Privacy notice
Last updated 2026-09-11. Written under India's Digital Personal Data Protection Act, 2023 (DPDP Act).
The short version
Your quiz answers — height, weight, age, goal, food and training details — stay in your own browser and are never sent to us unless and until you complete a purchase. At checkout we additionally collect your name, email and phone number to process payment and deliver your plan. We don't use cookies, we don't run third-party analytics or advertising pixels, and we don't sell personal data to anyone.
What we collect, and why
Quiz answers (health data)
Height, weight, age, sex, activity level, goal, diet type, allergies, cuisine region, meals per day, who cooks, training equipment, days and session length, injuries, and the three safety-screen questions (pregnancy/breastfeeding, diagnosed medical conditions, prescription medication). Collected to calculate your BMI and calorie/macro targets and to generate a personalised diet and training plan.
These answers are written only to your own browser's local storage as you complete the quiz. They are not sent to our servers at all until you choose to pay for a plan — closing the tab or clearing your browser data before then means nothing about you has reached us.
Contact details
Your name, email address and phone number — collected at checkout only, right before payment, and nowhere earlier in the quiz. Used to process your payment (Razorpay requires all three), to identify your order, and to reach you about it.
Consent record
Before the quiz begins, you must explicitly tick a box reading “I agree to let SureNutrition store my answers on this device so it can build my plan” — separate from an optional, unticked-by-default box to receive nutrition tips by email. Nothing is written to your device before that first box is ticked. If you go on to purchase, the timestamp of that consent is stored alongside your order so we can demonstrate, if ever asked, that you agreed before anything was collected.
Note on the email-tips box: at present, ticking it does not cause any email to be sent — this build does not yet have a marketing-email feature. We'd rather say that plainly than describe a feature that doesn't exist yet.
Marketing attribution
If you arrived via a tracked ad link, we may store the associated identifiers (Google's gclid, or UTM parameters) alongside your order, only to understand which channel led to a sale. These are never used to build an advertising profile of you elsewhere.
Anonymous funnel telemetry
A random identifier generated in your browser (not derived from anything about you), which quiz step you reached, and — if a safety check stopped or restricted you — which outcome that was. Never your age, weight, answers, or any free text you typed. This identifier lives in sessionStorage, not a cookie, and disappears when you close the tab; it exists only so we can see where people drop off in the quiz and improve it.
Payment details
Handled entirely by Razorpay. We receive and store Razorpay's own order and payment identifiers and the amount charged — never your card number, UPI PIN, or bank details, which go directly to Razorpay and never pass through our servers.
How your data is protected
Once you purchase, your quiz answers and the plan generated from them are encrypted (AES-256-GCM) before being written to our database, and are only ever decrypted by server-side code — never in a browser, never in a log. Every table that holds order or health data has row-level security enabled with no public access policy, so it is reachable only through our own server routes, never directly from the internet.
Who we share it with
- Razorpay — your name, email, phone and the amount, to process payment. Governed by Razorpay's own privacy policy.
- Supabase — our database provider, which stores your encrypted order and plan records on our behalf, under the access restrictions described above.
- WhatsApp — only if you choose to message us. We deliberately keep health details out of that message; only your name, goal and order reference ever appear in a WhatsApp link we generate.
Nobody else. We run no third-party analytics, advertising pixels, or tracking scripts of any kind, and we do not sell personal data.
No third-party requests
This site's typefaces are downloaded and self-hosted at build time (via Next.js's font optimisation), so viewing our pages never makes a request to Google's font servers or anywhere else. The same applies to everything else a page loads: the small animations on our home page, and their rendering engine, are served from this site, and the photographs are fetched and resized by our own server rather than by your browser. Loading any page here contacts us, and nobody else.
How long we keep it
- Quiz answers never reach us at all unless you complete a purchase — see above.
- Order records (name, email, phone, amount, status) and the encrypted plan/answers tied to them are kept for as long as reasonably needed to support your order and honour our refund policy, and to meet standard Indian tax and accounting recordkeeping requirements — in practice, up to 8 years from your order date. You can ask us to erase them sooner (see below); we will only decline where we are legally required to retain a specific record for longer.
- Anonymous funnel telemetry carries no name, email, or answer content, so there is nothing in it an erasure request could remove that identifies you in the first place.
Your rights
Under the DPDP Act, you can ask us to (1) give you a copy of the personal data we hold about you, (2) correct it, or (3) delete it. Deleting your order also deletes the plan and answers linked to it — they are stored so that erasing one removes the other automatically.
The fastest way to exercise any of these is our data request form, which records your request immediately rather than relying on someone reading an inbox. You can also reach us on WhatsApp — see Contact.
If you're under 18
SureNutrition is built for adults 18 and older. If our safety check identifies an under-18 age, the quiz stops immediately, no plan is offered, and anything already stored on your device for that session is deleted right away.