Privacy Policy

Last updated: 6 July 2026

Deepform is operated by Cosmoplex AI Pvt Ltd (“we”, “us”). This policy explains what we process, why, and the choices and rights you have. It is written to align with India’s Digital Personal Data Protection Act, 2023 (DPDP). We are the data fiduciary for the personal data described here.

The core principle: your camera never leaves your device

Deepform measures eye strain and focus by analysing your camera on your device, in your browser. Video frames are processed locally to compute numbers (for example, blink rate and a strain score) and are then immediately discarded. No image or video frame is ever stored or transmitted to us or anyone else. There is no server that sees your camera.

What we process, and only with your choice

Everything below is optional. The app works fully offline with none of it.

• Derived measurements (numbers only): blink rate, blink completeness, posture score, a Visual Strain Score, and similar — never images. Stored on our servers only if you opt in to “save my results”.
• An anonymous device identifier (a random ID) so your own results and progress can be recognised on that device.
• Account data, if you create one: your email address (via Supabase Auth), plan, streak/XP, linked devices, and your session history so it can sync across your devices.
• Organisation data, if your workplace uses Deepform for teams: your email domain and team membership. Team reports show ONLY anonymised aggregates and never any individual’s data.
• Wearable recovery data, if you connect a wearable (e.g. Oura): daily sleep, HRV, resting heart rate and readiness — numbers only, used as wellness context, never diagnosis. Removed when you disconnect.
• Waitlist / contact details you submit (email or phone), with explicit consent, for product updates.
• Payment reference: if you buy an add-on, the UPI reference number you enter (no card data is collected).

What we do NOT do

• We do not store, upload, or have access to any camera image or video.
• We do not sell your data or use it for third-party advertising.
• We do not show individual employee data to organisation admins — team views are aggregate-only and suppressed below a minimum group size.

Where your data is stored

Data you choose to sync is stored in a managed PostgreSQL database hosted in India (Mumbai region). The application is served via Vercel’s global edge network. We use a small set of processors strictly to run the service:

• Supabase — database and authentication (India region).
• Vercel — application hosting.
• Google MediaPipe — the on-device face-analysis model, loaded to run in your browser (it processes frames locally; no video is sent to Google through Deepform).
• Resend — transactional and update emails (only if you provide an email).
• An LLM provider — optional report narrative; it receives derived numbers and locale only, never video or contact details.
• Ōura Health Oy — ONLY if you connect your Oura account: we retrieve your daily sleep, HRV, resting heart rate and readiness (numbers only) to add recovery context. Access tokens are stored encrypted; you can disconnect and erase this data anytime from your Account.

How long we keep it (retention)

We retain synced measurement data and session history for up to 6 months, after which it is automatically deleted. Account details are kept while your account is active; delete your account and they are removed. This retention window is enforced automatically by a scheduled job.

Your rights

Under the DPDP Act you can, at any time:

• Access and correct your data.
• Withdraw consent — simply stop syncing; the app keeps working offline.
• Erase your data — use “Delete account & data” on your Account page, which permanently removes your account, history, and synced data from our servers and wipes it from your device. You can also email us to request erasure.
• Raise a grievance with us (details below).

Children

Deepform is not directed at children. If you are below the age of majority in your jurisdiction, please use it only with verifiable parental or guardian consent as required by law.

Contact & grievance

For any privacy request or grievance, contact us at reach@cosmoplex.ai. We are Cosmoplex AI Pvt Ltd, the data fiduciary responsible for your personal data.

Changes

We may update this policy as the product evolves. Material changes will be reflected here with a new “last updated” date.

Deepform is a wellness and focus tool, not a medical device, and does not provide medical advice.