The full text
Privacy Policy
Who we are
Calmistry (calmistry.thinknorth.consulting) is a self-understanding service about stress, made and run by Think North Consultancy, a consulting firm based in India. Under India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and the DPDP Rules, Think North Consultancy is the Data Fiduciary: we decide why and how your personal data is used. For visitors from the European Union or the UK we are the controller.
Contact for anything on this page, including requests and grievances: the contact form. Using Calmistry, and giving us any data beyond what showing you a result needs, is voluntary.
This policy covers the Calmistry website and the emails it sends. It sits alongside our Terms of Use.
What Calmistry offers today, and what may come
Today Calmistry offers stress-response self-assessments: short quizzes and a fuller profile describing how stress tends to behave for you. Nothing on Calmistry today is based on astrological charts, and no result you see today uses your birth details.
If you switch on Save my profile, we may later offer further personal assessments within a disclosed family of areas: stress and coping, relationships and marriage, family, friendships, work and career, education, relocation and places, health and wellbeing habits, gifting, home and surroundings (such as scents and spaces), and similar life choices. Future assessments in these areas may use your saved birth details, including insights based on astrological charts. Before any such feature uses your data we will tell you, and you will be able to switch it off.
Anything Calmistry shows you, now or later, is exploratory self-reflection: not a prediction, not a guarantee and not advice. Wellbeing content stays non-medical. Any future processing specific to your health will ask for its own separate, explicit consent first, because Indian law treats health information as sensitive personal data.
Your three permissions
Three separate permissions decide what happens with your data beyond showing you a result. Each is off until you switch it on, each is recorded with the version of the notice you saw, the versions of these terms and this policy, and the time. Each can be switched off on its own, as easily as it was given, in Me → Your Calmistry profile. Saying no to the second or third never limits the first, or anything else on Calmistry.
| Permission | What it covers | What we use it for | If you switch it off |
|---|---|---|---|
| 1. Save my profile (needs an account) | Your birth details (date, time and how exact it is, place), answers, results, optional details about you (see What we collect) and related information you give us | Keeping your results and history across devices; reusing what you told us in present and future personal assessments in the areas listed above, so you don't answer the same thing twice | We delete the birth details and About-you details saved in your profile at once and stop reusing your information in other assessments. Your results stay viewable until you delete them |
| 2. Help improve the assessments (optional) | Your answers, results and later outcomes (for example a retake or a check-in), linked under a random code, not your name, email or account | Checking whether each question measures what it should; checking and tuning scoring; testing the stress-mechanics model and how well it predicts how answers change over time (this links your answers across visits); research into stress, psychology, health and wellbeing, relationships, and astrology, using what you share under that code | Your answers are left out of every improvement analysis we run from then on. Findings already worked out describe groups, never you, and can't be undone |
| 3. Birth-timing research (optional) | The birth details you give the research, your answers and results, and a few research-only questions, under a random research ID | Research into stress, psychology, health and wellbeing, relationships, and astrology: in particular, testing whether birth timing, as used in Vedic astrology, adds anything to explaining or predicting stress patterns beyond psychology and demographics, against random comparison charts; publishing de-identified findings either way | Withdrawing deletes your birth details, research answers and consent records held for the research, and gives you a receipt code. Findings already published in aggregate can't be un-published. Otherwise research data is kept unless you ask us to delete it, or Think North Consultancy decides to purge, stop or refresh the research or its data; the profile inactivity review does not delete it |
Explicit acceptance when you give birth details
Whenever you submit birth details (in the research flow, when you change them in Settings, or in your profile), the form shows what we collect, why, how to withdraw and how to complain, and has one box, unticked, confirming you are 18 or older, accept the Terms of Use and this Privacy Policy (the current versions are shown), and give the permission described there. Nothing is saved until you tick it. We record which versions you accepted, which permissions you gave, and when.
If you already shared birth details with the research
We never turn research data into a profile on our own. If you are signed in and gave birth details to the research, we ask you once: “Use the birth details you already gave us for your profile too?” If you say yes (and tick the acceptance box), we copy the stored, encrypted details into your profile, with no re-entry, and switch on Save my profile. If you say no, nothing is copied and we don't ask again. The two copies are independent: deleting one never deletes the other.
Managing permissions
You manage each permission yourself in Me → Your Calmistry profile. Calmistry does not currently connect to a Consent Manager registered with the Data Protection Board of India; if that changes, we will say so here.
What we collect
We collect as little as we can and keep each kind of data for a stated reason. Everything below is optional except the device cookie and what you type into a quiz you choose to take.
| What | When | Why |
|---|---|---|
| Quiz answers: which option you picked, the order the options were shown in, how long each answer took, and basic display settings (such as reduced motion) | When you take a quiz or the full test | To work out your result and to spot rushed or random answering; for improving the questions only if you switch on Help improve the assessments |
| Results: the bands and labels we show you (never raw scores) | When you finish | To show your result again and power Me, invites, Boxes and your circles |
Device cookie (calm_dev): a random code, signed so it can't be forged | On your first visit | So your progress and results stay with your device without an account |
| Approximate region and network type, worked out from your IP address on your first visit (country; for India, the broad zone and whether it is a large city; whether it is a mobile, broadband, education or cloud network), with your browser language, the kind of site you arrived from and your device type. Your IP address itself is not stored for this. IP geolocation by DB-IP | On your first visit | To decide how likely we are to show you one home-page section about our birth-timing research, recorded with that decision so the research can account for who saw it |
| Email address, held by our sign-in provider Clerk (plus the basic profile Google shares, if you sign in with Google). We read only your email address | Only if you sign in | To keep your results across devices, hold your profile, send emails you ask for and the inactivity notice |
| Your Calmistry profile: the permissions you gave, your birth details if you save them (encrypted), and your answer to the one-time research question | Only if you switch on Save my profile | As described under Your three permissions |
| Place searches: the letters you type into a place box (at least 3) | When you search for a birth place or where you live | To suggest matching places. Our server sends only the typed text to Photon (see Who else handles your data), never your IP address, device, account or any other identifier. Results are cached on our server for 7 days by the typed text alone. The place you pick is stored with your details as described in this table |
| About you (all optional): preferred and full name, gender, where you live now (the place you pick from the search, or type yourself, with its state, country and time zone; we don't keep its coordinates), what you mostly do, your role or stream, life stage, anything you choose to share about your life or what's weighing on you, and questions about stress you'd like answered | Only if you switch on Save my profile and fill them in | To understand stress across different lives, and to decide what to write about and research next. Names and free text are encrypted; what you share may include health or relationship details, so we treat it as sensitive: it is never shown to your circles, Boxes or anyone else, and is deleted if you switch off Save my profile. Your gender, if you also take part in the research, is asked once and used in both |
| Permission and acceptance records: which permission, on or off, the notice version, the Terms and Privacy Policy versions, your 18+ confirmation and the time | Whenever you grant or switch off a permission, or submit birth details | To show what you agreed to and when, as the DPDP Act requires |
| Your circles: the private nickname (encrypted) and relation you give people you are connected with | Only if you add a label | To show you your circles in your own words. Nobody else sees them |
| Invites: a nickname and relation you give the person (encrypted, visible only to you); if you ask us to email the invite, their address | When you invite someone | To show you who you invited and how far they got (only if they keep updates on). After the invite email is sent we keep only a keyed hash of their address, never the address itself |
| Boxes: the Box name (encrypted) and, if you choose, your first name (encrypted) | When you start or join a Box | To show the group its Box and read-out. It never shows anyone's answers or scores |
| Share links: the result card you choose to share | When you share | Anyone with the link sees the card (your material, not your answers) |
| Check-in answers: whether you tried a practice, whether it helped, and one adjustment, from fixed choices | Only if you opt in to a check-in after the full test | To see whether practices help and improve them |
| If-then plan text you type on a results page | Only if you write one | Kept in your browser session (a short-lived record that ends within two weeks), never in your account, results or research data |
| Email preferences: which optional emails you want, pauses, your monthly limit, time zone for quiet hours, and a record of what we sent and why | When you set them, and when we send | To follow your choices and our contact rules, and to show we did |
| Research data (see Birth-timing research) | Only after you give explicit consent | Research by Think North Consultancy |
| Contact form messages: your reason, your message, and a reply address if you give one | Only if you write to us | To read and answer what you sent |
| Which pages and articles you view on Calmistry, in order, before and after a quiz: the kind of page, which article, material or finding it was, when, and how you arrived (for example through a shared link or a campaign link). Linked to your device, and to your account if you sign in | While you use the site | To understand how what you read may shape your answers, so our research can account for it, and to improve the site |
| Your last visit date | When you visit (at most once a day) | To run the 3-year inactivity review |
| Usage and technical data: pages visited, clicks and scrolls (Microsoft Clarity), product events (for example ‘quiz finished’), IP address and browser in server logs, error reports | While you use the site | To keep the site working and secure and to make it better |
Product events never carry birth details, free text, names, email or phone numbers: the system refuses any event that tries. For invite-abuse checks we keep a keyed hash of a shortened IP address and browser type, never the raw values.
Email only if you ask. Optional emails stay off until you switch them on: at most one a week, three a month, never between 9 pm and 8 am. Service emails you asked for (such as your result link) and the inactivity notice are separate.
Your circles, and people who haven't joined
Your circles list the people you are connected with on Calmistry: people you invited, people who invited you, and people who share a Box with you. You can give each one a private nickname and a relation (close family, partner, extended family, friends, colleagues, classmates, other). Those labels are yours alone: encrypted, never shown to the other person or anyone else.
You see someone's material only where they chose to share it with you: a comparison they accepted, or a Box whose read-out is open for you. You can compare with them and pick people for a Box; each person joins a Box with their own consent.
We never build a stored, identifiable profile of someone who hasn't joined Calmistry and agreed themselves. A nickname or relation you give them is your own private label, linked to your invite, not to them. If a future feature lets you enter another person's birth details, we will process them only for that moment and not store them, unless that person joins Calmistry and consents themselves.
Birth-timing research (only if you opt in)
Think North Consultancy studies how stress behaves in people. With people who choose to take part, we research stress, psychology, health and wellbeing, relationships, and astrology, and in particular test whether birth timing, as used in Vedic astrology, adds anything useful on top of the psychology and demographics. Birth timing means the date, time and place someone was born. We don't know the answer; that is why we test it. More on Why we built this.
You are asked only after you have your result. Taking part is voluntary and never needed to use Calmistry. Joining takes one unticked box confirming you are 18 or older and agree to the research use described there; saving your birth details takes the acceptance tick described above.
What the research holds
- Your consent records: which version of the notice you saw, when you agreed, your 18+ confirmation, and two separate optional choices (findings emails; a follow-up test in 12 to 24 months).
- One awareness question: whether you knew, before answering, that Think North Consultancy also studies birth timing.
- Your birth date, birth time if you know it (with how you know it and how exact it is) and birth place. The place is stored as the name you picked from the place search (an OpenStreetMap place, with its state, country, coordinates and the time zone worked out from them), or the place, state and country you typed yourself (no coordinates unless you enter exact ones), plus the UTC offset used for that date and time. Earlier versions are kept if you correct them, so the research knows which details it used when.
- Your gender, if you give it (a self-description is encrypted).
- Optional: 20 short public-domain personality questions (the Mini-IPIP) and one question about how carefully you answered.
- How long the research notice was open and whether you opened ‘How we look after it’, so we can check the notice is being read. It never blocks anything.
- Your quiz answers and results, linked to all of the above through a random research ID rather than your name or email.
How it is protected
- Birth details are encrypted field by field and kept in a separate table from your answers.
- Only named research administrators can decrypt them, and every read is logged (who, when, why) before the data is opened.
- Analysis is done on the whole group, next to comparisons made from random birth details. Today no one, including you, is shown astrological output about an individual participant from the research.
- We publish only aggregate, de-identified findings. When a journal asks for data alongside a paper, we share only a de-identified subset: nothing that names you, no email, no account or device ID, reduced to what the analysis needs.
Withdrawing
Withdraw anytime in Me → Research and your birth details. We delete your birth details, your research answers, your consent records and research events, and give you a receipt code. We keep only an anonymous note that a withdrawal happened. Findings already published in aggregate can't be un-published, but your data won't be used in anything new. Withdrawing doesn't touch your quiz results or your Calmistry profile.
New studies
If Think North Consultancy starts research beyond what is described here, we will invite you again and explain what the new study involves. Your data is used for a new study only if you opt in to it. Saying no changes nothing about your use of Calmistry or the research you already agreed to.
How long research data is kept
Research data is kept unless you ask us to delete it (withdraw), or Think North Consultancy decides to purge, stop or refresh the research or its data. It is not deleted by the 3-year inactivity review of your profile: if your profile is deleted for inactivity, your research data stays with the research, detached from your device and account.
Why we use it, and on what basis
| Purpose | Basis under the DPDP Act |
|---|---|
| Giving you your result, saving your progress, Me, invites, Boxes, your circles and share links | You give us the data for this purpose and can stop anytime (a legitimate use under the Act); your consent where you sign in |
| Your Calmistry profile and reusing it across assessments | Your consent (Save my profile), withdrawable anytime |
| Improving the assessments (validation, scoring, the stress-mechanics model, predictive accuracy) | Your consent (Help improve the assessments), withdrawable anytime |
| Birth-timing research | Your explicit consent, given on the research notice and at the acceptance tick |
| Optional emails (check-ins, retests, monthly notes, research findings) | Your consent, given per email type and withdrawable in one click |
| The inactivity notice and inactivity deletion | Keeping data no longer than needed; DPDP Rules on erasure |
| Answering a contact form message | You give us the data for this purpose when you write to us |
| Safety, abuse and fraud prevention (rate limits, invite-abuse checks, error monitoring, security logs, processing records) | Needed to run the service safely; legal obligations |
| Running and improving the site, and understanding how what you read may shape your answers (page analytics, product events, the order of pages you view) | Your use of the service; you can opt out of page recordings (see Cookies) |
| Meeting legal duties and answering lawful requests | Compliance with law |
We don't use your data for automated decisions that have legal or similarly serious effects on you. Your result is a description, not a decision about you.
What we never do
- Sell or rent your personal data.
- Show ads, or share data with advertisers or data brokers.
- Send marketing for anyone else.
- Email the people you invite beyond the one invite email you ask us to send (and one optional reminder, if they haven’t opted out).
- Show your answers or scores to anyone else: invites and Boxes show labels and group readouts only.
Who else handles your data
We use a small number of service providers (‘data processors’). Each handles only what it needs to do its job for us, under contract, and may not use it for anything else.
| Provider | What it does for us | Where |
|---|---|---|
| DigitalOcean | Hosts the website, database and backups | Bengaluru, India |
| Clerk | Sign-in (Google or email code); holds your email address and sign-in sessions | United States |
| Brevo | Sends our emails | European Union (France) |
| Microsoft Clarity | Page recordings and heatmaps (see Cookies) | United States |
| Sentry | Error reports, when switched on, with personal details stripped before they are sent | United States |
| Photon, run by komoot GmbH | Place search: suggests places as you type a birth place or where you live. It receives only the typed text, from our server; never your IP address, device, account or any identifier. Place data © OpenStreetMap contributors (ODbL) | Germany (European Union) |
We may also disclose data where the law requires it, for example to answer a valid order from a court or authority, and only as much as that order needs.
Transfers outside India
Calmistry itself is hosted in India. Clerk, Microsoft Clarity and Sentry process data in the United States, Brevo in the European Union, and Photon (place search) in Germany, which receives only the place text you type, sent by our server with nothing that identifies you. The DPDP Act allows these transfers unless the Government of India restricts a country; if it restricts one we use, we will stop or move that transfer. Saved birth details stay on our servers in India and are never sent to any of these providers.
How long we keep it
| Data | Kept for |
|---|---|
| Your Calmistry profile (permissions, saved birth details, About-you details) | While you keep it, subject to the 3-year inactivity review below. Switching Save my profile off deletes its birth details at once |
| Questions about stress you sent us | While you keep your profile, and deleted with it; a question we have answered may be kept without anything that identifies you |
| Answers, results and history (device or account) | While needed for your profile and history, subject to the same 3-year inactivity review, unless you delete them sooner |
| The improvement dataset | While the improvement work you consented to needs it, and only while Help improve the assessments is on |
| Birth-timing research data, including birth details | Unless you ask us to delete it (withdraw), or Think North Consultancy decides to purge, stop or refresh the research or its data. Not deleted by the 3-year inactivity review |
| Place search results (place names and coordinates, cached by the typed text, with nothing that identifies you) | 7 days |
| Anonymous findings (no one can be identified) | Indefinitely |
| Permission and acceptance records | While the data they cover is kept, and deleted with your account |
| Processing records (what was done, when, under a keyed code with no personal details) | At least 1 year, as the DPDP Rules require |
| Withdrawal receipts and birth-detail access logs (no birth details inside) | 5 years, to show we honoured your request |
| The log of what our staff did in the admin (for example, answering a request or changing a setting) | 5 years |
| Invites, Boxes and your circles labels | While you use them, subject to the inactivity review, unless you leave a Box, cancel an invite, or delete them sooner |
| Hashed addresses of people who unsubscribed or were invited | As long as needed to keep honouring the opt-out (a hash, never the address) |
| Contact form messages | 1 year, then deleted |
| Email send records and contact-rule decisions | 1 year |
| Product events | 13 months |
| Which pages and articles you viewed, in order | With your answers and results (same inactivity review); deleted with them, or when you withdraw from the research |
| Home-page section decision (region and network type, the decision and its probability) | With your answers and results (same inactivity review); deleted with them |
| Page recordings (Clarity) | About 30 days (heatmap totals up to 13 months, under Microsoft's settings) |
| Server and security logs | 1 year |
| Error reports (Sentry) | 90 days |
| Backups | Overwritten within 30 days, so deleted data leaves backups within 30 days |
The 3-year inactivity review
Calmistry is meant to be a service you can keep for life, so there is no fixed end date for your profile. But if you don't visit Calmistry or sign in for 3 years, we check: if you have an account, we email you to ask whether to keep your profile. If you don't come back within 60 days of that email, or we have no way to reach you (for example, data held only on a device), we delete your profile and the data linked to it, or make it permanently anonymous. Research data is not deleted by this review: before deleting an inactive participant's other data, we keep their research data, detached from their device and account, until they ask us to delete it or Think North Consultancy purges, stops or refreshes the research or its data.
For everything else, when a period ends we delete the data or make it permanently anonymous. We keep data longer only where a law requires it, and then only for that reason.
Your rights and how to use them
Under the DPDP Act, your rights can't be waived. You can ask for a summary of the personal data we hold about you and who we've shared it with, ask us to correct or complete data, ask us to erase it, withdraw consent anytime (as easily as you gave it, with no effect on anything done before), nominate someone to act for you if you die or can't act, raise a grievance with us through the contact form, and complain to the Data Protection Board of India if you're not satisfied with our answer. For any of these, or any other concern, the one thing we offer to put it right is deleting your data, available anytime in Me → Settings or through the contact form.
How
| You want to | Do this |
|---|---|
| Switch a permission on or off | Me → Your Calmistry profile |
| Delete your profile's birth details only | Me → Your Calmistry profile → Delete from my profile |
| Delete your account and everything in it | Me → Settings → Delete my account. We delete your profile and its birth details, your circles labels, answers, results, invites, Box memberships, the record of pages you viewed and research data, stop all emails, and delete your Clerk sign-in account. You get a receipt code |
| Withdraw from the birth-timing research | Me → Research and your birth details → Withdraw and delete |
| Stop optional emails | The unsubscribe link in any email (one click), or Me → Settings |
| Anything else: a copy of your data, a correction, a question, a concern, nominating someone, deleting data held only on a device | the contact form |
We may ask you to show that the data is yours (for example, from the device or the signed-in account that holds it) before we act. We reply within 7 days and finish within 30 days; if it will take longer we'll tell you why. There is no charge.
Age limit: adults only
Calmistry is for people aged 18 or older. We don’t offer the verifiable parental consent Indian law requires for anyone younger, so we don’t knowingly process children’s data. If you think someone under 18 has used Calmistry, write through the contact form and we will delete their data.
How we protect it
- Encrypted connections (TLS) for every page and email link.
- Field-level encryption for the most sensitive data: birth details (research and profile), invite nicknames, circles labels, Box names and first names. Keys are kept apart from the database and can be rotated.
- Access limited to the people who need it: admin pages are open only to a short allowlist and need a recent sign-in.
- Audit logs for every read of birth details.
- Personal details scrubbed from logs and error reports.
- Rate limits and abuse checks on invites, Boxes, the contact form and quiz submission.
No system is perfectly secure. If a personal data breach happens, we will tell the people affected without delay, in plain language, what happened, what it may mean for them and what they can do, and we will report it to the Data Protection Board of India as the DPDP Act and Rules require.
If you are in the EU or the UK
If the EU or UK General Data Protection Regulation (GDPR) applies to you, Think North Consultancy is the controller and these are our lawful bases:
- Contract: giving you your result and the features you use.
- Consent: Save my profile, Help improve the assessments, the birth-timing research (explicit consent), optional emails and page recordings where consent is required. Withdraw anytime.
- Legitimate interests: keeping the service secure, preventing abuse and fixing errors, balanced against your rights.
- Legal obligation: where a law requires us to keep or disclose data.
You can access, correct, erase, restrict, port and object to the processing of your data, withdraw consent, and complain to your local data protection authority. Your data is processed in India and in the countries listed above; where the law requires it, transfers use standard contractual clauses or another lawful safeguard. To use any right, write through the contact form.
Grievances and complaints
Write through the contact form. We acknowledge within 7 days and resolve within 30 days at most.
If you are not satisfied with our answer, you can complain to the Data Protection Board of India through its official website, as the DPDP Act provides.
Changes to this policy
When we change this policy we update the version and effective date at the top. If a change affects what we collect, why, or how long we keep it, we tell you on the site (and by email if you signed up for emails) before it applies, and ask for fresh consent where the law requires it. Returning visitors see a short notice summarising what changed.
Questions, requests or concerns
Write through the contact form. We reply within 7 days and finish within 30 days. For any concern, the one thing we offer to put it right is deleting your data -- any time, in Settings or through the contact form.
Also read