Last updated: October 4, 2026
This Privacy Policy explains what information XPARO ("we", "us", "our") collects through the XPARO website and platform (the "Service", at xparo.in and its subdomains), how we use it, and who we share it with. XPARO is run by Pankaj Jangir from Jaipur, Rajasthan, India. The Policy applies to visitors, registered users, and the robots/devices connected to user projects. It is framed with reference to the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Information Technology (Reasonable Security Practices and Sensitive Personal Data or Information) Rules, 2011. Under the DPDPA, XPARO acts as the "Data Fiduciary" and you (the user) are the "Data Principal" in relation to your personal data.
When you create an account or use the Service, we collect:
A core feature of the Service is connecting physical robots to your project for monitoring and control. When you connect a robot, it can send us:
This data is used solely to power the monitoring, analytics, and behavior-tree features you use within your own project, and is visible to you and to the members you invite to that project. We do not sell robot/device data, and we do not use robot location data for advertising. Location data and device identifiers of this kind may constitute "Sensitive Personal Data or Information" (SPDI) under the IT Rules, 2011; by connecting a robot to a project, you consent to this data being collected and processed as described in this Policy, and you confirm you have the right to share any location or device data generated in spaces you do not personally control (for example, a shared workspace).
Our free tools at xparo.in/more_tools (calculators, the PID simulator, the serial monitor, the map editor, the behaviour tree visualizer and others) process what you enter inside your own browser. Values you type, files you open (such as .pgm maps or XML trees) and data read from a serial device are not uploaded to our servers, and we do not store them. The serial monitor only talks to a device after you pick it in your browser's own permission dialog.
Like most websites, we automatically log standard technical information when you visit (IP address, browser type, pages visited, timestamps) for security and diagnostics. We and our partners also use cookies and similar technologies -- see Section 6.
We do not sell your personal information. We share information with the following categories of third parties, only as needed to operate the Service:
| Who | What they receive | Why |
|---|---|---|
| Cashfree Payments (payment gateway) | Your email, a system-generated customer ID, and the order amount | To process purchases. Cashfree is a licensed payment aggregator regulated by the Reserve Bank of India; see Cashfree's own privacy policy at cashfree.com for how they handle payment details. |
| Cloud file storage (S3-compatible object storage) | Uploaded files: sensor recordings, project images, and other media you upload | To store and serve the files you upload through the Service. |
| Firebase Storage (Google) | Profile pictures you upload | To host and serve user avatar images. |
| Email delivery (Gmail/Google Workspace SMTP) | Your email address and the content of transactional emails | To send account, password-reset, verification, receipt, and product-notification emails. |
| Bugsnag (error monitoring) | Technical request data (URL, browser info) at the moment an error occurs | To help us detect and fix bugs. Not used for advertising. |
| Google Analytics | Pages visited, device/browser type, approximate location from IP, via cookies | To understand site usage and improve the Service. |
| Google AdSense and the ad partners Google works with | Cookies and similar identifiers, IP address, browser and device information, and the pages you view | To show ads on our public content pages (tools, guides and the blog), measure them, and prevent ad fraud. Ads help pay for the free tools and the free tier of the Service. See Section 6. |
We may also disclose information if required by law, to protect the rights and safety of XPARO or our users, or in connection with a merger, acquisition, or sale of assets (with notice to you where required).
Cross-border transfer: some of the third parties above (including our cloud storage, email, analytics and advertising providers) may process or store data on servers located outside India. The DPDPA permits transfer of personal data outside India except to countries specifically restricted by the Central Government; we do not currently transfer data to any such restricted country. By using the Service, you consent to this transfer.
We use:
How advertising on XPARO works. We use Google AdSense to show ads on some public pages.
Your choices.
Ad-blocker notice. On pages that carry ads, a small script checks whether the ad script was blocked, only so that it can show a request to allow ads on xparo.in. It does not store anything or send anything to us, and you can dismiss the request.
XPARO itself does not use cookies to follow you across other websites. Google's advertising cookies described above may do so unless you opt out.
We retain account and project data for as long as your account is active. If you want your account or project data deleted, email us at the address in Section 13 and we will manually delete it, typically within 30 days, except where we are required to retain records for legal, tax, or fraud-prevention purposes (for example, transaction records related to a payment). We do not currently offer a fully automated self-service deletion or data-export tool; requests are handled manually by us.
Account-related emails (password resets, email verification, purchase receipts) are sent regardless of marketing preferences, since they're necessary to operate your account. Product update and reminder emails include an unsubscribe link that lets you opt out of that category, or of all non-essential email, at any time.
Under the DPDPA, a "child" is anyone under 18 years of age. The Service is not directed at children, and account creation requires a user to be 18 or older (or to have a parent/guardian create and consent to the account on their behalf, per Section 2 of our Terms of Service). We do not knowingly collect personal data directly from unaccompanied children, and we do not knowingly use personalised advertising for children. If you believe a child has provided us with personal data without appropriate consent, contact us using Section 13 below and we will delete it.
We serve the site over HTTPS, store passwords only as salted hashes, and limit who can access our servers and database. Files you upload are stored with a cloud storage provider, and anyone who has a file's link can open it, so do not upload files you need to keep secret. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and fix problems quickly when we find them.
As a Data Principal under the DPDPA, and as a user of the Service, you have the right to:
To exercise any of these rights, contact us using Section 13 below.
In the event of a personal data breach that is likely to affect you, we will notify you and, where required under the DPDPA, the Data Protection Board of India, without undue delay.
For any question about this Privacy Policy, to exercise the rights in Section 11, or to raise a grievance, contact our Grievance Officer:
Grievance Officer: Pankaj Jangir
Email: [email protected]
Location: Jaipur, Rajasthan, India
Or via our contact page. We aim to acknowledge requests within 24 hours and resolve them
within 15 days.
We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new "Last updated" date. Material changes will be highlighted where practical.
