ATHLIUMLegal
Privacy & Data
Protection Policy
Last updated 14 August 2026
This notice explains what personal data Athlium collects, why we use it, and the rights you have under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. It is a standalone notice. Please read it before you create an account or share information with us.
1. Who we are
Athlium (“we”, “us”, “our”) operates the Athlium website and app at athlium.app. Athlium is a personal achievement portfolio. You can log sports, cultural, leadership, internship, academic, service, and other achievements, add photos, and share a profile link.
For the Digital Personal Data Protection Act, 2023 (“DPDP Act”), Athlium is the Data Fiduciary for personal data we process to provide this service. You are the Data Principal.
This policy applies to people in India who use Athlium, and to personal data we process in connection with the service. Questions about this notice can be sent to privacy@athlium.app.
2. Personal data we collect
We collect only what we need to run your account and profile. We do not collect location, health or fitness metrics, payment card details, or advertising identifiers.
Account and identity
- Email address — to create your account, send confirmation and password-reset emails, and sign you in.
- Password — to authenticate you. We do not store your password in readable form; it is handled by our authentication provider.
- Full name — shown on your profile and used to suggest your profile link.
- Birth year — to confirm you are 18 or older. We do not collect a full date of birth. Accounts for people under 18 are not allowed.
- Profile link (slug) — the public URL you choose, such as athlium.app/john-doe.
Optional profile details
You can add these later in settings. They are not required to create an account:
- Mobile number
- College, course, and class year
- Profile title and about text
- Profile photo and banner
Achievement content you add
- Category (for example sports, cultural, internship, academic)
- Organisation or event name, rank or role, level, and date
- Free-text details
- Photos and captions you upload as proof
- Whether an entry is pinned, hidden, or marked for verification
Technical data
- Session cookies needed to keep you signed in
- Standard server and hosting logs (such as IP address, browser type, and request time) created when you use the site. We do not run advertising or product-analytics trackers.
- Account and content timestamps (created and updated times)
3. How we collect it
- Directly from you when you sign up, sign in, edit settings, add or import achievements, or upload photos.
- Automatically when you use the site, through essential cookies and hosting logs.
We do not buy personal data from third parties, and we do not offer social-login sign-in (Google, Apple, or similar) at this time.
4. Why we use your data
We process personal data with your consent, given when you create an account and accept this policy, and when you later add optional details or content. We use it only for these purposes:
| Purpose | What this enables |
|---|---|
| Create and secure your account | Sign-up, email confirmation, sign-in, password reset, and keeping you logged in |
| Build your portfolio | Store your name, profile details, achievements, and photos so you can manage them |
| Share your profile | Show the public, unlisted, or private profile you choose, at the link you pick |
| Export | Let you download a résumé-style PDF of selected achievements |
| Support and legal duties | Respond to your requests, fix issues, and meet applicable law |
We do not sell your personal data. We do not use it for advertising, profiling for ads, or automated decision-making that produces legal or similarly significant effects.
5. Your public profile
Athlium is designed so you can share achievements. You control how visible that is:
- Public — anyone with the link can view the profile.
- Unlisted — only people you send the link to can view it. It is not meant to be listed for general discovery.
- Private — only you can view it while signed in.
In settings you can also hide photos, hide unverified entries, and choose whether a résumé download is allowed. You can hide or delete individual achievements.
Profile photos and achievement photos are stored so they can be shown on your profile. Anyone who has the file URL may be able to open that file. Do not upload images you are not comfortable sharing, and do not upload other people’s personal data without a lawful basis to do so.
6. Cookies and similar technology
We use essential cookies to keep you signed in and to operate the service. These are required for the account features you ask for. We do not use advertising cookies, and we do not currently use third-party analytics cookies.
Your browser may also store a theme preference (light or dark) on your device. That stays on your device and is not used to identify you across sites.
7. Who we share data with
We share personal data only with service providers who process it on our instructions to run Athlium, and only as needed for the purposes above:
- Supabase — authentication, database, file storage, and account emails (confirmation and password reset).
- Vercel — website hosting and related infrastructure logs.
We may also disclose data if required by Indian law, a court, or a competent authority, or to protect the service, our users, or the public from serious harm.
If you set your profile to public or unlisted, the information you choose to show is visible to people who open that link. That is sharing you control, not a sale of data.
8. Transfers outside India
Some of our processors are located outside India, or may store or access data on servers outside India. Under the DPDP Act, personal data may be transferred outside India except to a country or territory restricted by the Central Government. We will not transfer personal data to any restricted country.
If you use Athlium, you understand that your data may be processed in India and in other permitted countries where our processors operate.
9. How long we keep it
We keep your account and profile data for as long as your account is active, so you can use the service. If you delete an achievement or photo, we remove it from your profile.
If you ask us to delete your account, we will erase personal data we no longer need for the service, unless we must keep it for a legal obligation, to handle a dispute, or for the limited period Indian law requires for certain logs and records.
Hosting and security logs are kept only as long as needed for security, debugging, and legal compliance, then deleted or anonymised.
10. Your rights
Under the DPDP Act, you may:
- Access a summary of the personal data we hold about you, the processing activities, and the identities of others with whom we have shared it (including processors), along with a description of such data.
- Correct inaccurate or misleading personal data, and complete incomplete personal data.
- Erase personal data that is no longer necessary for the purpose for which it was processed, unless retention is required by law.
- Withdraw consent for processing that is based on consent, without affecting processing already done before withdrawal.
- Nominate another person to exercise your rights in the event of your death or incapacity.
- Seek grievance redressal from us, and then approach the Data Protection Board of India if needed.
You can correct most profile details, change visibility, hide or delete achievements and photos, and export a PDF of selected achievements yourself in the app, under Profile Settings.
To request a copy of your data, account deletion, nomination, or any other right, email privacy@athlium.app from the email address on your account. We may ask you to confirm your identity (for example, by signing in or verifying that email) before we act.
11. Consent and withdrawal
When you create an account, you confirm you are 18 or older and consent to Athlium storing your account and achievement data and showing it on your profile according to the visibility you choose.
You can withdraw consent as easily as you gave it:
- Set your profile to Private in settings so others cannot view it.
- Hide or delete achievements and photos in the app.
- Email privacy@athlium.app to withdraw consent and request account deletion.
If you withdraw consent or delete your account, we will stop processing your personal data for the service, except where we must keep limited records under law. Some features will no longer work without that data.
12. Children
Athlium is only for people aged 18 or older. We do not offer the service to children as defined under the DPDP Act (under 18 years), and we do not knowingly collect their personal data. At sign-up we require a birth year that shows you are at least 18, plus an explicit confirmation that you are 18 or older. We will refuse or close any account that appears to belong to someone under 18.
If you believe a person under 18 has created an account, contact us at privacy@athlium.app. We will delete that account.
13. Security
We use reasonable security safeguards appropriate to the nature of the data, including encrypted connections (HTTPS), access controls, and row-level restrictions in our database so you can normally only change your own account and content. Passwords are handled by our authentication provider and are not stored by us in readable form.
No internet service is completely secure. If we become aware of a personal data breach that must be reported under applicable law, we will notify you and the Data Protection Board of India as required.
14. Grievance redressal
If you have a concern about how we process your personal data, write to our Grievance Officer:
Please include your registered email, a description of the issue, and what you want us to do. We will acknowledge and respond within a reasonable period, and in any case within 90 days.
If you are not satisfied after that, you may complain to the Data Protection Board of India under the DPDP Act. Information about the Board is published by the Ministry of Electronics and Information Technology at meity.gov.in.
15. Changes to this policy
We may update this policy when the service or the law changes. We will post the updated version on this page and change the “Last updated” date. If a change is material, we will also try to notify you by email or a notice in the app. Continued use after an update, where consent is still required, means you should review the new notice. For new purposes that need fresh consent, we will ask you again.
16. Contact
For privacy questions, rights requests, consent withdrawal, or grievances: