PRIVACY NOTICE
Cognitive Materials Private Limited (the company, we, us, our). Corporate identity number U62013KA2024PTC190282. Registered office: 1007, Siddhartha Layout, Kadugodi, Bangalore South, Bangalore 560067, Karnataka, India. Grievance Officer: Meghavarsha Rajeshwari, grievance@fyzygy.com, email only. General contact: support@fyzygy.com. This is an adults-only service for users aged eighteen and over. Fyzygy is a trademark of Cognitive Materials Private Limited.
Last updated: 8 October 2026.
WHO WE ARE
Cognitive Materials Private Limited is the data fiduciary for the personal data described in this notice. Our registered office and contact details appear above.
WHO MAY USE OUR PRODUCTS
Our products are for adults aged eighteen and over. A date of birth is collected at signup to confirm the user is old enough, and anyone under eighteen cannot create an account. The date of birth is stored on the account and is never shown to anyone. We do not knowingly collect personal data from anyone under eighteen, and we do not offer a parental-consent route, because we do not offer the service to children.
WHAT THIS SURFACE DOES
Fyzygy Take is a product on which a person makes posts and polls and follows other people and pages. A post can be a photo or a video, with or without text. A post or poll can be public or Followers only. Public posts and polls have their own pages on the Fyzygy Take website that can be viewed without an account. A Followers-only post is seen by the author and the author's followers. A private profile makes following the user a request the user approves, and keeps the account off the public web.
WHAT WE COLLECT HERE
At Fyzygy Take we process: account identity data, namely the email address or phone number and the password; the date of birth; the display name the user sets for Fyzygy Take; the user's profile picture, bio and location, which is free text; the posts a user creates, which may be a photo or a video with or without text, and whether each is public or Followers only; the polls a user creates and the votes cast on them; comments, likes and saves; follows, follow requests and blocks; reposts and quote-shares; tags of people and pages; the user's notifications; reports the user makes; the pages a user creates, with their pictures; the posts the user viewed; advertising interaction events, namely impressions and clicks, tagged by product and device type and held as aggregate counters; product usage beacons, namely landing, signup started, signup completed and activation; aggregate usage counts for running and improving the service, namely installs and first opens, sign-ups, active users and returns after one, seven and thirty days; and the days the user was active, kept as a last-active date for this product. Search text a user types is not stored. We use no outside trackers, and any use of a person's activity beyond running the service stays under the cross-app analytics consent, which is off by default.
HOW WE USE THIS DATA
We use it to create, secure and operate the account; to verify sign-in; to show the user's posts, polls, profile and pages and, for public ones, to show them to others and on the Fyzygy Take website; to run the follow graph and the people the user follows; to order the user's feed, which shows posts from the people and pages the user follows first, with the newest on top, and then other public posts, not by a profile of the user beyond who they follow; to run polls and count the votes cast on them; to generate a preview image when a public post is shared; to check uploaded media for child sexual abuse material before it is published, as the child safety standards describe; to show advertising and, only where the user has switched on personalised advertising, to make that advertising more relevant; and to understand product usage in aggregate. We rely on the user's consent and on the other lawful bases available under the Digital Personal Data Protection Act.
THE MEASUREMENT IDENTIFIER
A random value is created when a page loads, and is used to count how many visits lead to an account being created. This happens even for a person who has never signed in. It is not a cookie. It is different on each product and cannot be used to connect a person's activity between products. It identifies a browsing session, not a person, and is never sold or shared with advertisers. On the web, the value lasts for the browsing session; it is shared by tabs opened from one another, and a browser may restore it when a tab is reopened or a session is recovered; it is not stored permanently and is not kept when the browser starts fresh. In the app, the value lasts as long as the app is running, which can be longer if the app is left open in the background.
YOUR HANDLE AND DISPLAY NAME
A person has one Fyzygy account and one public handle across the products, managed in the account centre. On Fyzygy Take the user sets a display name, and the display name and handle appear with the user's public posts and polls. The switch "Let people find me by handle", in the account centre, controls whether other people can find the user by their handle in Fyzygy Take's people search.
CONSENTS
At signup a user gives two required agreements, separately: agreement to this Privacy Notice, and agreement to the Terms. These are stored while the account exists. Two further forms of processing are optional and off unless the user chooses them, and they are separate consents with separate purposes. Cross-app analytics is used to understand how the same person uses more than one Fyzygy product, so that we can improve those products; it is not used for advertising and not for ad targeting, and when it is switched on the person's account identifier is attached to those measurement events. Personalised advertising is a separate option that uses a user's activity within our own products to make advertising more relevant. Each is off unless chosen, and each can be switched off again at any time in the account centre. Switching either off does not remove access to the product.
CHILD-SAFETY CHECKING OF UPLOADS
Media a user uploads is checked against a child-protection provider before it is published; a video is checked whole, in the same way as an image. Nothing is published until the check completes, and nothing is published if the check cannot be completed. Where the check identifies child sexual abuse material, the media is preserved as evidence for legal process and reported to the authorities, as the child safety standards describe. An alert to an operator about a flagged item goes to an internal operations inbox and carries no personal data.
PUBLIC POSTS, POLLS AND THE WEBSITE
A post or poll a user marks public has its own page on the Fyzygy Take website, which anyone can view without an account. The page shows the post or poll, the author's display name and handle, and the text. A Followers-only post is seen by the author and the author's followers; it has no public page, and its media is held in private storage reached only through short-lived signed links. A poll closes twenty-four hours after it is made. Anyone may vote on a public poll without signing in; to count each such vote once without identifying the voter, we store a salted hash of a token held in a cookie on the voter's device, or, where there is no cookie, a salted hash of the voter's IP address, and that hash is different for each poll and is removed thirty days after the poll closes. Poll results are shown to a signed-in user.
PUBLIC CONTENT AND SEARCH ENGINES
Public posts and public polls are indexed by search engines, such as Google, and a public profile or an approved page may appear by its name. They can also appear in link previews on other services. A Followers-only post, a private profile, a page under review, and the content of a suspended or deleted account are closed to search engines and are not indexed. Making a post private, or deleting it, removes it from Fyzygy Take at once; search engines then drop it on their own schedule, which the company does not control.
SHARING A PUBLIC POST
When a public post is shared, the link to its public page is sent. Our server generates a preview image for that link from the public post, which may include a photo or a frame of the video, the author's display name and handle, and the text. For a public video post, a preview frame is stored with the post. A Followers-only post cannot be shared and has no preview image. A link to a public post opens the Fyzygy Take app when it is installed, and opens the web page otherwise.
CONTACTS
Fyzygy Take does not read the contacts on the device, and there is no contact import.
CARDS
Cards use images that the company provides, or a photo the user chooses from their own device. A draft a user makes with Cards is stored on the user's own device, in the app or, on the web, in the browser, and is not uploaded to the company until the user posts it.
NOTIFICATIONS
Fyzygy Take has its own notifications switch, named Notifications. The company may send a service message, such as an "update available" notice; it appears inside the app and may also be sent as a push, and it respects the switch. To deliver notifications, Fyzygy Take stores a push registration for the device, which is kept until the account is deleted.
WHO PROCESSES DATA FOR US
We use Amazon Web Services, in the Asia Pacific Mumbai region, for the database and compute; MSG91, for email and SMS; Cloudflare, for stored media; Google Firebase, for push notifications; Vercel, for the websites; and a child-protection provider, which checks uploaded media before it is published. Each processor is engaged under a contract that requires it to protect personal data.
SHARING
We do not sell personal data. We do not share personal data with advertisers. Advertisers receive only anonymised and aggregated performance information, from which no individual can be identified. We share personal data only with the processors above, where the law requires it, and with the authorities in a child-safety matter as described above.
RETENTION
We keep personal data only as long as needed for the purpose, or as the law requires.
| Category | Retention | Reasoning |
|---|---|---|
| Account identity, that is email or phone and password hash | While the account is active. On deletion, removed on the deletion timeline below. | Needed to provide and secure the account. |
| Date of birth | While the account is active. Removed on deletion. Never shown to anyone. | Needed to confirm the user is old enough. |
| Codes sent at sign-in | Expire ten minutes after they are sent; their records are removed within an hour. | Needed only to verify. |
| Profile picture, bio and location | While the account is active. On deletion, removed. A replaced profile picture deletes the old file. | The user's own profile. |
| Posts, polls, comments, likes, saves, follows, blocks, reposts, quote-shares, tags, pages and their pictures | While the account is active. On deletion, removed on the deletion timeline. Deleting a post deletes its files. | The user's own content and activity. |
| Posts the user viewed | While the account is active, to order the feed and avoid repeats. Erased with the account. | Ordering the feed. |
| Consent records | Kept after deletion in a minimised, pseudonymised form, for the limitation period for related claims. Twenty-four months. | Establishment, exercise or defence of legal claims, and legal obligation. |
| Advertising and usage events | Ad events carry no user identifier. Individual identifiable ad events are not kept; the anonymised aggregate counters are retained while the product is operated. | Advertising performance and product analytics. |
| Reported content | Kept with its report for one hundred and eighty days, then erased, unless the report is dismissed sooner. | Handling reports and any legal process. |
| Anonymous poll vote hash | A salted hash, different per poll, removed thirty days after the poll closes. Identifies no person. | Counting votes once without identifying voters. |
| Last-active date for this product | While the account is active. Erased with the account. | Measuring returns and whether the product is used. |
| Push registration | Kept until the account is deleted. | Delivering notifications the user has turned on. |
| Child-safety records, including preserved media | Kept even after account deletion, as the law requires. | Legal obligation to preserve and report. |
| Server and access logs | One year minimum. | Prescribed as a minimum by the Digital Personal Data Protection Rules 2025. |
| Backups | Age out on the backup rotation after deletion. | Backups cannot be edited item by item. They age out. |
CROSS-BORDER
Some processing takes place outside India, because our websites are served by a global provider and stored media is held with a global provider. Personal data is held on servers in the Asia Pacific Mumbai region.
YOUR RIGHTS
A user may access their personal data, correct or complete it, erase it, nominate another person to exercise rights in the event of death or incapacity, and withdraw either optional consent. Rights are exercised in the account centre. To raise a concern, a user may contact the Grievance Officer, and may escalate to the Data Protection Board of India.
DELETION
When a user asks to delete their account, we deactivate it at once, which ends access to every product and revokes active sessions, and we erase the personal data thirty days after the request, by an automatic check. During those thirty days the user can restore the account by signing in to the account centre and pressing Activate account; signing in alone does not restore it. Deletion is carried out in the account centre, which the Fyzygy Take Delete Account control opens. What is erased includes the account identity, the date of birth, the user's posts, polls, comments, uploaded media, profile picture, bio, location, pages and their pictures, active sessions, the push registration, and the account's analytics events, and the account's identifier is removed from aggregate rows; the public handle is retired. Deleting a post deletes its files.
Erasing an account also removes the person's traces from other people's data: others' reposts of the person's posts are removed; a quote-share keeps the quoter's own words and shows "This post is no longer available."; tags of the person are removed; and notifications that named the person are removed. Where someone else typed the person's handle into their own text, it stays as written; the handle itself is retired and leads nowhere. Pushes already delivered to phones cannot be recalled.
We keep some records after an account is erased, where the law requires: user reports; reported content, for one hundred and eighty days; uploads held by the child-safety check, and any preservation hold; consent records, pseudonymised, for twenty-four months; server and access logs, for the prescribed minimum period; and the retired handle, as a bare string with no link to the person. Erasing an account does not edit the server logs. An account under a child-safety preservation hold is not erased until the hold ends.
SECURITY
We protect personal data with access controls, encryption in transit and at rest where appropriate, and logging. No method is perfectly secure, but we take reasonable measures suited to the sensitivity of the data.
BREACH
If a personal data breach occurs, we follow our internal breach procedure, which includes notifying the Data Protection Board of India within seventy two hours as the Rules require, and notifying affected users where required.
CHANGES
We will update this notice as the product and the law change, and will make material changes visible before they take effect.
CONTACT
Grievance Officer: Meghavarsha Rajeshwari, grievance@fyzygy.com, email only. General contact: support@fyzygy.com. Registered office as above.