Effective date: 24 October 2026
Last updated: 24 October 2026
Your test answers, your scores, your Eye Age number, and your eye photo never leave your device. They are calculated inside your phone's browser and are deleted when you close the tab. EyeAge never receives them, never stores them, and cannot see them.
Here is the little that does leave your device:
| What | Who gets it | Why |
|---|---|---|
| Anonymous usage events (which screens you reached, whether payment succeeded) with no name or account attached | PostHog (analytics, United States) | To understand whether the product works and where people get stuck |
| Your approximate country (derived from your IP address by the analytics provider) | PostHog | Basic audience understanding |
| A record of each purchase (order reference, amount, payment type such as UPI, payment status) — no name or contact details — and, for the family pack, a random share code with a "scans used" counter | Supabase (database, Singapore) | To confirm payments, issue family-pack codes, and handle refunds |
| Your card / UPI / payment details | Cashfree (payment gateway) — not EyeAge | To take the payment. EyeAge only learns "paid" or "not paid" |
| Standard web-server logs (IP, time, page requested) | Vercel (hosting) | Every website has these; kept briefly |
| A request for web fonts | Google Fonts | To display the site's typefaces |
EyeAge has no login and no user account. We do not run ads, we do not use data brokers, and we never sell or share your personal data for money.
EyeAge is a screening and awareness tool — not an eye exam and not a medical diagnosis. If you have any concern about your eyes or vision, see a qualified eye-care professional.
The "Data Fiduciary" (the entity that decides how and why your personal data is processed) under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") is:
Umair Ahmed, sole proprietor, trading as EyeAge 2, Ravinagar, Indore, Madhya Pradesh 452018, India Not applicable — sole proprietorship (no company/LLP registration number)
Contact for all privacy matters, including data-principal rights requests and grievances:
support@eyeage.co
Grievance Officer / Data Protection contact (required under the DPDP Act and the Information Technology Act, 2000):
Umair Ahmed Email:
support@eyeage.co2, Ravinagar, Indore, Madhya Pradesh 452018, India
If EyeAge is later required to appoint a Data Protection Officer under Section 10 of the DPDP Act (as a Significant Data Fiduciary), that person's details will be published here.
This is the most important part of this policy, and it is the whole point of how EyeAge is built.
The following data is processed entirely inside your device's web browser. It is never transmitted to EyeAge or to anyone else, and no server — ours or a third party's — ever receives it:
The age, height, and whether-you-wear-glasses/contacts information you enter is held only in your browser's temporary sessionStorage. It is used only to calculate your result. It is erased automatically when you close the browser tab.
All seven screening activities — visual acuity, near vision, focus, colour, contrast, the Amsler grid, and the tiredness questionnaire — are scored by JavaScript running in your browser. Your Eye Age number and your per-test report are calculated the same way. No test response, no score, and no Eye Age value is ever sent to any server. They exist only on your screen and in your browser's temporary memory for that session.
If you choose to take the optional eye photo for a shareable result card:
EyeAge stores a few technical values in your browser. These are not shared except as described in Section 4:
| Key | Where | What it is | Cleared when |
|---|---|---|---|
eyeage.ph_distinct_id |
localStorage |
A random, persistent pseudonymous ID for analytics. Not linked to any name, email, or account. | You clear site data |
eyeage.ph_session |
sessionStorage |
A random analytics session ID | You close the tab |
eyeage.session |
sessionStorage |
Your progress through the test, so a refresh or the payment redirect does not lose your readings | You close the tab (kept up to 24 hours for session recovery) |
eyeage_consent |
cookie | Whether you accepted or declined analytics, so we do not ask again on every visit. Set only once you have chosen. | 180 days, or you clear site data |
eyeage_order |
cookie | The reference of a payment you have just started, so that when the bank sends you back we can reconnect you to it. Strictly necessary to deliver a purchase; not used to track you. | 30 minutes |
Under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), information about a person's physical or mental health and medical condition and biometric information are treated as "Sensitive Personal Data or Information" (SPDI).
Your vision-test data is health/medical information. Your iris photo is biometric information. The key safeguard is that EyeAge does not collect, receive, transmit, or store any of it. It is processed only on your own device, under your own control. Because EyeAge never handles this data, the risks that privacy law is designed to address — unauthorised access on a server, data breaches, onward sharing, profiling — do not arise for it.
For each item below we state the purpose, the legal basis under the DPDP Act, and whether the third party acts as a Data Processor (acting on EyeAge's instructions) or an independent Data Fiduciary / Controller (deciding things for itself).
Under the DPDP Act, personal data may be processed either (a) with your consent, or (b) for certain "legitimate uses" defined in Section 7 of the Act — including where you have voluntarily provided data for a specified purpose and not objected, and to comply with law.
EyeAge asks before it measures anything, and what "asks" means depends on where you are:
In both cases you can change your mind at any time using the Cookies link in the site footer. Choosing to turn analytics off does not merely stop further sending: the stored PostHog identifier is deleted from your browser at the moment you choose.
Your choice is recorded in a single first-party cookie, eyeage_consent, so that we do not have to ask you again on every visit. That cookie is the only thing set before you have chosen anything, and it exists solely to remember that you were asked.
Where consent is the basis, you can withdraw it at any time (see Section 8).
us.i.posthog.com (United States region).distinct_id generated in your browser and stored in localStorage; a session ID; automatic pageview and page-leave events; and product events such as test started / test completed (with the test number), payment started / payment succeeded / payment failed, share clicked, family-pack clicked, and diagnostic events such as camera permission denied and device not recognised. Events about the tests carry only technical facts about the set-up — for example how far your phone was from your face, your camera's field of view, or that your screen was too dim — and never your answers, results, scores, Eye Age, age, height or glasses.distinct_id is persistent (it stays in your browser until you clear site data), so the analytics data is best described as pseudonymous rather than strictly anonymous — it is a random identifier that is not, and cannot by EyeAge be, linked to your real-world identity.localStorage only.uexhmbgplighvqmpzgbs.supabase.co, hosted in Singapore.fonts.googleapis.com and fonts.gstatic.com).If you email support@eyeage.co — for example, to make a refund claim (see the Terms of Service) or to raise a privacy request or grievance — we process the information in that correspondence: your email address, whatever you write, and any payment reference you provide.
This is the only situation in which EyeAge holds an item of directly identifying personal data (your email address), and only because you chose to contact us.
EyeAge uses no advertising or analytics cookies. It sets two small first-party cookies of its own, both listed in Section 3.4:
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
eyeage_consent |
EyeAge | Remembers whether you accepted or declined analytics | 180 days |
eyeage_order |
EyeAge | Reconnects you to a payment you have just started when the bank sends you back. Strictly necessary for the purchase | 30 minutes |
PostHog analytics uses browser storage (localStorage), not cookies.
The localStorage and sessionStorage keys listed in Section 3.4.
posthog.com stops analytics from being sent.localStorage analytics ID and both cookies. Using your browser's private / incognito mode also prevents anything from persisting after you close it.Because there is no account, clearing your browser storage fully resets your relationship with EyeAge.
| Third party | Country of processing | Role | Data involved |
|---|---|---|---|
| PostHog | United States | Processor | Anonymous analytics events, approximate country |
| Supabase | Singapore | Processor | Purchase records and family-pack codes — no name or contact details |
| Cashfree Payments | India | Independent Fiduciary/Controller | Payment details (entered on Cashfree, not shared with EyeAge) |
| Vercel | United States and its global edge network | Processor | Transient server logs (IP, time, URL, user-agent) |
| Google Fonts | United States and other countries | Independent controller | IP and user-agent from the font request |
International transfer position. The DPDP Act permits transfer of personal data outside India except to countries specifically restricted by the Central Government by notification. As at the effective date, no such restriction has been notified for any of the destinations above. The analytics provider (PostHog) processes data in the United States. For visitors in the EU, UK, or other regions with transfer-restriction regimes, the relevant safeguard is the processor's own transfer mechanism (for example, Standard Contractual Clauses or an approved data-transfer framework) in its data-processing terms.
| Data | Retention |
|---|---|
| What you type (age, height, glasses) | Browser sessionStorage only — erased when you close the tab |
| Test responses, scores, Eye Age | Never stored anywhere; exist only during your session |
| Eye / iris photo | Never stored by EyeAge. The result-card image is kept only on your own device, only if you saved it, and you control it |
| PostHog analytics events | Up to 1 year, then deleted by PostHog |
| Purchase records in Supabase | For as long as Indian tax and accounting law requires transaction records to be kept, then deleted |
| Family-pack code rows in Supabase | Family-pack codes do not expire, so the row (random code + counters, no personal data) is kept for as long as the code can be used |
| Vercel server access logs | About a day, then deleted by Vercel |
Nothing else is retained, because nothing else is collected.
Under the DPDP Act you have the following rights in respect of personal data that EyeAge processes:
How to exercise them: email support@eyeage.co with your request. We will acknowledge your request within 48 hours and respond within 30 days — and in any case within the period the Digital Personal Data Protection Rules, 2025 allow (currently no more than 90 days).
Important practical point: because EyeAge has no account and stores almost no personal data, in most cases the honest answer to an access request is: "We hold a random pseudonymous analytics identifier that we cannot connect to you, and — if you bought the family pack — a random code with a usage counter that also cannot be connected to you." We may ask you for information (such as the approximate date and time of your visit, or your family-pack code) so we can locate any record, and we will not use that information for any other purpose. If we genuinely cannot identify any data as relating to you, we will tell you so.
To withdraw consent to analytics: use the Cookies link in the site footer, as described in Section 5.3. You can also email support@eyeage.co and we will suppress analytics for you as far as technically possible. Withdrawing consent does not affect processing that already happened.
Complaints to the regulator. If you are not satisfied with our response, you may complain to the Data Protection Board of India through its online complaint system (current details are published by the Ministry of Electronics and Information Technology at https://www.meity.gov.in). You may also have remedies under the Information Technology Act, 2000 and the Consumer Protection Act, 2019.
EyeAge is not directed at anyone under 18, and you must be at least 18 to use it. This matches the minimum age in the Terms of Service.
The DPDP Act treats everyone under 18 as a "child", and would otherwise require verifiable parental or guardian consent and prohibit any tracking of that child. EyeAge sets an 18+ minimum precisely to avoid processing children's data at all — every user is an adult, and the child-consent and no-tracking obligations do not arise.
No behavioural monitoring or targeted advertising, of anyone. Independently of the age rule, EyeAge does not do behavioural advertising, targeted advertising, or profiling of any user (see Section 4.7).
EyeAge does not knowingly process the personal data of anyone under 18. If you believe someone under 18 has used EyeAge in a way that sent us data, contact support@eyeage.co and we will delete anything we can identify.
COPPA (United States). EyeAge is not directed to children and does not knowingly collect the data of anyone under 18. The 18+ minimum applies to US visitors as it does everywhere else.
No method of transmission or storage is perfectly secure. If EyeAge becomes aware of a personal-data breach that is required to be reported, it will:
If you have a complaint about how EyeAge handles your personal data:
support@eyeage.co, marked "Privacy grievance", with enough detail for us to understand the issue.EyeAge may update this policy as the product changes or as the law develops (in particular as the DPDP Rules, 2025 come fully into force). When we make a material change we will update the "Last updated" date at the top and, where practical, show a notice on the site. Because there is no account, we cannot email you about changes — please check this page.
EyeAge is operated from India and governed by Indian law (see Section 14). However, because EyeAge is offered to consumers in the United States, the United Kingdom, and the European Union, some non-Indian laws may also apply. The on-device-first design means that for these users almost no personal data is actually processed — essentially only pseudonymous analytics events and an approximate country.
Where the EU or UK GDPR applies to a visitor:
support@eyeage.co.support@eyeage.co.support@eyeage.co. We will not discriminate against you for exercising these rights.If you are in another jurisdiction with a data-protection law, contact support@eyeage.co and we will handle your request in line with that law so far as it applies to the limited data described in this policy.
This policy and any dispute relating to EyeAge's processing of personal data are governed by the laws of India. Subject to the paragraph below, the courts at Indore, Madhya Pradesh, India have exclusive jurisdiction.
Nothing here takes away (a) any non-waivable right you have under the data-protection law of your own country of residence, (b) your right as a consumer to approach the consumer disputes redressal commissions under the Consumer Protection Act, 2019, or (c) your right to complain to the Data Protection Board of India. As in the Terms of Service, arbitration is not mandatory and is not a pre-condition to any of these routes.
All privacy questions, data-principal rights requests, and grievances:
support@eyeage.co