DPDP Act Compliance

About this page

This page explains how KaryaYogi, published by KaryaYogi, approaches the Digital Personal Data Protection Act, 2023 (DPDP Act) — the Indian law that governs the handling of digital personal data. It is written in plain language so that any officer can read it and check our claims against how the app actually behaves on the device.

KaryaYogi is a private planning and productivity app for personal use. It is not an official Government of India system and does not replace or connect to eOffice, HRMS, APAR, pay systems, sanction files, GeM, GFR, CGHS, DoPT portals or any authorised system of record. Anything you create in KaryaYogi is a private draft, note or estimate for your own planning — it is never filed or submitted anywhere on your behalf.

This page describes our stated practices. It is not legal advice. Where the DPDP Act or its rules impose a specific obligation, that obligation prevails over any summary here.

Who is who: Data Fiduciary and Data Principal

The DPDP Act uses two key terms. The Data Principal is the individual whose personal data is being processed — in KaryaYogi, that is you. The Data Fiduciary is the entity that decides the purpose and means of processing that data — for KaryaYogi, that is KaryaYogi.

Because KaryaYogi is offline-first, our role as Data Fiduciary is narrow by design. When you use the app with no account and no sync, your data stays on your device and we do not receive it. We take on the fuller responsibilities of a Data Fiduciary only for the limited data involved when you choose to create an account or turn on optional encrypted cloud sync.

Where we engage service providers to help operate optional sync, they act as Data Processors — they process data only on our instructions and only for the purposes described here.

The principles we apply

The DPDP Act is built on a set of data-protection principles. Here is how each one maps to KaryaYogi:

• Lawful purpose. We process personal data only for clearly stated, lawful purposes — running the app, and, if you opt in, syncing your data and operating the web portal.
• Consent and lawful basis. Local use needs no account and no consent because we do not collect your data. Optional cloud sync runs on your explicit consent, which you can withdraw.
• Data minimisation. We ask for the least data needed. The 74 tools work with the SIM removed; we do not require personal profiles to use them.
• Purpose limitation. Data given for sync is used to sync — not for advertising, profiling or resale.
• Accuracy. You can view and correct your data, and edit or delete your entries at any time.
• Storage limitation. We retain account and sync data only while your account is active or as needed for a stated purpose or legal obligation, then delete or de-identify it.
• Security safeguards. We use technical safeguards including an AES-256 local vault, app lock, and encryption for optional sync.
• Accountability. We stand behind these practices and provide a grievance route below.

What we process, and our lawful basis

Local, no account: When you use KaryaYogi without an account, your tasks, notes, estimates and other entries are stored on your device in an AES-256 encrypted local vault. No account is required, and this data is not sent to us. There is no personal data collection by us in this mode, so no consent is needed.

Optional cloud sync and web portal: If you choose to create an account and enable encrypted sync, we process the account and sync data needed to keep your entries consistent across your devices and the web workspace at https://my.karyayogi.in. The lawful basis for this is your consent. Sync data is encrypted and hosted in India, keyed to your account.

We do not run ads, we do not embed trackers, and we do not sell personal data. The app and all 74 tools are free; only optional cloud sync and the web portal are a paid plan.

How consent is taken and withdrawn

Under the DPDP Act, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the stated purpose. In KaryaYogi, you are asked for consent only at the point you choose to enable cloud sync or create an account — never as a condition of using the app itself.

You can withdraw consent at any time. Turning off sync in the app stops further syncing, and you may delete your account to end our processing of your synced data. Withdrawing consent is as easy as giving it. Withdrawal is not retrospective: it does not undo processing that was lawfully carried out while consent was active, but it stops processing going forward.

If you never opt in, your KaryaYogi data stays local to your device and under your control.

Your rights as a Data Principal

The DPDP Act gives you specific rights over your personal data. KaryaYogi supports them as follows:

• Right to access: You can see your own data. Locally, it is visible in the app; for synced data, you can request a summary of what we hold and why.
• Right to correction and completion: You can edit and update your entries directly in the app. For account data, you may ask us to correct inaccurate or incomplete information.
• Right to erasure: You can delete your entries. A one-tap Emergency Reset wipes all local KaryaYogi data from the device. For synced data, deleting your account removes it, subject to any retention the law requires.
• Right to grievance redressal: You can raise a complaint with us using the contact below and expect a response.
• Right to nominate: The Act lets you nominate another individual to exercise your rights in the event of death or incapacity. You may make such a nomination by writing to us at the grievance address below.

You also control your own data outside our systems: a one-tap encrypted local backup produces a backup file that you keep and control.

Security safeguards

We apply reasonable technical safeguards to protect personal data. On the device, entries are held in an AES-256 encrypted local vault, and the app can be locked with a biometric or PIN app lock. Optional cloud sync is encrypted and hosted in India, keyed to your account.

No system can promise perfect security, and we do not claim to. We describe here the safeguards we actually use. We do not hold any security certification, and this page does not assert one.

You can further protect your data by enabling the app lock, keeping your device software current, and storing your local backup file safely.

Personal data breach: our stance

The DPDP Act requires a Data Fiduciary to take steps to prevent personal data breaches and to give notice of a breach in the manner and to the persons the law and its rules specify — including, as applicable, the Data Protection Board of India and affected Data Principals.

If a breach affecting your personal data occurs in a system we operate, our stance is to act promptly to contain it, assess the impact, and provide the notifications required by law. Where you are affected, we will aim to tell you what happened, what data was involved, and what steps you can take.

Because local-only data never leaves your device and is not held by us, the breach obligations that fall on us relate to the account and sync data we process for opted-in users. You can help reduce risk by keeping your app lock enabled and your device secure.

Grievance officer and how to contact us

If you have a question, a request to exercise a right, or a complaint about how your personal data is handled, you can reach our grievance contact by email at support@karyayogi.in. For privacy questions generally, write to support@karyayogi.in; for security matters, write to support@karyayogi.in.

Please include enough detail for us to identify your request and respond. We will address grievances within the timelines applicable under the DPDP Act and its rules.

If a postal address or the name of a specific officer is required for a formal request, that information is available on request via the email addresses above. If you are not satisfied with our response, the DPDP Act allows you to approach the Data Protection Board of India.

Changes to this page

We may update this page as KaryaYogi evolves or as the DPDP Act's rules are notified and refined. When we make a material change, we will reflect it here. Continuing to use optional sync after an update means the current version applies to that processing.

This page describes KaryaYogi as a private planning aid run by the KaryaYogi team. It is not an official government system, and nothing in the app files, submits or transmits anything to any authorised system of record on your behalf.