PRIVACY NOTICE
Cognitive Materials Private Limited (the company, we, us, our). Corporate identity number U62013KA2024PTC190282. Registered office: 1007, Siddhartha Layout, Kadugodi, Bangalore South, Bangalore 560067, Karnataka, India. Grievance Officer: Meghavarsha Rajeshwari, grievance@fyzygy.com, email only. General contact: support@fyzygy.com. This is an adults-only service for users aged eighteen and over. Fyzygy is a trademark of Cognitive Materials Private Limited.
Last updated: 8 October 2026.
WHO WE ARE
Cognitive Materials Private Limited is the data fiduciary for the personal data described in this notice. Our registered office and contact details appear above.
WHO MAY USE OUR PRODUCTS
Our products are for adults aged eighteen and over. A date of birth is collected at signup to confirm the user is old enough, and anyone under eighteen cannot create an account. The date of birth is stored on the account and is never shown to anyone. We do not knowingly collect personal data from anyone under eighteen, and we do not offer a parental-consent route, because we do not offer the service to children.
WHAT THIS SURFACE DOES
Fyzygy Shelf is a private space for a user's own notes, lists and reminders. The content is text only. There are no uploads. The content is private to the user and is never published to anyone. A reminder may raise an alarm at a time the user sets.
WHAT WE COLLECT HERE
At Fyzygy Shelf we process account identity data, namely the email address or phone number and the password; the date of birth; the display name the user sets for Fyzygy Shelf; the user's own notes, lists and reminders; advertising interaction events, namely impressions and clicks, tagged by product and device type and held as aggregate counters; product usage beacons, namely landing, signup started, signup completed and activation; aggregate usage counts for running and improving the service, namely installs and first opens, sign-ups, active users and returns after one, seven and thirty days; and the days the user was active, kept as a last-active date for this product. We use no outside trackers, and any use of a person's activity beyond running the service stays under the cross-app analytics consent, which is off by default.
HOW WE USE THIS DATA
We use it to create, secure and operate the account; to verify sign-in; to store the user's own notes, lists and reminders and show them back to the user; to raise a reminder's alarm at the set time; to show advertising and, only where the user has switched on personalised advertising, to make that advertising more relevant; and to understand product usage in aggregate. The user's private notes are never used to target advertising.
THE MEASUREMENT IDENTIFIER
A random value is created when a page loads, and is used to count how many visits lead to an account being created. This happens even for a person who has never signed in. It is not a cookie. It is different on each product and cannot be used to connect a person's activity between products. It identifies a browsing session, not a person, and is never sold or shared with advertisers. On the web, the value lasts for the browsing session; it is shared by tabs opened from one another, and a browser may restore it when a tab is reopened or a session is recovered; it is not stored permanently and is not kept when the browser starts fresh. In the app, the value lasts as long as the app is running, which can be longer if the app is left open in the background.
YOUR HANDLE AND DISPLAY NAME
A person has one Fyzygy account and one public handle across the products, managed in the account centre. On Fyzygy Shelf the user sets a display name. Fyzygy Shelf shows a user's handle to no one; the "Let people find me by handle" switch in the account centre affects only Fyzygy Take's people search.
CONSENTS
At signup a user gives two required agreements, separately: agreement to this Privacy Notice, and agreement to the Terms. These are stored while the account exists. Two further forms of processing are optional and off unless the user chooses them, and they are separate consents with separate purposes. Cross-app analytics is used to understand how the same person uses more than one Fyzygy product, so that we can improve those products; it is not used for advertising and not for ad targeting, and when it is switched on the person's account identifier is attached to those measurement events. Personalised advertising is a separate option that uses a user's activity within our own products to make advertising more relevant. Each is off unless chosen, and each can be switched off again at any time in the account centre. Switching either off does not remove access to the product.
NOTIFICATIONS
Fyzygy Shelf has its own notifications switch, named alarms, which covers reminder alarms and other messages from the product. The company may send a service message, such as an "update available" notice; it appears inside the app and may also be sent as a push, and it respects the switch. To deliver notifications and alarms, Fyzygy Shelf stores a push registration for the device, which is kept until the account is deleted.
WHO PROCESSES DATA FOR US
We use Amazon Web Services, in the Asia Pacific Mumbai region, for the database and compute; MSG91, for email and SMS; Google Firebase, for push notifications; and Vercel, for the websites. Each processor is engaged under a contract that requires it to protect personal data.
SHARING
We do not sell personal data. We do not share personal data with advertisers. Advertisers receive only anonymised and aggregated performance information, from which no individual can be identified. We share personal data only with the processors above, and where the law requires it.
RETENTION
We keep personal data only as long as needed for the purpose, or as the law requires.
| Category | Retention | Reasoning |
|---|---|---|
| Account identity, that is email or phone and password hash | While the account is active. On deletion, removed on the deletion timeline below. | Needed to provide and secure the account. |
| Date of birth | While the account is active. Removed on deletion. Never shown to anyone. | Needed to confirm the user is old enough. |
| Codes sent at sign-in | Expire ten minutes after they are sent; their records are removed within an hour. | Needed only to verify. |
| Notes, lists and reminders | While the account is active. On deletion, removed on the deletion timeline. A cancelled reminder is kept until the account is erased. | The user's own content, kept to provide the service. |
| Consent records | Kept after deletion in a minimised, pseudonymised form, for the limitation period for related claims. Twenty-four months. | Establishment, exercise or defence of legal claims, and legal obligation. |
| Advertising and usage events | Ad events carry no user identifier. Individual identifiable ad events are not kept; the anonymised aggregate counters are retained while the product is operated. | Advertising performance and product analytics. Aggregates carry no personal data. |
| Last-active date for this product | While the account is active. Erased with the account. | Measuring returns and whether the product is used. |
| Server and access logs | One year minimum. | Prescribed as a minimum by the Digital Personal Data Protection Rules 2025. |
| Backups | Age out on the backup rotation after deletion. | Backups cannot be edited item by item. They age out. |
CROSS-BORDER
Some processing takes place outside India, because our websites are served by a global provider.
YOUR RIGHTS
A user may access their personal data, correct or complete it, erase it, nominate another person to exercise rights in the event of death or incapacity, and withdraw either optional consent. Rights are exercised in the account centre. A user may export or delete their notes. To raise a concern, a user may contact the Grievance Officer, and may escalate to the Data Protection Board of India.
DELETION
When a user asks to delete their account, we deactivate it at once, which ends access to every product and revokes active sessions, and we erase the personal data thirty days after the request, by an automatic check. During those thirty days the user can restore the account by signing in to the account centre and pressing Activate account; signing in alone does not restore it. Deletion is carried out in the account centre, which the Fyzygy Shelf account menu opens. What is erased includes the account identity, the date of birth, the user's notes, lists and reminders, active sessions, the push registration, and the account's analytics events, and the account's identifier is removed from aggregate rows; the public handle is retired.
We keep some records after an account is erased, where the law requires: user reports; reported content, for one hundred and eighty days; uploads held by the child-safety check, and any preservation hold; consent records, pseudonymised, for twenty-four months; server and access logs, for the prescribed minimum period; and the retired handle, as a bare string with no link to the person. Erasing an account does not edit the server logs. An account under a child-safety preservation hold is not erased until the hold ends.
SECURITY
We protect personal data with access controls, encryption in transit and at rest where appropriate, and logging. No method is perfectly secure, but we take reasonable measures suited to the sensitivity of the data.
BREACH
If a personal data breach occurs, we follow our internal breach procedure, which includes notifying the Data Protection Board of India within seventy two hours as the Rules require, and notifying affected users where required.
CHANGES
We will update this notice as our products and the law change, and will make material changes visible before they take effect.
CONTACT
Grievance Officer: Meghavarsha Rajeshwari, grievance@fyzygy.com, email only. General contact: support@fyzygy.com. Registered office as above.