Legal
Privacy Policy
Effective date: July 27, 2026
This Privacy Policy explains how ProjectX42 ("we", "us") collects, uses and protects your information when you use projectx42.online and its subdomains, including our store, service pages and user accounts, and when you use the ProjectX42 Android application (together, the "Services").
1. Information we collect
Information you provide. When you contact us, create an account, subscribe to our newsletter, leave a review, apply for a role, or place an order, we collect the information you submit: name, email address, phone number, shipping address, and the content of your message or review.
Payment information. Payments are processed by Razorpay. Card numbers, UPI credentials and banking details are handled entirely by Razorpay and never touch our servers. We store only the transaction identifiers (order ID, payment ID), the amount, and the item purchased, as required to fulfil your order and maintain financial records.
Google sign-in. If you sign in with Google, we receive your name, email address and profile identifiers from Google. We do not receive or store your Google password. Google's own privacy policy governs their handling of your data.
Technical information. Like most websites, our servers keep standard access logs (IP address, browser type, pages requested, timestamps) used for security monitoring and debugging.
2. The ProjectX42 Android app
The ProjectX42 Android app (including its Wear OS, Android Auto and Android Automotive versions) is a client for your own self-hosted ProjectX42 home server. Data collected by the app is transmitted only to the server that you choose and control — your own home server. ProjectX42 does not operate that server, cannot access it, and does not receive the data described below unless explicitly stated. We do not sell this data, do not use it for advertising, and do not share it with third parties.
Server account. To use the app you sign in to your own server with a username and password (or token). Credentials are stored encrypted on your device and are exchanged only between your device and your server.
Location data (including background location). If — and only if — you enable the location sensor, the app collects your device's precise or approximate location, including while the app is in the background, and sends it to your own server so your home can react to your presence (for example, turning on lights when you arrive). Location collection is disabled by default, is clearly disclosed in the app before it starts, requires your explicit consent through the Android permission system, and can be turned off at any time in the app's sensor settings. Location data is never sent to ProjectX42 or to any third party.
Health and fitness data (Health Connect). With your explicit consent through Android's Health Connect permission screens, the app can read health and fitness data you choose to share — such as heart rate, steps, sleep, calories, blood glucose, blood pressure, body measurements and related metrics — and make it available to your own server for your personal dashboards and automations. Health Connect data is used only to provide this functionality at your request. It is never used for advertising, never sold, never used to determine credit, insurance or employment eligibility, and never transmitted to ProjectX42 or any third party. You can revoke Health Connect access at any time in Android settings, and revoking it stops all further reads immediately.
Microphone and voice. If you use the voice assistant feature, audio is recorded only while you actively invoke the assistant, is sent to your own server for processing, and is not retained by the app. The app never records audio in the background without an active assistant session.
Device sensors and app activity. The app offers optional sensors (battery level, charging state, connectivity, Bluetooth devices, physical activity, currently used or installed apps, and similar device state) that you can individually enable to power automations on your own server. Every sensor is off by default and can be disabled at any time. Sensor data goes only to your own server.
Notifications and device identifiers. If you use the Play Store version of the app, push notifications are delivered through Google's Firebase Cloud Messaging, which requires a push token (a device identifier) to route messages to your device. Notification content originates from your own server. Google's handling of the push token is governed by Google's privacy policy.
Crash diagnostics. The app may collect anonymized crash reports and performance diagnostics to help us fix bugs and improve stability. Crash reports do not include your location, health data, credentials or server contents.
Data retention and deletion for the app. Because your data lives on your own server, you control it completely: you can view, export or delete it there at any time, and uninstalling the app removes all data stored on your device. For anything else, or for help, write to projectx42labs@gmail.com and we will respond within 30 days.
3. How we use your information
- To provide the Services: process orders, deliver digital products, arrange shipping, issue invoices, and respond to enquiries.
- To operate your account: authentication, order history, wishlist and downloads.
- To send transactional emails: order confirmations, invoices, shipping updates and support replies.
- To send the newsletter — only if you subscribed, and every email includes a way to unsubscribe.
- To keep the Services secure: fraud prevention, abuse detection and audit logging.
- To comply with legal obligations, including tax and accounting requirements.
We do not sell, rent or trade your personal information. We do not use your data for third-party advertising.
4. Cookies and sessions
We use strictly necessary cookies: a session cookie (for login, cart and wishlist state), a CSRF token (security), and a theme preference stored in your browser. We do not use third-party tracking or advertising cookies.
5. Sharing your information
We share data only with the service providers required to operate: Razorpay (payment processing), our email provider (transactional mail), our hosting provider (infrastructure), and shipping carriers (name, phone and delivery address for physical orders). Each receives only what it needs. We may disclose information if required by law or to protect our rights, users or the public. Data collected by the ProjectX42 Android app is not shared with any of these providers — it goes only to your own server, as described in section 2.
6. Data retention
Order and invoice records are retained as required by Indian tax and accounting law (typically 8 years). Contact messages and job applications are retained for up to 2 years. Account data is retained until you delete your account. Newsletter addresses are removed promptly on unsubscribe. App data retention is described in section 2.
7. Your rights
You may request access to, correction of, or deletion of your personal data at any time by writing to projectx42labs@gmail.com. We will respond within 30 days. Note that we must retain records connected to completed payments for the statutory period even after account deletion.
8. Security
All traffic is encrypted in transit (TLS). Passwords are stored using industry-standard one-way hashing. Payment signatures are verified server-side on every transaction. Access to production systems is restricted and logged. The Android app encrypts stored credentials on the device and communicates with your server over encrypted connections.
9. Children
The Services are not directed at children under 13, and we do not knowingly collect their data. The ProjectX42 Android app is intended for users aged 18 and over. If you believe a child has provided us personal information, contact us and we will delete it.
10. Changes to this policy
We may update this policy as the Services evolve. Material changes will be announced on this page with a new effective date. Continued use of the Services after a change constitutes acceptance.
11. Contact
ProjectX42 — Privacy
Email: projectx42labs@gmail.com