Privacy Policy

Data Model by User Type

Beyond these two products, BornClock operates on a tiered model. What we collect and store depends on how you use the service:

AI Longevity Coach

When you send a message to the AI Longevity Coach, two things are transmitted through our servers to Anthropic (the AI provider) to generate a response: the text of your message, and a summary of your computed longevity results (your forecast, factor impacts, and scores — not your raw health inputs, which never leave your browser). This happens only when you send a coach message, is processed transiently, is never stored on our servers, and is never logged. Conversation history exists only in your browser session and is never sent to us. Anthropic processes this data to generate the response and does not use it to train models, per our API agreement.

What We Collect

When you create a BornClock account, we collect the following information:

• Name — used to personalise your dashboard and reports.
• Email address — used for account access, transactional emails, and optional notifications. Never sold.
• Date of birth — used to calculate your real-time age and power all date-based features. Stored only if you explicitly save your profile.
• Country — used to select the correct WHO/UN life-expectancy baseline for your region.
• Health inputs (smoking, alcohol, BMI, exercise, sleep, stress, medical history) — entered into the Life Expectancy Calculator. These are processed entirely in your browser and are never transmitted to our servers.
• Premium status — whether your account has an active premium subscription, stored so we can grant access to premium features.
• Payment metadata — we use Razorpay for payment processing. BornClock receives only a transaction ID and confirmation status; your card details are handled entirely by Razorpay and never touch our servers.
• Anonymous analytics — page views and feature usage via privacy-focused analytics (no cross-site tracking, no fingerprinting). This helps us understand which features to improve.

What We Do NOT Store

We believe in data minimalism. Here is what we deliberately do not collect or store:

• Raw health inputs — your answers to the Life Expectancy Calculator (smoking, alcohol, BMI, sleep, stress, medical history, etc.) are processed entirely in your browser and never transmitted to our servers. They are never stored.
• Longevity forecasts and results — your life expectancy calculation result is never saved on our servers. If you add a family member or submit to the longevity leaderboard, only the numeric forecast summary (e.g. "78.5 years") is stored — not the health inputs that produced it.
• Birthday Blueprint reports are stored for delivery — this is the one exception to the above. When you create a Birthday Blueprint, we store the recipient's name, date of birth, and generated report content, because the shareable link must exist on our servers for the recipient to open it. These reports are deleted with your account, on request, or automatically after 12 months without a view.
• Card numbers, CVVs, or bank details — payments go directly through Razorpay's PCI-DSS compliant infrastructure.
• Data sold to third parties — we do not sell, rent, or trade your personal information. Ever.
• Advertising — BornClock may display advertising to support the free tier. We do not sell your health data — including your life expectancy inputs, biological age results, or any health-related information — to advertisers or any third parties.
• Precise location data — we never collect GPS location. We detect your approximate country from your IP address (via ipapi.co) solely to display correct pricing and currency; this lookup is not stored and is never linked to your account.

Gift Recipients' Data

When a BornClock user creates a Birthday Blueprint about another person, we store that person's name and date of birth solely to generate and deliver the report, on the purchaser's instruction. This data is not used for any other purpose, is not sold or shared, and is deleted when the report is deleted.

• Retention: Gift reports that have not been viewed for 12 months are automatically and permanently deleted.
• Recipient deletion rights: Recipients themselves may request deletion of a report about them by emailing privacy@bornclock.com. We will process such requests within 30 days.
• Reports about minors: by creating a report about a person under 18, you confirm you are their parent or guardian, or have a parent or guardian's consent.

How We Use Your Data

• Account management — your name and email let you log in, recover your account, and manage your subscription.
• Personalisation — your date of birth and country personalise your dashboard and choose the right life-expectancy baseline.
• Transactional emails — account confirmation, password reset, and payment receipts. We do not send marketing emails without your explicit opt-in.
• Optional notifications — with your consent, we may send birthday-related nudges or product updates. You can unsubscribe at any time from your profile page.
• Product improvement — anonymised, aggregated usage data helps us decide what to build next. No individual is identifiable in this data.

Data Storage and Security

• Account data is stored on Supabase (PostgreSQL), hosted on AWS Mumbai (ap-south-1) with encryption at rest and in transit.
• All connections to BornClock are HTTPS encrypted using TLS 1.2 or higher.
• We use row-level security (RLS) policies to ensure your data is only accessible to you and never to other users.
• Passwords are hashed using industry-standard bcrypt via Supabase Auth — we never see or store plaintext passwords.
• We retain your account data for as long as your account is active. If you delete your account, all personal data is permanently deleted within 30 days.

Third-Party Services

We use a small number of third-party services. Here is each one and what data they receive:

We do not sell your personal data to any third party. If we add advertising partners in the future, this table will be updated and you will be notified if you have an account.

Your Rights

Regardless of where you are in the world, you have the following rights:

• Access — see exactly what data we hold about you. Email privacy@bornclock.com.
• Correction — update your name, email, or date of birth from your Profile page at any time.
• Deletion — permanently delete your account and all associated data from your Profile page. No need to contact support. Data is purged within 30 days. Transaction records (payment IDs, amounts, dates) are retained in de-identified form as required by tax and accounting law, but are permanently unlinked from your profile and email on deletion.
• Export — request a copy of your data in a portable format by emailing privacy@bornclock.com.
• Opt out — unsubscribe from all non-essential emails from your Profile page or via the unsubscribe link in any email we send.
• Withdraw consent — if you gave consent for any specific processing, you can withdraw it at any time without affecting past processing.

EU/UK residents have rights under GDPR/UK-GDPR (see EU/UK Rights below). Indian residents have rights under DPDPA 2023 (see Indian Law Rights below). We honour all requests within 30 days.

Your Rights Under Indian Law (DPDPA 2023)

Under the Digital Personal Data Protection Act 2023 (DPDPA), Indian residents have the following rights:

• Right to Access — request a copy of all personal data we hold about you. Email privacy@bornclock.com.
• Right to Correction — update inaccurate or incomplete data from your Profile page or by emailing us.
• Right to Erasure — request permanent deletion of all your personal data. We will process your request and confirm deletion within 30 days.
• Right to Withdraw Consent — withdraw consent for any data processing at any time. This does not affect processing already completed.
• Right to Grievance Redressal — contact our data protection contact at privacy@bornclock.com for any concerns.

EU/UK Rights (GDPR & UK-GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, you have rights under GDPR / UK-GDPR:

• Right of Access (Art. 15) — obtain confirmation of processing and a copy of your data.
• Right to Rectification (Art. 16) — correct inaccurate personal data without undue delay.
• Right to Erasure / Right to be Forgotten (Art. 17) — request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restriction (Art. 18) — request that we restrict processing of your data in certain circumstances.
• Right to Data Portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to Object (Art. 21) — object to processing based on legitimate interests.

To exercise any of these rights, email privacy@bornclock.com. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

Cookies

We use a minimal set of cookies:

• Essential cookies — session tokens required for you to stay logged in. Cannot be disabled without breaking the app.
• Analytics cookies — anonymised, cookieless-mode analytics. Can be disabled via the Cookie Settings link in the footer.
• Advertising cookies — we do not currently use ad-targeting or cross-site tracking cookies. If advertising is introduced, cookie preferences will be updated and your consent obtained where required by law.

You can manage your cookie preferences at any time using the Cookie Settings option in the footer.

Children's Privacy

BornClock is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact privacy@bornclock.com and we will delete it promptly.

Changes to This Policy

If we make material changes to this policy, we will notify you via email (if you have an account) and update the "Last updated" date at the top of this page. Minor clarifications may be made without notice. The latest version is always available at bornclock.com/privacy.

Contact Us

For any privacy-related questions, requests, or complaints:

• Privacy: privacy@bornclock.com
• General enquiries: hello@bornclock.com

We aim to respond to all privacy requests within 30 days.