SmartHold ("SmartHold", "we", "us") is operated by Praveen Baid (individual), Surat, Gujarat, India. This policy explains, in plain language, what personal data we collect when you use SmartHold, why, where it's stored, how long we keep it, and the rights you have over it under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

By creating a SmartHold account, you agree to the collection and use of your information as described here. If you don't agree, please don't create an account.

1. What we collect

Category	What, specifically
Account identity	Name, email address, mobile number — all required at signup
Optional contact	WhatsApp number, if you add one in Account settings
Your password	Never stored as plain text — only a one-way cryptographic hash (bcrypt). We cannot see or recover your actual password; see §4.
Your lists	Any ticker lists you create, and the tickers you add to them
Your buy/sell log	Quantity, price, date and any note you log for a trade. SmartHold never places trades. Any buy/sell entries you log are your own personal record-keeping, not a real brokerage connection
Feedback you submit	Your message and (optionally) a 1–5 star rating
Push notification token	A device identifier issued by Firebase Cloud Messaging (Google), used only to deliver your daily flip summary and any price alerts you set
Standard technical logs	Ordinary web-server logs (IP address, browser/device type, request timestamps) — the same baseline logging any website keeps for security and troubleshooting, not used to build an advertising profile

We do not collect your PAN, Aadhaar, bank account, demat account, or any real brokerage credentials from regular users. We do not use cookies or any third-party advertising/analytics tracker — your session is kept in your browser's local storage, on your own device, not in a tracking cookie.

2. Why we collect it

• Name, email, mobile — to create and secure your account, personalize the app (e.g. "{Your Name}'s Lists"), and let you recover access if needed.
• Lists, buy/sell log — this is the core of the product: tracking your own holdings and showing you hold-or-gold signals, backtests and returns against them.
• WhatsApp number — only if you choose to provide it, for a notification channel you opt into.
• Push token — solely to deliver the daily summary and price alerts you ask for; never used for anything else.
• Feedback — to read, triage and act on what you tell us.
• Technical logs — to keep the service secure, debug problems, and prevent abuse.

3. Where your data is stored

SmartHold's database and application server are self-hosted on infrastructure located in India, operated directly by us — not a large third-party cloud platform. The app is reachable over the internet through a Cloudflare Tunnel (see Cloudflare below).

Four services outside our own server are involved, each limited to exactly what they need:

• Cloudflare (Tunnel/CDN) — relays and terminates the encrypted connection between your device and our server, so it necessarily processes your traffic in transit (the same way any CDN/reverse-proxy in front of a website does). Cloudflare does not store your account data.
• Firebase Cloud Messaging (Google) — delivers push notifications. Google processes your device's push token to route the notification; this may involve infrastructure outside India, consistent with the DPDP Act's allowance for cross-border transfer except to specifically restricted countries.
• Google Gmail (SMTP) — sends the optional daily flip-summary emails to your account's email address.
• Google Fonts — the app's typefaces load from Google's font CDN. This sends your browser's standard request metadata (not your account data) to Google, the same as visiting almost any modern website.

We do not use any other third-party data processor, analytics platform, or ad network.

4. Password security

Your password is stored using bcrypt, a one-way cryptographic hash — we cannot see, recover, or "look up" your actual password, by us or anyone with database access. If you ever need help regaining access, an admin can issue a one-time temporary password, which you must replace with your own the moment you next log in.

5. How long we keep it

We keep your account data for as long as your account is active. If you ask us to delete your account (§7), we delete your personal data within 30 days of confirming the request, except where we're required to retain certain records by law, or where data has already been anonymized/aggregated for product improvement in a form that no longer identifies you. Standard technical logs are retained only briefly for security purposes and are not kept indefinitely.

6. We do not sell your data

We do not sell, rent, or trade your personal data to anyone, for any purpose. We do not share it with advertisers. The only parties who ever see any of it are: you, SmartHold's own admin(s) (for support and account-approval purposes), and the processors named in §3, each strictly limited to what they need to do their one job.

7. Your rights (DPDP Act, 2023)

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you.
• Correct or update inaccurate or incomplete data (most of this you can already do yourself, in the app's Account settings).
• Erase your personal data and close your account, once it's no longer needed for the purpose you gave it for, or you withdraw consent.
• Withdraw consent at any time, as easily as you gave it — withdrawing consent means we can no longer provide the account-based parts of the service to you.
• Grievance redressal — raise a complaint about how we've handled your data (§9) and get it addressed in a reasonable time.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

8. How to request access or deletion

Email [email protected] from the email address on your account, with "Privacy request" in the subject line, telling us what you'd like (a copy of your data, a correction, or full account deletion). We'll verify it's really you before acting on it, and respond within 30 days.

9. Grievance Officer

For any privacy complaint or grievance, contact:

10. Children's data

SmartHold is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us at the email above and we'll remove it.

11. Changes to this policy

If we materially change how we collect or use your data, we'll update the date at the top of this page and, where the change is significant, make a reasonable effort to let existing users know (e.g. by email or an in-app notice).

12. Contact

Questions about this policy: [email protected]. See also our Terms of Use and How SmartHold Works & Its Limits.