PRIVACY NOTICE
Cognitive Materials Private Limited (the company, we, us, our). Corporate identity number U62013KA2024PTC190282. Registered office: 1007, Siddhartha Layout, Kadugodi, Bangalore South, Bangalore 560067, Karnataka, India. Grievance Officer: Meghavarsha Rajeshwari, grievance@fyzygy.com, email only. General contact: support@fyzygy.com. This is an adults-only service for users aged eighteen and over. Fyzygy is a trademark of Cognitive Materials Private Limited.
Last updated: 8 October 2026.
WHO WE ARE
Cognitive Materials Private Limited is the data fiduciary for the personal data described in this notice. Our registered office and contact details appear above.
WHO MAY USE OUR PRODUCTS
Our products are for adults aged eighteen and over. A date of birth is collected at signup to confirm the user is old enough, and anyone under eighteen cannot create an account. The date of birth is stored on the account and is never shown to anyone. We do not knowingly collect personal data from anyone under eighteen, and we do not offer a parental-consent route, because we do not offer the service to children.
WHAT THIS SURFACE DOES
The account centre is where a user logs in, manages their profile, sets their consent choices, and deletes their account. Signup happens at a product, not here.
WHAT WE COLLECT HERE
At the account centre we process account identity data, namely the email address or phone number and the password; the date of birth; the public handle and the display name the user sets for each product; and the record of the user's consents and their history. The account centre does not process notes content or knowledge content. When a user signs in, or resets a password, or changes the phone number or email on the account, a code is sent to verify it; a change of phone number or email sends a code to both the old and the new contact before it takes effect.
HOW WE USE THIS DATA
We use it to create, secure and operate the account, to verify sign-in and contact changes, to record and honour the user's consent choices, and to let the user exercise their rights. We use the email address or phone number only for account-related purposes. We rely on the user's consent and on the other lawful bases available under the Digital Personal Data Protection Act.
THE FYZYGY ACCOUNT AND YOUR HANDLE
A person has one Fyzygy account across the products. The account has a public handle, written with an @, which is the same in every product. A user can change the handle at most once every thirty days. A retired handle is never reused by anyone; after an account is erased, only the bare handle string is kept, with no link to the person. A user sets a display name for each product. One switch, "Let people find me by handle", controls whether other people can find the user by their handle in Fyzygy Take's people search. Fyzygy Shelf and Fyzygy Conductor show a user's handle to no one.
CONSENTS
At signup a user gives two required agreements, separately: agreement to this Privacy Notice, and agreement to the Terms. These are stored while the account exists. Two further forms of processing are optional and off unless the user chooses them, and they are separate consents with separate purposes. Cross-app analytics is used to understand how the same person uses more than one Fyzygy product, so that we can improve those products; it is not used for advertising and not for ad targeting, and when it is switched on the person's account identifier is attached to those measurement events. Personalised advertising is a separate option, described on the advertising pages, that uses a user's activity within our own products to make advertising more relevant. Each is off unless chosen, and each can be switched off again at any time here in the account centre. Switching either off does not remove access to any product.
NO PERSONAL DATA GOES TO ANY ARTIFICIAL-INTELLIGENCE MODEL
We use an automated language model only on Fyzygy Conductor, to extract structure from public source text. No personal data is ever sent to that model.
WHO PROCESSES DATA FOR US
We use Amazon Web Services, in the Asia Pacific Mumbai region, for the database and compute; MSG91, for email and SMS; Google Firebase, for push notifications; and Vercel, for the websites. Each processor is engaged under a contract that requires it to protect personal data.
SHARING
We do not sell personal data. We do not share personal data with advertisers. Advertisers receive only anonymised and aggregated performance information, from which no individual can be identified. We share personal data only with the processors above, and where the law requires it.
RETENTION
We keep personal data only as long as needed for the purpose, or as the law requires.
| Category | Retention | Reasoning |
|---|---|---|
| Account identity, that is email or phone and password hash | While the account is active. On deletion, removed on the deletion timeline below. | Needed to provide and secure the account. |
| Date of birth | While the account is active. Removed on deletion. Never shown to anyone. | Needed to confirm the user is old enough. |
| Codes sent at sign-in | Expire ten minutes after they are sent; their records are removed within an hour. | Needed only to verify. |
| Public handle | While the account is active. On deletion the handle is retired, and only the bare string is kept, with no link to the person. | A stable public name, and preventing reuse of a retired handle. |
| Consent records | Kept after deletion in a minimised, pseudonymised form, as proof that our past processing was lawful, for the limitation period for related claims. Twenty-four months. | Establishment, exercise or defence of legal claims, and legal obligation. |
| Server and access logs | One year minimum. | Prescribed as a minimum by the Digital Personal Data Protection Rules 2025. |
| Backups | Age out on the backup rotation after deletion. | Backups cannot be edited item by item. They age out. |
CROSS-BORDER
Some processing takes place outside India, because our websites are served by a global provider.
YOUR RIGHTS
A user may access their personal data, correct or complete it, erase it, nominate another person to exercise rights in the event of death or incapacity, and withdraw either optional consent. These rights are exercised here in the account centre. To raise a concern, a user may contact the Grievance Officer, and may escalate to the Data Protection Board of India.
DELETION
When a user asks to delete their account, we deactivate it at once, which ends access to every product and revokes active sessions, and we erase the personal data thirty days after the request, by an automatic check. During those thirty days the user can restore the account by signing in to the account centre and pressing Activate account; signing in alone does not restore it. Deletion is carried out in the account centre; in Fyzygy Take the Delete Account control opens it, and in Fyzygy Shelf and Fyzygy Conductor the account menu opens it. What is erased includes the account identity, the date of birth, active sessions, push registrations, the user's data and media across Fyzygy Take, Fyzygy Shelf and Fyzygy Conductor, and the account's analytics events, and the account's identifier is removed from aggregate rows; the public handle is retired. Erasing an account also removes the person's traces from other people's data: others' reposts of the person's posts are removed; a quote-share keeps the quoter's own words and shows "This post is no longer available."; tags of the person are removed; and notifications that named the person are removed. Where someone else typed the person's handle into their own text, it stays as written; the handle itself is retired and leads nowhere. Pushes already delivered to phones cannot be recalled.
We keep some records after an account is erased, where the law requires: user reports; reported content, for one hundred and eighty days; uploads held by the child-safety check, and any preservation hold; consent records, pseudonymised, for twenty-four months; server and access logs, for the prescribed minimum period; and the retired handle, as a bare string with no link to the person. Erasing an account does not edit the server logs. An account under a child-safety preservation hold is not erased until the hold ends.
SECURITY
We protect personal data with access controls, encryption in transit and at rest where appropriate, and logging. No method is perfectly secure, but we take reasonable measures suited to the sensitivity of the data.
BREACH
If a personal data breach occurs, we follow our internal breach procedure, which includes notifying the Data Protection Board of India within seventy two hours as the Rules require, and notifying affected users where required.
CHANGES
We will update this notice as our products and the law change, and will make material changes visible before they take effect.
CONTACT
Grievance Officer: Meghavarsha Rajeshwari, grievance@fyzygy.com, email only. General contact: support@fyzygy.com. Registered office as above.