Legal
Privacy Policy
Effective date: 11 July 2026
This policy explains what data Roadmapper (operated by Cognix, India — the “data fiduciary” under India’s Digital Personal Data Protection Act, 2023) collects, why, and the choices you have. It applies to roadmapper.space, app.roadmapper.space and our mobile apps. Questions: cognix@roadmapper.space.
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account | Email, name, profile photo, phone number (if you sign in by phone), bio | You / your Google account |
| Learning activity | Roadmaps and goals, study sessions, quiz & practice answers, flashcard and spaced-repetition reviews, streaks (including streak freezes), notes, tasks | Your use of the Service |
| AI conversations | Messages you exchange with the AI tutor and document chat | You |
| Uploaded documents | PDFs/images you upload, the text we extract from them (including OCR), and vector embeddings used for search | You |
| Career artifacts | Job descriptions you paste, generated resumes, cover letters, LinkedIn posts | You / generated |
| Calendar (optional) | Availability (free/busy), event titles shown in your calendar view, and study events we create — only if you connect Google Calendar | Google, with your consent |
| Payments | Plan, transaction references and status. Card/UPI details are handled by Razorpay and never touch our servers | Razorpay |
| Technical | Log data, device/browser type, timezone, push-notification tokens, crash and error reports | Automatic |
2. How we use it
- Providing the Service — generating roadmaps and study content, answering your questions with context from your documents, tracking progress, scheduling study time, building career documents.
- Personalisation — adapting content, reminders and recommendations to your activity.
- Plans and billing — enforcing plan quotas, processing purchases, preventing abuse and fraud.
- Communication — service messages (receipts, plan expiry) and optional study reminders/notifications, which you can turn off.
- Improvement and safety — debugging, measuring aggregate usage, securing the Service.
We do not sell your personal data, and we do not use your content for advertising.
3. AI processing
To generate output, relevant parts of your prompts, learning context and document excerpts are sent to third-party AI model providers — currently Google (Gemini), with OpenAI as a fallback — acting as processors under their API terms. Per those API terms, this data is not used by the providers to train their models. We do not use your private content to train models of our own.
4. Google user data (Calendar and Sign-in)
If you connect Google Calendar, we request the minimum scopes needed to (a) read availability and events so we can display your schedule and avoid conflicts, and (b) create the study events you approve. Calendar data is used only for these features, is never sold or used for advertising, and connection can be revoked at any time in the app or at myaccount.google.com/permissions. Our use of Google user data complies with the Google API Services User Data Policy, including its Limited Use requirements.
5. Who we share data with
Only service providers who process data for us, under contract:
- Google Cloud / Firebase — authentication, file storage (documents are stored in a private bucket), push notifications;
- Google (Gemini) and OpenAI — AI generation (Section 3);
- Razorpay — payment processing;
- Hostinger — server hosting;
- Sentry — error monitoring (technical data only).
We may also disclose data where the law requires it, or to protect the rights and safety of users and the Service. Some providers process data outside India (for example in Google Cloud regions); where they do, contractual and technical safeguards apply.
6. Security
Data is encrypted in transit (HTTPS everywhere); documents live in a private, access-controlled storage bucket; passwords are never stored in plain text; production access is restricted. No system is perfectly secure — if we learn of a breach affecting your data we will notify you and the authorities as required by law.
7. Retention and deletion
- Your data is kept while your account is active.
- Deleting a document removes the file, its extracted text and its search embeddings.
- Deleting your account (request via cognix@roadmapper.space) removes your personal data from live systems within 30 days; encrypted backups age out within a further 90 days. We keep minimal payment records as long as tax law requires.
8. Your rights
Depending on where you live (including under India’s DPDP Act and, for EEA/UK users, the GDPR), you can: access a copy of your data; correct it; delete it; withdraw consent (e.g. disconnect calendar, disable notifications); and complain to a supervisory authority. Exercise any of these by emailing cognix@roadmapper.space from your registered address — we respond within 30 days.
9. Children
The Service is not directed at children under 13, and we do not knowingly collect their data. Users under 18 require the consent of a parent or guardian (see the Terms). If you believe a child has provided us data without consent, contact us and we will delete it.
10. Cookies and local storage
We use only what the Service needs to work: authentication tokens (kept in secure browser/app storage) and basic preferences. We do not use advertising cookies or cross-site trackers on the app; the marketing site sets no cookies at all.
11. Changes
We will post updates here and, for material changes, notify you by email or in-app before they take effect.
12. Contact / Grievance Officer
Cognix · Roadmapper — cognix@roadmapper.space. Grievances under Indian law are acknowledged within 48 hours and resolved within 30 days.