Privacy Policy

The short version

• Your video is never recorded. It is relayed live between the people in your room and then it is gone. We do not store it, and neither can they.
• Your microphone is never on. Focus rooms have no audio at all.
• There are no analytics or advertising trackers. No Google Analytics, no Meta pixel, no session recording, no heatmaps, no ad networks. The only cookies we set are the ones that keep you signed in.
• We do not sell your data, and we do not share it for advertising.
• Room chat is deleted after 24 hours, by the database itself.

1. Who is responsible for your data

Grayblock Technologies Private Limited (CIN U00000MH2026PTC000000), Registered office address line 1, City, State PIN, India, is the data fiduciary for the personal data described here — the company that decides how and why it is used.

For anything in this policy, including requests about your own data, write to team@grayblock.io.

2. What we collect

What you give us

• Account. Your email address, and a password — stored only as a hash, never in a form we can read. If you sign in with Google, we receive your name, email address and profile picture from Google instead of a password.
• Profile. Your name, handle, photo and cover image, bio, what you are working on, and any of the optional fields you choose to fill in: date of birth, gender, city, country, timezone, languages, interests, skills, role, company, industry and website. Everything after your name is optional, and you can clear any of it at any time.
• Content. Your tasks, your room status, your direct messages, your room chat lines and your reactions.
• Settings. Your notification preferences, daily goal, and whether your camera starts on.

What the service records as you use it

• Focus sessions. Which room, when you started, and how long you stayed. This is what the leaderboard, your streak and your statistics are built from.
• Social activity. Who you follow, your badges, and when you were last online.
• Payments. If you subscribe, a record of the plan, the amount, the date and a payment reference from Razorpay. We never see your card details — they go directly to Razorpay and never touch our servers.
• Technical logs. Our servers keep short-lived logs containing IP addresses, timestamps and error information, which is how we keep the service running and spot abuse.

3. What we deliberately do not collect

This is the part most policies leave out, so it is worth being specific. Grayblock does not:

• record, store or have any way to replay your video;
• transmit your microphone — focus rooms carry no audio;
• see your screen, your other tabs or your files;
• run any analytics, advertising, heatmap or session-replay service;
• build an advertising profile of you, or share data with ad networks;
• read your direct messages, except where we must to investigate a report; or
• sell your personal data to anyone, for any price.

4. How your camera actually works

When you turn your camera on, your browser sends the video to our own media server at rtc.grayblock.io, which forwards it live to the other people in that room. It is a relay, not a store: nothing is written to disk, and when you leave, there is nothing left behind.

The people in the room can see you while you are there. That is the point of the product, and it is worth being clear-eyed about it: they can also, in principle, point a phone at their screen. Our Community Rules forbid it and we act on reports, but no software can prevent it. Keep your camera off if that matters to you — it is optional in every room, always.

5. Why we use your data

• To run the service — signing you in, showing your tile, delivering your messages, counting your focus time, keeping your tasks.
• To take payment and give you the plan you paid for.
• To keep people safe — investigating reports, dealing with abuse, preventing fraud.
• To contact you about your account, and to send the notifications you have switched on. You can turn every optional notification off in settings.
• To improve Grayblock — understanding, in aggregate, which rooms and features get used.
• To meet our legal obligations, including keeping tax records of payments.

Under the Digital Personal Data Protection Act, 2023 we rely on your consent, given when you create an account and fill in what you choose to, and on the Act's “certain legitimate uses” where we must act to comply with the law.

6. What other members can see

Grayblock is partly a social product, so some of your data is visible by design. Signed-in members can see:

• your name, handle, photo, cover image and the profile fields you filled in;
• your focus hours, sessions, streak and badges, on the leaderboard and your profile;
• your status and your camera, while you are in a room; and
• your chat lines, to everyone in that room, for the day they last.

Your email address, date of birth, payment records and direct messages are never shown to other members. Only aggregate totals — the counts on the home page — are visible to people who are not signed in.

7. Who else processes your data

We keep this list short on purpose. Each of these companies processes data only to provide its service to us, under contract:

• Supabase — the database, sign-in and file storage behind Grayblock.
• Google — only if you choose to sign in with Google, which tells Google that you use Grayblock.
• Razorpay — payment processing. They are the ones who handle your card, under RBI rules.
• Hostinger — the servers running the website and our media server.

We may also disclose data where the law requires it, to enforce our Terms, or to protect someone from harm. If Grayblock is ever sold or merged, your data may transfer with it, and we will tell you before that happens.

8. Where your data is stored

Grayblock is operated from India and our media server runs in India. Some of the providers above store or process data on servers outside India. Where that happens, we only use providers that offer comparable protection under contract. The DPDP Act permits transfers outside India except to countries the government restricts.

9. How long we keep it

• Room chat — deleted after 24 hours. This is enforced by the database, not by a promise.
• Video — never stored, so nothing to keep.
• Your account, profile, sessions, tasks and messages — for as long as your account is open.
• After you delete your account — removed within 30 days, except that direct messages may remain visible to the person you sent them to, and anything genuinely anonymous may stay in aggregate totals.
• Payment records — kept for up to eight years, because tax law requires it.
• Technical logs — kept for up to 90 days.

10. Your rights

Under the DPDP Act you have the right to:

• know what personal data we hold about you and what we do with it;
• correct anything inaccurate, or complete anything missing — most of it you can edit yourself in your profile;
• erase your data, by deleting your account or writing to us, unless we must keep something by law;
• withdraw consent at any time, which for most purposes means closing your account;
• nominate someone to exercise these rights on your behalf if you die or become incapable of doing so; and
• complain — to us first, and then to the Data Protection Board of India if we have not resolved it.

Write to team@grayblock.io from your account email address and we will respond within 30 days. There is no charge.

11. Cookies

We set only the cookies needed to keep you signed in and to keep that session secure. There are no advertising or analytics cookies on Grayblock, which is why you have not been shown a consent banner — there is nothing to consent to. Clearing these cookies signs you out.

12. Security

Traffic is encrypted in transit. Passwords are stored as hashes. Access to the database is restricted by row-level rules, so one member's account cannot reach another's private data. Access to production systems is limited to the people who need it.

No system is perfectly secure. If a breach ever affects your data, we will notify you and the Data Protection Board as the law requires.

13. Children

Grayblock is for people aged 18 and over, and we do not knowingly collect data about anyone younger. If you believe a child is using Grayblock, tell us and we will close the account and delete the data.

14. Changes to this policy

If we change this policy we will update the date at the top, and we will tell you by email or in the app before any change that materially affects you takes effect.

15. Grievance Officer

If you are unhappy with how we have handled your data, contact our Grievance Officer at team@grayblock.io. We acknowledge within 24 hours and aim to resolve within 15 days. If you are still not satisfied, you can complain to the Data Protection Board of India.