Privacy policy | SUN IT UP · Surya Namaskar for everyone

1. Who we are

SUN IT UP is run by Ritu Petkar, Pune, Maharashtra, India ("SUN IT UP", "we", "us"). Under the DPDP Act we are the Data Fiduciary for the personal data described here.

You can reach us about anything in this policy at hello@sunitup.in or through our Contact page.

2. What this policy covers

This policy covers the website sunitup.in, including its forms, the private Community Kit pages and our replies to messages sent through the site. Our pages on Instagram, YouTube and WhatsApp are run on those platforms, under their own privacy policies.

3. What you give us

We only collect what you type into our forms. Each form tells you why it needs the details, and asks for your consent before anything is saved.

Form	What we collect	Why
Take the pledge	Name, mobile number (WhatsApp), email, month and year of birth (used only to work out your age group; the date itself is never saved), city or area, how you'll salute the sun, your daily target, how you heard about us (optional); for under-18s, confirmation that a parent or legal guardian agrees	To count pledges and contact you on WhatsApp and email about the pledge and SUN IT UP updates
Register your community	Community or your name, type of community, city or area, approximate members, contact person's name, email and WhatsApp number, and month and year of birth (only to check you're 18 or over; not saved)	To review the registration, send your private Community Kit link and keep in touch about the Kit
Report a screening (Community Kit)	Date, which videos were shown, number of people, optional photos	To build your community's impact summary and certificate, and to count how many people SUN IT UP has reached
Share your story	Name, month and year of birth (only your age group is saved), area or city (optional), your story, an optional photo; for under-18s, confirmation that a parent or legal guardian agrees	To read your story and, if we choose to publish it, show it on our website and social media with your first name, age group and area
Contact us	Name, month and year of birth (only to check you're 18 or over; not saved), email or WhatsApp number, topic, your message	To reply to you

Please only send photos of people who have agreed to be photographed. Photos of anyone under 18 need a parent or guardian's permission.

4. What we collect automatically

Visit counts without cookies. To know how many people visit each day, and how many answer "Haan, kiya!" to our daily question, the site makes a scrambled code from your internet address and browser, using a secret that changes every day. Your internet address is never stored. The codes are deleted after two days; only daily totals are kept.
Security records. To stop spam and abuse, the site keeps short-lived records of how many forms were sent from a scrambled version of an internet address. These are deleted within two hours. Each saved form also keeps a scrambled code of the sender's internet address, never the address itself.
Error logs. If something breaks, the site writes a technical log that contains no names, phone numbers or emails. Logs are deleted after 90 days.

We do not use advertising or tracking cookies, tracking pixels, or analytics services that follow you across websites.

5. Cookies and what stays on your device

We set a cookie only when it's needed to keep you signed in:

Community Kit: when a community opens its private Kit link, a cookie keeps that device signed in to the Kit for up to 30 days.
Admin area: our team's sign-in cookie, used only on the admin pages.

Some features save information only in your own browser, and it is never sent to us: your practice tracker, your pledge badge details on the thank-you page, the thank-you message you write to the sun, your sound setting, and the heart on the health card. You can clear it at any time in your browser settings.

6. Why we use your data

We use personal data only to run SUN IT UP:

to count pledges, practitioners, communities and people reached, and report our progress (as totals, never naming individuals)
to send the updates and reminders you agreed to
to review community registrations, provide the Community Kit and prepare certificates, impact summaries and letters
to read, and with your consent publish, stories
to reply to messages and handle data requests
to keep the website secure and working

We rely on your consent, which you give on each form. You can withdraw it at any time (see Your rights and choices). Withdrawing doesn't affect anything we did before.

7. Who can see your data

The SUN IT UP team. Only a small number of named team members can see submitted details, through an admin area that needs a password and a one-time code. Every action there is recorded.
Service providers who help run the website: our web host (Hostinger), which stores the website and its database; email delivery for our replies and team alerts; and, if we use it, a security and speed service (Cloudflare) that passes visits to our site. They handle data only to provide these services to us.
The public, only for published stories. If we publish your story, it shows your first name, age group and area, with your photo if you sent one.
YouTube. Our videos are played through YouTube's privacy-enhanced mode. When you play one, YouTube may receive information about your device under its own privacy policy.

We never sell your personal data, and we don't share it for advertising. We'll disclose data to authorities only when the law requires it.

8. Where your data is stored

The website and its database run on servers in Mumbai, India. Our host keeps its own backups in Singapore. Our own nightly database backups are stored on the same server as the website.

9. How long we keep it

Pledges, community registrations, screening reports and messages: 3 years from when you sent them, or sooner if you ask us to delete them. Records older than 3 years are deleted automatically every night.
Stories: published stories stay until you ask us to remove them. Stories we don't publish are deleted automatically after 3 years.
Photos: deleted together with the story or screening report they belong to.
Daily visit codes: 2 days. Security records: 2 hours. Error logs: 90 days.
Backups: each nightly backup is deleted automatically after 14 days, so deleted data disappears from backups within 14 days.

10. How we protect it

The website uses a secure HTTPS connection.
Admin access needs a password and a one-time code from an authenticator app, signs out automatically, and locks after repeated wrong attempts.
Uploaded photos are re-drawn when received, which removes hidden information such as the location where they were taken, and they are stored where the website never serves them directly.
Internet addresses are only ever stored in scrambled form.
The private Community Kit link is stored in scrambled form and can be switched off at any time.

No website can be perfectly secure. If a breach affecting your personal data happens, we'll inform you and the Data Protection Board of India as the law requires.

11. Your rights and choices

Under the DPDP Act you can:

ask what personal data we hold about you and how we use it
correct or update it
ask us to delete it
withdraw your consent for updates or for a published story
nominate someone to exercise these rights for you if you're unable to
raise a complaint with us, and if you're not satisfied, with the Data Protection Board of India

To use any of these rights, write to us through our Contact page (topic: Data request) or at hello@sunitup.in. To protect you, we'll confirm it's you by replying to the email or WhatsApp number you used on our form. We aim to respond within 30 days.

Giving us your details is always voluntary; without them, some features (such as the pledge badge or the Community Kit) can't work.

12. Children

Everyone can read and use the information and guided practices on this website, whatever their age. Where we collect personal details, our forms ask for your month and year of birth.

Under 18: you can take the pledge or send a story only after confirming that your parent or legal guardian has read this policy and agrees. For the pledge, that confirmation is recorded with it.
Adults only: community registration and the contact form are for people aged 18 or over. If you're younger, please ask a parent, guardian or teacher.
Stories from under-18s are read by our team but never published.

We don't use children's data for tracking, profiling or advertising. If you're a parent or guardian and want your child's details removed, contact us and we'll delete them.

13. Links to other websites

Our pages link to Instagram, YouTube and WhatsApp, among others. Those services have their own privacy policies, and we aren't responsible for how they handle your data.

14. Changes to this policy

If we change this policy, we'll update the date at the top of this page. If a change affects how we use the data you've already given us, we'll ask for your consent again where the law requires it.

15. Contact and grievances

Questions or complaints about your personal data: hello@sunitup.in, or our Contact page (topic: Data request).

Grievance officer: Arha Doijode, SUN IT UP, Pune, Maharashtra.