Privacy Policy

Cloka runs community fitness sessions, events, merchandise drops, and retreats. For the purposes of the DPDP Act, Cloka is the Data Fiduciary responsible for the personal data described here. You can reach us at privacy@cloka.in.

We collect the following categories of personal data, most of which you provide directly when you sign up, complete your profile, register for events, post to Arcs, or pay:

• Account & identity: your name, email address, and profile photo. If you sign in with Google, we receive your basic Google profile (name, email, picture).

• Member profile: phone number, social (Instagram) handle, gender, and optionally your date of birth and an emergency contact number — collected to run sessions safely and to manage gendered events.

• Event participation: your registrations, approval and check-in status, and event QR access.

• Payments: for paid events, the email, phone number, amount, and payment method recorded by our payment processor (Razorpay). We do not collect or store your full card or bank details — those are handled by Razorpay.

• Arcs content: photos and captions you post (shared to the community feed, or kept private so only you can see them), and the comments and likes you add.

• Waitlist: the email address you submit to join a merchandise drop waitlist (available without an account).

• Technical & usage: your IP address (stored only as a one-way salted hash in our analytics), device and browser (user-agent), pages visited, and session security details. See Cookies & analytics.

• Create and manage your account and member profile.

• Process event registrations, approvals, check-ins, payments, and waitlists.

• Operate community features (Arcs posts, comments, likes) and keep them safe through content moderation.

• Communicate with you about approvals, slot openings, payments, and service updates.

• Keep the service secure — preventing fraud, abuse, and unauthorised access.

• Understand and improve how the site is used, through privacy-respecting analytics (only with your consent).

Under the DPDP Act we process your personal data based on your consent (which you give when you create an account, submit information, or accept analytics cookies) and for certain legitimate uses necessary to provide a service you have asked for. You can withdraw consent at any time (see Your rights); doing so won’t affect processing already carried out, and some features may stop working if the data is essential to them.

To keep Arcs feeds safe, images you upload are automatically screened for unsafe content using a third-party content-moderation service. Images that fail screening are rejected and not stored. This screening processes the image you upload only for that purpose.

We do not sell your personal data. We share it only with trusted service providers (Data Processors) who help us operate Cloka, under contracts that limit how they may use it. These fall into the following categories:

• Payment processing — to take payment for paid events, through our payment provider (Razorpay). We do not receive or store your full card or bank details.

• Sign-in & analytics — to let you sign in and, with your consent, to measure how the site is used. This includes Google (Google Sign-In and Google Analytics).

• Cloud infrastructure — hosting, database, and media-storage providers that run the application and store your data securely.

• Content moderation — an automated service that screens uploaded images for unsafe content.

Some of these providers operate outside India. Where personal data is transferred abroad, we do so in accordance with the DPDP Act and take appropriate steps to protect it. We may also disclose data where required by law or to protect the rights and safety of our members and the public.

We keep personal data for as long as your account is active and as needed to provide the service, then for as long as required to meet legal, accounting, or security obligations (for example, payment records). When data is no longer needed we delete or anonymise it. You can ask us to delete your account and associated data — see below.

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you.

• Correct or update inaccurate or incomplete data.

• Request erasure of your personal data.

• Withdraw consent you previously gave.

• Nominate another person to exercise your rights in case of death or incapacity.

• Raise a grievance about how we handle your data.

To exercise any of these, email us at privacy@cloka.in. We will respond within the timelines required by law. If you are not satisfied, you may escalate to the Data Protection Board of India.

Cloka is intended for adults (18 and over). We do not knowingly collect personal data from children without verifiable parental consent. If you believe a child has provided us data, contact us and we will remove it.

We use reasonable technical and organisational safeguards — encrypted connections, access controls, hashed credentials, and hashed IP addresses in analytics — to protect your data. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the authorities of breaches where the law requires.

Cookies are small files stored on your device. We group them as strictly necessary (needed for the site to work — sign-in, security, and remembering your cookie choice) and analytics (optional, to measure usage). Strictly necessary cookies are always active. Analytics cookies — including Google Analytics and our first-party cloka_aid id — are set only after you accept them in the cookie banner, and never before.

You can change your mind at any time by clearing the cloka_consent cookie in your browser settings, which brings the banner back so you can choose again. You can also block or delete cookies through your browser; strictly necessary cookies cannot be switched off without breaking core features.

We may update this policy from time to time. When we do, we’ll revise the “Last updated” date above and, for material changes, take reasonable steps to let you know.

Questions, requests, or grievances about your data? Email privacy@cloka.in. Cloka is based in India.