18. We do not knowingly collect data from children, we do not profile children, and we do not direct advertising at them. If you believe a child has given us data, tell us and we will delete it.

This Policy is versioned. When we change it substantively we bump the version and effective date shown at the top of this page, and where the change materially affects how we handle your data we will tell you directly rather than quietly re-publishing.

For any privacy question, request, or complaint — including anything under Section 8 — write to support@exof.in. Privacy matters reach our Grievance Officer through that address, and we will acknowledge your message and respond within 30 days.

ExoF is operated from India. Full registered-entity details will be published here as the company's registration completes.