Last updated 24 October 2026
Privacy Policy
The short version: OnTrack stores your deadlines, timetable and attendance so it can remind you before things are due. We never sell your data, never show ads, never train AI on it, and you can download or delete everything at any time.
Who we are
OnTrack (ontrack.golash.in) is part of golash and is run by Krishna Gahlod, an individual based in Mumbai, Maharashtra, India (“we”). Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the data fiduciary for the personal data described here.
What we collect, and why
| Data | Why |
|---|---|
| Name, email and (if you use Google sign-in) your Google account ID and profile picture | To create your account and sign you in. We never see your Google password. |
| Deadlines, courses, timetable and notes you add | To show your schedule and remind you. |
| Your attendance marks | To work out your attendance percentage and how many classes you can miss. |
| Classes you join, and your role in them | To share a class's timetable and deadlines with you. Your class rep sees your name in the member list; classmates don't. Your attendance and ticks are never shared. |
| Notification details: this device's push address, your Telegram chat ID if you connect Telegram, your morning-email choice | To deliver reminders where you asked for them. |
| Your consent records | To show we have your consent, as the DPDP Act requires. |
| Technical data (IP address, browser, request logs, rate-limit counters) | To keep the service secure and prevent abuse. |
OnTrack uses one essential cookie to keep you signed in. We don't use advertising or analytics trackers.
Paste to add deadlines (AI)
When you use Paste, the text or PDF you provide, plus the names of your courses, is sent to an AI provider to find the dates in it. OnTrack doesn't store the pasted text; only the deadlines you confirm are saved. Don't paste other people's personal details. We don't train AI models on your data. The AI providers handle requests under their own terms: some keep them for a limited time to monitor abuse, and on free API tiers some providers (including Google) may use submitted content to improve their services.
Who processes your data
| Provider | What for | Where |
|---|---|---|
| Vercel | Hosting the app | Singapore / global |
| Neon | Database where your account and data are stored | Singapore |
| Sign-in with Google; AI for Paste (Gemini) | Global | |
| Groq | AI for Paste | United States |
| Resend | Sign-in links and the morning email | United States |
| Your browser's push service (Google, Apple or Mozilla) | Delivering phone notifications (title and due time only) | Global |
| Telegram | Reminders, only if you connect it | Global |
| Cloudflare | Domain, email routing and the golash bar script | Global |
How long we keep it
- Your account and data: while your account exists. Delete any deadline or course, or your whole account, at any time and it's erased.
- Deadlines and courses you shared with a class as rep belong to the class, and stay for your classmates if you leave or delete your account.
- If your account is inactive for 24 months, we'll email you and delete it 30 days later unless you sign in.
- Sign-in links expire after 15 minutes. Rate-limit counters reset within a day.
- Messages you send us: up to 12 months after the conversation ends.
Your rights under the DPDP Act
- Access and a copy: download all your data from Me → Privacy.
- Correction: edit anything directly in the app, or write to us.
- Erasure and withdrawing consent: delete your account from Me → Privacy. We then stop processing and erase your data unless the law requires us to keep it.
- Nomination: nominate someone to exercise these rights for you if you die or become unable to, by writing to us.
- Grievances: write to our Grievance Officer (below). If you're not satisfied with our response, you can complain to the Data Protection Board of India.
Age
OnTrack accounts are for people aged 18 or older; we ask you to confirm this when you sign up. We don't knowingly process children's data, and if we learn an account belongs to someone under 18, we delete it.
Security and breaches
Data is encrypted in transit, each student's data is only accessible to their own account (and shared class items only to that class), and sign-in links are single-use. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires, and report it to CERT-In where required.
Grievance Officer
Krishna Gahlod, Grievance Officer, golash
Email: grievance@golash.in
Mumbai, Maharashtra, India
We acknowledge grievances within 48 hours and resolve them within 30 days.
Changes
If we change this policy in a way that matters, we'll update the date above and ask for your consent again the next time you sign in.