Version 2026-08-23.1 · Effective 23 August 2026

Privacy Policy

PixelPet — a product of Uncertified (uncertified.in)
This Privacy Policy explains how uncertified.in (“PixelPet”, “we”, “us”) — acting as the Data Fiduciary — collects, uses, stores, and protects your personal data when you use the PixelPet website and desktop application (together, the “Service”). We process your data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it, along with other applicable Indian law.

1. Quick summary

We keep this simple:

• What we collect: your email address, profile details you choose (display name), the pets you adopt and how you customise them, your friends list and messages on PixelPet, your licence keys and device activations, purchase records, and minimal security logs.
• Why: to create your account, sign you in securely, run pet/social features, process purchases, issue licences, prevent abuse, and send you service emails.
• What we never do: no behavioural advertising, no tracking ads, no selling of your data.
• Your control: you can access, correct, or erase your data, withdraw consent, and nominate someone to exercise your rights — by writing to us.
• Grievances: acknowledged within 48 hours and resolved within 30 days; you may also complain to the Data Protection Board of India.

2. Who we are & how to reach us

3. Personal data we collect, and why

We collect only what is necessary for the purposes listed below (purpose limitation and data minimisation). All processing happens only after you have given consent at sign-in, which you can withdraw.

Payment card / UPI credentials are never collected by us. Payments are processed entirely by Razorpay; we receive only a payment confirmation and identifiers.

What we do not do: we do not sell or rent personal data; we do not use it for behavioural advertising or cross-context targeted advertising; we do not build advertising profiles.

4. Who we share data with (processors)

• Razorpay — payment processing (they act as an independent fiduciary/processor for payment data).
• Email delivery provider (SMTP) — sending OTP codes and transactional email.
• Hosting & database providers (e.g. Vercel, managed PostgreSQL) — running the Service.

We share only what each processor needs to perform its function, bound by contract to use it solely on our instructions and to safeguard it. Processors may process data outside India; such transfers are permitted under the DPDP Act except to countries restricted by government notification, and we do not transfer data to any restricted territory. We may also disclose data where legally required (court orders, lawful requests from the State under its powers).

5. Children’s data

The Service is not directed at children under 18. If you are under 18, a parent or lawful guardian must provide verifiable consent before your data is processed — the guardian should create and manage the account using their own email address. We do not undertake tracking, behavioural monitoring, or targeted advertising directed at children, consistent with DPDP Act S.9. A guardian may withdraw consent or request erasure at any time via the Grievance Officer.

6. How long we keep your data

• OTP codes: 10 minutes (then deleted).
• Session tokens: up to 30 days or until you sign out.
• Account, pet, and social data: until you delete your account or withdraw consent (erasure completed within 30 days).
• Purchase & licence records: retained as long as required by applicable tax, accounting, and consumer-protection law, even after account deletion.
• Security logs: limited period, then deleted or de-identified.
• Consent records: maintained as evidence of the notices given and consents collected.

7. How we protect your data

• All traffic encrypted with TLS; passwords are not stored at all (passwordless OTP sign-in).
• OTP codes, session tokens, and licence keys are stored only as cryptographic hashes.
• Licence tokens are signed with asymmetric keys so desktop clients can verify them offline.
• Access controls and least-privilege access for our infrastructure.

If a personal-data breach occurs, we will report it to the Data Protection Board of India without delay and inform affected users within 72 hours, as required by the DPDP Rules.

8. Your rights

• Access: a summary of your personal data, the processing done, and the identities of processors.
• Correction & erasure: fix inaccurate data, or erase it (subject to legal retention of purchase records).
• Withdraw consent: as easily as you gave it — withdrawal stops future processing; we explain what must be retained by law.
• Nominate: name a person to exercise your rights if you are unable to (incapacity or death).
• Grievance redressal: write to the Grievance Officer; resolution within 30 days.

To exercise any right, email pixelpetdev@gmail.com from your registered email address. You may also escalate a grievance to the Data Protection Board of India.

9. Withdrawing consent / deleting your account

Email the Grievance Officer asking for deletion. We erase your account, pets, social graph, and messages within 30 days, keeping only the purchase/licence records the law requires. Because the Service is built on consent-based processing, withdrawal means we can no longer operate your account.

10. Changes to this policy

We will publish any updated policy here with a new version number and effective date. If a change materially affects how we process your data, we will seek your fresh consent at your next sign-in — your continued use after re-consenting governs. Past versions are available on request.

Questions about this notice? See also our Terms of Adoption.