Legal
Privacy Policy
How Jay Tech Labs handles personal information across our products — Athelista, Panchang Calendar, and any custom software we build and operate for a client.
1. Who we are
Jay Tech Labs (“we”, “us”) builds and operates AI-powered software and SaaS products. We are based in India. Under India’s Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the data described here; under the GDPR and comparable laws we are the controller. The exception is software we build and operate on behalf of a business client — there, that client is the controller (Data Fiduciary) and we act as their processor under a separate agreement.
Privacy contact: privacy@jaytechlabs.com.
Jay Tech Labs
Malad West,
Mumbai 400064
2. What we collect
Account data
Name, email address, organisation or club name, role, password hash, and billing details processed by our payment provider (we never store full card numbers).
Content you enter
In Athelista: athlete profiles, session logs, performance measurements, training loads, notes and any wellbeing or injury information you choose to record.
Panchang Calendar does not send us any content. It has no account, and the preferences you set — your language and whether reminders are on — stay on your device.
Technical data
Device and browser type, IP address, timestamps, crash reports and product-usage events (which screens are used, which features are opened) so we can fix problems and decide what to improve.
This does not apply to Panchang Calendar, which contains no analytics or crash-reporting software and sends us no technical data.
Support communications
Emails, chat messages and attachments you send us, kept so we can answer and keep a record of the issue. This includes anything you submit through the contact form on this website: your name, email address, organisation, topic and message.
We do not buy personal data from brokers, and we do not collect special-category or sensitive data unless you enter it yourself in a field intended for it (for example, an injury note).
3. Why we use it
Under the DPDP Act we rely on your consent, and on “certain legitimate uses” such as responding to a request you made to us. Where the GDPR or a similar law applies, our legal bases are: performance of a contract, legitimate interests (security and product improvement), consent (marketing and optional analytics), and legal obligation.
4. AI features and your content
Some features use machine-learning models to summarise, forecast or flag patterns in the data you enter. We do not use your customer content to train third-party foundation models, and we do not sell it. Where a feature sends content to a third-party model provider to generate a response, that provider processes it only to return the output, under contractual terms that forbid training on it.
Model output can be wrong. Athelista’s flags are decision support for a qualified coach — they are not medical, safety or professional advice.
Panchang Calendar displays a fixed almanac compiled from a traditional printed panchang; observance dates vary legitimately between regional traditions, so it is a reference for planning and not a substitute for your own tradition or a qualified priest. It performs no calculations and uses no machine-learning models.
5. Athletes, and children under 18
Athelista is bought by coaches, trainers and clubs, who enter data about athletes — some of whom are minors. India’s DPDP Act treats anyone under 18 as a child and requires verifiable consent from a parent or lawful guardian; where the GDPR applies the threshold is lower (13–16 depending on the country), and we apply whichever rule is stricter for the person concerned.
If you record data about a minor, you confirm you hold the legal authority or parental consent to do so, and you remain responsible for what you enter. Records identified as belonging to a minor are handled with stricter defaults: reduced retention, no marketing use, no behavioural tracking or advertising, and no inclusion in de-identified research sets.
We do not knowingly collect data directly from children. If you believe a child’s data reached us without authority, write to privacy@jaytechlabs.com and we will delete it.
6. Athelista: Garmin and other connected devices
Athletes can choose to connect a Garmin account to Athelista so their workouts arrive automatically. Connecting is optional; athletes can instead upload workout files or mark sessions done by hand.
How you connect
You sign in on Garmin’s own page and approve access there. We never see or store your Garmin password. Garmin gives us access keys, which we store encrypted and use only to receive your data.
What we receive
Activity data from Garmin Connect: activity type and name, start time, duration, distance, pace or speed, elevation, heart rate (average and maximum), cadence, calories, laps, the device used and, where your device records it, the GPS route. Through Garmin’s Training API we send the workouts your coach planned to your Garmin device. We do not request Garmin’s health data (sleep, stress, all-day heart rate, steps or women’s health data).
How we use it
Only to run Athelista for you: to match each activity to the workout that was planned for that day, mark it done, and show your training history and progress. We do not use Garmin data for advertising, we do not sell it, and we do not use it to train AI models.
Who can see it
You, and the coach you have joined on Athelista. You choose separately whether your coach sees your activity details and whether they see which workouts you completed or missed, and you can change this at any time in Account › My coaches. We do not disclose Garmin data to anyone else, other than the hosting and storage providers that run Athelista for us under contract (see §8), or where the law requires it.
Disconnecting and deletion
You can disconnect Garmin at any time in Athelista or in your Garmin Connect account settings, and we stop receiving data straight away. Activities already imported stay in your training history unless you delete them or ask us to delete your account; on a deletion request we remove them within 30 days. If you withdraw permission or delete your Garmin account, Garmin tells us and we act on it.
7. Panchang Calendar
Panchang Calendar is a standalone almanac app. It is the one product on this page from which we collect nothing at all.
No account, no collection
There is no sign-in. We do not collect your name, email, location, contacts or any identifier. We use no analytics, no crash reporting and no advertising.
Everything stays on your device
The whole calendar ships inside the app and works with no network connection. Your language choice and your reminder preferences are stored on your device, and deleting the app removes them. If you have device backups switched on — iCloud on iPhone, iPad and Mac, or your Google account on Android — your operating system may include them in that backup, as it does for other apps. Those backups are controlled by you and by Apple or Google; we have no access to them.
Reminders
If you switch on festival or Ekadashi reminders, they are scheduled and delivered by your device’s own operating system. Nothing is sent to us or to any server, and the app never creates a push token.
Wikipedia
When you tap the name of a festival or observance, the app asks Wikipedia’s public API whether an article of that name exists, and may then open Wikipedia inside the app. The only information sent is the name you tapped — for example “Raksha Bandhan” — with no identifier of you or your device attached. Once a Wikipedia page is open you are browsing Wikipedia, and the Wikimedia Foundation’s privacy policy applies: foundation.wikimedia.org/wiki/Policy:Privacy_policy.
App updates
When the app opens with an internet connection, it checks Expo’s update service (run by 650 Industries, Inc., the company behind the framework the app is built with) for small fixes we publish between app-store releases. The check sends the app’s version, its release channel and your platform (iOS or Android), and may include a random identifier that the update service generates for this installation — it is not linked to your name, an account or an advertising ID. As with any internet request, the service also sees your IP address. Expo uses this only to deliver the right update, under its own privacy policy: expo.dev/privacy. Without a connection the check is skipped and the app works normally.
Future calendar updates
A later version may download an updated calendar for the following year. If that is added, the app will only ever download calendar data and will send no information about you, your device or your usage. This is not active in the current release.
8. Who we share it with
We share personal data only with service providers who help us run the product, under contract and only for that purpose: cloud hosting and storage, error and analytics tooling, email delivery, payment processing, and customer-support tooling. We also share data when required by law or valid legal process, and if our business is transferred we will notify you before your data becomes subject to a different policy.
In Athelista, an athlete’s training data is visible to the coach they join, within the sharing choices the athlete sets (see §6).
We do not sell personal information and do not share it for cross-context behavioural advertising.
9. Security
Data is encrypted in transit (TLS) and at rest. Access is limited to staff who need it, on least-privilege principles, with logging. We keep backups, test restores, and run a documented incident-response process — if a breach affects you we notify you and the relevant regulator within the timeframes the law requires, including the notification duties under the DPDP Act.
No system is perfectly secure; choose a strong, unique password and enable two-factor authentication where offered.
10. How long we keep it
Account and content data are kept while your account is active. After you close it we delete or de-identify your content within 30 days, except where we must keep records longer for tax, accounting or legal-defence reasons. Backups roll off within 90 days. Enquiries and support emails are kept for 24 months. Aggregated statistics that can no longer identify anyone may be kept indefinitely.
11. Your rights
Depending on where you live you may have the right to access, correct, complete, update, erase or port your data, to restrict or object to certain processing, to nominate someone to exercise your rights if you die or become incapacitated (a DPDP Act right), and to withdraw consent at any time.
You can export your data from the product at any time, or ask us. Write to privacy@jaytechlabs.com — we respond within 30 days and never charge for a first request. If we operate the product for a business client, send your request to them and we will assist.
If you are not satisfied with our answer, raise it with our Grievance Officer at grievance@jaytechlabs.com (see §15). If it is still unresolved you can complain to the Data Protection Board of India, or to your local data-protection authority.
12. Cookies and similar technologies
This website (jaytechlabs.com) sets no cookies and runs no third-party analytics, advertising or tracking scripts. Fonts and page assets are served from our own server, so loading a page here does not tell anyone else that you visited.
Our products are different: signing in to Athelista sets strictly necessary cookies for your session and for security, and optional analytics cookies run only if you consent in-product. Athelista’s mobile app uses device identifiers for crash reporting. Panchang Calendar does not: it has no account, no analytics and no crash reporting, and stores your preferences only on your device.
13. Where your data is stored
Our website and primary application data are hosted in India. Some service providers — for example error reporting, email delivery and model providers — process data in other countries. Where that happens we rely on approved transfer mechanisms such as Standard Contractual Clauses or an adequacy decision, contractually restrict what the provider may do, and apply additional safeguards where needed. Transfers are made only to countries not restricted by the Government of India under the DPDP Act.
14. Changes to this policy
We update this policy as our products change. If a change materially affects how we use your data we will notify you by email or in-product at least 14 days before it takes effect, and the “last updated” date above always reflects the current version.
15. Contact us
Privacy questions and data requests — access, correction, erasure, export or withdrawing consent — go to privacy@jaytechlabs.com. We acknowledge every request and respond within 30 days.
Grievance Officer
If you are not satisfied with how we handled a request, or you want to raise a complaint about our processing of your personal data, contact our Grievance Officer — the person designated under India’s Digital Personal Data Protection Act, 2023 to answer questions from Data Principals:
grievance@jaytechlabs.com
We acknowledge grievances within 7 days and aim to resolve them within 30 days. If we have not resolved yours, you may escalate to the Data Protection Board of India.
General enquiries: hello@jaytechlabs.com · contact form
Jay Tech Labs
Malad West,
Mumbai 400064