Privacy Policy
Last updated: 15 October 2026
This Privacy Policy explains what personal data MyCelestials collects, why, how we keep it safe, who can see it, and the choices and rights you have. We have tried to write it in plain words.
MyCelestials is operated by X-ionic Tech Solutions Pvt. Ltd. (CIN U72900PN2021PTC200623), registered office at 613/614, Rasta Peth, Pune 411011, Maharashtra, India ("MyCelestials", "we", "us", "our"). For the purposes of the Digital Personal Data Protection Act, 2023 and the rules made under it ("DPDP Act"), we are the Data Fiduciary for the personal data described here. Until the DPDP Act's main duties come into force, we also follow the Information Technology Act, 2000 and its rules on reasonable security practices. We have written this policy to meet the DPDP Act standard now.
This policy applies to the MyCelestials website (mycelestials.com and mycelestials.in), the MyCelestials web app (app.mycelestials.com), the MyCelestials app on Android and iOS phones (installed from our website, Google Play or the App Store), and any related services (together, the "Service"). By creating an account you confirm you have read this policy. Where we rely on your consent, we ask for it clearly and separately, as described in section 4.
1. The short version
- We collect only what it takes to run MyCelestials: your name, mobile number, wishes, friends, the addresses you choose to add, gift activity and basic technical data.
- Your lists are private until you choose who sees them. You will never see what has been reserved for you until it arrives.
- Your delivery address and delivery contact number are shown only to the friend sending you a gift, and only while they are holding that gift.
- Your data is stored on servers in Mumbai, India, and is encrypted in transit and at rest. Staff access is limited and every access is logged.
- We never sell your data and never show ads. We may earn a commission from stores when someone buys through a link.
- You can download your data or delete your account at any time from Profile > Account & Data.
2. What we collect
| Data | What it includes | Where it comes from |
|---|---|---|
| Account details | Name, mobile number, profile photo (optional), short bio (optional), and your privacy choices, such as whether people can find you by your number | You |
| Sign-in data | One-time passwords (OTPs) sent to your number, session tokens | Generated when you sign in |
| Wishes | Items you save, product links, titles, prices, images fetched from the store, lists, occasions, notes, list privacy settings | You, and the store page you save from |
| Your circle | Friends you add, friend requests, close-friend settings, invite links | You |
| Contacts you pick | Only the names and numbers you select when you tap "Choose from contacts" | Your phone, with your permission |
| Delivery addresses | Recipient name, address, landmark, city, state, pin code, delivery contact number, delivery instructions and preferred delivery days, labelled (for example Home, Office), and which list each one is used for | You |
| Device and notifications | Push notification tokens for the web and mobile apps, so we can send the notifications you allow | Your device, with your permission |
| Photos you add | Profile photo, wish photos and gift memory photos you choose to upload | You, from your camera or gallery, with your permission |
| Gift activity | Reservations, items marked as ordered, tracking links, notes, reasons, thank-yous, gift memories | You and the friends you gift with |
| Important dates | Birthdays, anniversaries and other events you add, and who they are shared with | You |
| Messages | Chats with friends inside the Service | You and your friends |
| Price data | The price shown on the store page when you save an item | Store pages |
| Technical data | Device and browser type, IP address, approximate location from IP, app version, error logs, basic usage events | Your device |
| Support data | What you tell us when you contact us, and any reports you make about a user. If you ask for help without signing in, the mobile number and message you give us | You |
What we do not collect: card numbers, UPI IDs, bank details or any payment credentials. Purchases happen on the store's own website or app, under that store's privacy policy. We do not collect sensitive data such as health, religion or caste, and we ask you not to add it to notes or messages.
3. Why we use it
| Purpose | Data used | Basis |
|---|---|---|
| Create your account and sign you in by OTP | Account details, sign-in data | Consent |
| Save and organise your wishes, fetch product details | Wishes, price data | Consent |
| Show each list only to the people you chose | Wishes, your circle, list settings | Consent |
| Let friends find you and send friend requests | Mobile number, your circle | Consent |
| Find friends from contacts you pick | Contacts you pick | Consent, asked when you use the feature |
| Hold a gift for a friend for 4 hours and hide it from you | Gift activity | Consent |
| Share your chosen address with the friend sending you a gift | Delivery addresses | Consent, given when you add the address |
| Send notifications you expect (friend requests, "someone's thinking about you", gift updates, thank-yous, messages, date reminders) | Account details, gift activity, important dates | Consent |
| Keep the Service secure, prevent fraud and misuse, fix problems | Technical data, sign-in data | Consent (part of running the Service) and legal obligation |
| Respond to you, handle reports and grievances | Support data | Consent and legal obligation |
| Meet legal obligations and respond to lawful requests | Any data we are required to provide | Legal obligation |
We do not use your data to build advertising profiles, and we do not sell or rent it.
4. Consent and your choices
- At sign-up, we show a short notice of what we collect and why, with links to this policy and our Terms of Use, and ask you to agree by ticking a box. Marketing messages, if we ever send them, are a separate opt-in.
- Phone permissions: we ask for a permission only when you use the feature that needs it, and explain why first. You can turn any of them off at any time in your phone's settings.
- Contacts: only when you tap "Choose from contacts". We use and store only the contacts you select. We never upload your whole contact list.
- Notifications: to send the alerts you choose.
- Camera and photos: only when you add a photo, and only the photo you pick.
- Addresses: when you add an address, we show who will be able to see it. Adding it is your consent to that sharing.
- Who can find you: you choose whether people who already have your number can find you by it, and whether your photo shows in search.
- List privacy: every list has its own setting (Private, Close friends, Friends, or Anyone with the link). You can change it at any time.
- Withdrawing consent: withdrawing is as easy as giving consent. You can do it at any time from Profile > Account & Data, by changing settings, removing data, revoking phone permissions, deleting your account, or by writing to [email protected]. Withdrawal does not affect processing done before it. Some features will stop working without the data they need.
You may also manage your consent through a registered Consent Manager under the DPDP Act, once that option is available.
5. Who can see your data
| Who | What they can see |
|---|---|
| You | Everything in your account, except which of your wishes a friend has reserved or ordered, until the gift arrives |
| Friends and close friends | The lists you have shared with them, your name and photo, the important dates you shared |
| Anyone with your list link | That list only, if you set it to "Anyone with the link" |
| A friend sending you a gift | The delivery address and delivery contact number you selected for that list, only while they are holding that gift, so they can arrange delivery |
| Other givers on the same list | That an item is "Already taken care of", never who took it |
| Other members | Your login mobile number is never shown on your profile or to other members |
Service providers (Data Processors). We use trusted providers to host data, send OTPs and messages, and keep the Service running. They process data only on our instructions, under written contracts that require security and confidentiality. They currently are: Supabase (database and storage, Mumbai region), Cloudflare (website and app hosting), Twilio (sending one-time passwords and messages), and Apple and Google (delivering push notifications to your phone). If we add or change a provider, we will update this list. Our providers also keep their own short-term technical logs, for example of sign-ins and of messages sent, under their contracts with us.
Stores. When you or a friend open a product link, you leave MyCelestials and the store's own terms and privacy policy apply. Some links are affiliate links, so the store may learn the visit came from MyCelestials and pay us a commission. We do not share your name, number or address with stores.
App stores. If you download our app from the Apple App Store or Google Play, Apple or Google handle the download under their own terms and privacy policies. They may share anonymous statistics with us, such as numbers of installs and crash reports, which we use only to fix and improve the app.
Sharing through WhatsApp. When you share a list or an invite through WhatsApp, the message is sent by WhatsApp from your own phone, under WhatsApp's own terms and privacy policy.
Legal reasons. We may disclose data if required by law, court order or a lawful request from a government authority, or to protect the rights, safety or property of users, the public or MyCelestials.
Business changes. If MyCelestials is merged, acquired or restructured, data may transfer to the new owner, who must continue to protect it under this policy.
6. People who are not on MyCelestials yet
We do not store the phone numbers of people who are not on MyCelestials. When you look for a friend by number, we only check whether it belongs to a member who allows being found that way; if it does not, the number is discarded straight away. To invite someone, you share a private invite link yourself; we never message people on your behalf.
Please only add people you know and who would expect to hear from you. When you add someone's details, you are responsible for having the right to share them.
7. What you choose to share
MyCelestials gives you the controls; you decide how to use them. What others can see depends on the list settings, friends, links and addresses you choose. If you share a list link, or share with someone who later screenshots or forwards it, that is outside our control. Please review your settings before you share, and see our Terms of Use (sections 11 and 12) for your responsibilities.
8. Where your data is stored
Your data is stored on servers in Mumbai, India. It is encrypted in transit (HTTPS) and at rest. Some providers, such as message delivery services, may process limited data outside India; any such transfer happens only as permitted under the DPDP Act and with safeguards in place.
9. How long we keep it
| Data | How long |
|---|---|
| Account, wishes, circle, addresses, dates | While your account is active |
| Gift memories | While your account is active; a memory a friend received from you stays in their account |
| Messages | While your account is active, unless you delete them earlier |
| OTPs | Minutes; they expire after use |
| Technical and security logs, staff and address access logs | At least 1 year, as the law requires, then deleted |
| Basic account records after deletion (mobile number, sign-up and deletion dates) | Up to 1 year, only to meet legal duties, then deleted |
| Help requests sent without signing in | Up to 1 year after the request is closed, then deleted |
| Everything else, after you ask to delete your account | Hidden at once; permanently deleted or anonymised after a 15-day restore window |
Deleting your account. When you ask to delete your account, your profile, lists and circle are hidden from everyone straight away, and any gifts you are holding for others are released. For 15 days you can sign in and restore your account. After that, your profile, lists, addresses, photos, messages and device tokens are permanently deleted. Gift memories that live in your friends' accounts stay with them, showing "A friend" instead of your name, or just your first name if you chose to keep it in their memories. Indian law requires us to keep a small set of records for a limited time even after deletion: basic account records and security logs, kept for up to one year. These are stored securely, are not visible to anyone on MyCelestials, and are used only if the law requires, for example to answer a lawful request or investigate misuse.
10. How we protect it
- Encryption in transit and at rest.
- Row-level permissions, so each person can only see what has been shared with them.
- Every view of a delivery address is recorded in an audit log.
- Photos are stored privately and shown through short-lived links that expire after about an hour. They are not public web files.
- Sign-in by one-time password; we never ask for or store passwords.
- Staff access needs two-factor authentication and is limited to a small number of authorised people, only to run the Service, help you, look into a report or meet a legal requirement. Every access is logged.
- Regular reviews of our providers and security settings.
No system is perfectly secure. If a personal data breach affects you, we will tell you without delay through the app or your registered number, explaining what happened, what it may mean for you and what we are doing about it. We will also report it to the Data Protection Board of India and to CERT-In as the law requires.
11. Your rights
Under the DPDP Act you can:
- Access a summary of the personal data we hold about you and how we use it, and the people we have shared it with.
- Download a machine-readable (JSON) copy of your data at any time from Profile > Account & Data.
- Correct, complete or update your data, most of it directly in the app.
- Erase your data by deleting it in the app, or delete your account from Profile > Account & Data (see section 9). If you no longer have the app, you can ask us to delete your account at mycelestials.com/legal/delete-account.
- Withdraw consent at any time (section 4).
- Nominate another person to exercise your rights if you die or become unable to.
- Raise a grievance with our Grievance Officer. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
To use a right we cannot handle in the app, write to [email protected] from your registered number's account or include your registered number. We may ask you to confirm your identity. We respond within the time the law requires.
12. Children
MyCelestials is for people aged 18 and above. We do not knowingly create accounts for anyone under 18. A parent may keep a family list, such as a list for a new baby, in their own account; that list is the parent's, and the parent is responsible for it. Please do not add a child's photo, full name, school or other personal details. If we learn that a person under 18 has created an account, we will delete it.
13. Cookies, device storage and tracking
We do not use advertising or tracking cookies, third-party analytics, ad pixels, advertising IDs or cross-site or cross-app tracking. The web and mobile apps use essential storage on your device to keep you signed in and secure, remember your light or dark theme, keep drafts while you edit, remember your recent searches on that device, and remember where you were. Recent searches and drafts are cleared when you sign out. One cookie remembers a layout setting. If we add privacy-friendly analytics, we will update this section and give you a way to opt out.
14. Your duties
Under the DPDP Act, users also have duties: do not provide false information, do not impersonate anyone, do not file false or frivolous complaints, and only share other people's details when you are entitled to. Under the DPDP Act, breaking these duties can carry a penalty of up to ₹10,000.
15. Changes to this policy
We may update this policy as the Service or the law changes. If a change is significant, we will tell you in the app before it applies and, where needed, ask for your consent again. We will also remind you of this policy at least once a year. The "Last updated" date shows the latest version, and earlier versions are available on request.
16. Contact and grievances
Grievance Officer: Sayali Saswadkar
Email: [email protected]
Address: X-ionic Tech Solutions Pvt. Ltd., 613/614, Rasta Peth, Pune 411011, Maharashtra, India
We acknowledge complaints within 24 hours and aim to resolve them within 15 days. See our Grievance Officer page for details.