Propel Privacy Policy

1. Scope & Core Principles

This policy applies to all visitors, registered users, and desktop application operators across the Propel ecosystem. Our privacy architecture is guided by three fundamental principles:

• Data Minimization: We collect only the data strictly necessary to authenticate your account, verify your subscription tier, ensure software compatibility, and maintain system stability.
• Zero Invasive Surveillance: Propel is a system optimization tool. We do not inspect personal documents, track browsing history, monitor keystrokes, or access unauthorized directories.
• No Data Brokering: We do not sell, rent, monetize, or trade your personal data with third-party data brokers or advertising networks.

2. Information We Collect

We collect information across several distinct categories depending on your interaction with the service:

A. Account and Registration Information

When you register for a Propel account, we collect:

• Email Address: Used as your unique account identifier for login, email verification, subscription confirmations, and transactional security notices;
• Full Name or Display Name: Optional name provided during registration to personalize your dashboard and account communications;
• Password: Securely processed and stored using cryptographic hashing algorithms through Supabase Auth. We never store, transmit, or have access to your plaintext password.

B. Authentication and Session Information

To facilitate cloud Single Sign-On (SSO) and desktop application authorization, our systems generate:

• Session Tokens: Cryptographically signed JWT access tokens and refresh tokens issued by Supabase Auth to manage authenticated web sessions;
• Handoff Authorization Codes: Short-lived, single-use cryptographic codes generated exclusively to facilitate browser-to-desktop SSO linking via the propel:// protocol;
• Session Scoping: Independent cryptographic session storage for browser and Electron desktop applications to prevent cross-client token leakage.

C. Subscription and Entitlement Information

To govern access to optimization tools and multi-workstation limits, we track:

• Current plan (FREE, PRO or MAX) and 7-day PRO trial status;
• Plan start and expiry dates, and refund status;
• Order and payment reference IDs from our payment partner (Razorpay). Propel purchases are one-time payments and do not auto-renew. We do not collect or store card numbers, CVVs or bank credentials.

D. Desktop Application & System Telemetry

When the Propel desktop client runs on your Windows computer, it processes:

• Operating system: Windows edition/build and Propel version, to ensure compatibility and deliver updates;
• Device registration: a random device identifier generated when you first run Propel (not derived from your hardware), a generic device label ("Windows PC"), and the date it was last active. This lets us apply your plan's device limit and lets you remove devices from your dashboard. We do not collect your computer name or hardware serials;
• Usage counts for AI features (a number per month, not the content).

E. Crash Logs and Diagnostic Information

If crash reporting is on, Propel sends diagnostic reports (error message, stack trace with personal folder paths removed, timestamp, app version, Windows version, CPU model and RAM size) to our crash reporting provider (GlitchTip). Reports exclude your files and personal data. You can turn this off anytime in Settings > Privacy.

3. What We Do NOT Collect

• Personal files, documents, downloads, spreadsheets, photos, or media files;
• Web browsing histories, visited URLs, or search engine queries;
• Passwords, credentials, or session cookies from other web browsers or desktop applications;
• Keystrokes, keyboard inputs, or clipboard contents;
• Microphone audio, webcam video, or screen capture streams;
• Surveillance telemetry, background audio monitoring, or biometric data;
• Propel scans your disk (Cleaner, Duplicate Finder) locally on your device. File names, paths and contents are never uploaded.

4. How We Use Information

We utilize collected data solely for legitimate operational and technical purposes:

• Authenticating your identity and preventing unauthorized access to your account;
• Provisioning and synchronizing your FREE, PRO, or MAX plan entitlements between the cloud and desktop;
• Managing the 7-day PRO evaluation trial and preventing automated trial circumvention;
• Processing subscription upgrades, invoice generation, and billing notifications;
• Delivering automated delta updates, security patches, and application enhancements;
• Detecting, mitigating, and investigating security incidents, abuse patterns, and system vulnerabilities;
• Responding to customer support inquiries and resolving technical bug reports.

5. AI-Powered Features (PC Advisor)

When you click "Explain my PC's health", Propel sends a summary of your PC's current state through our servers to Google's Gemini API to generate a plain-language explanation. The summary contains only: CPU, memory and disk usage and memory size, number of running processes, system uptime, a health score, and the size/status of the last junk scan. It does not contain your name, email, account ID, device name, file names or paths, running process names, or file contents. This happens only after you give consent in the app, and only when you click the button. We do not store the summary or the AI response; we only keep a monthly usage count to enforce plan limits. Google processes the request under its own terms and privacy policy.

6. Cookies & Local Storage

The Propel website uses modern web storage (such as browser localStorage) strictly for essential functionality:

• Authentication Token Storage: Caching the authenticated Supabase session token to maintain your logged-in status as you navigate between pages;
• Theme Preference: Storing your preferred visual color theme (dark or light mode);
• Zero Advertising Trackers: We do not deploy third-party advertising cookies, behavioral re-targeting scripts, or cross-site tracking pixels;
• Our login pages use Cloudflare Turnstile to detect bots, which may process your IP address and browser signals.

7. Third-Party Service Providers

We partner with trusted infrastructure service providers to operate the Propel cloud platform:

• Supabase: authentication and database hosting
• Render: backend API hosting (processes IP addresses and requests)
• Vercel: website hosting
• Razorpay: payment processing (PCI-DSS)
• Google (Gemini API): AI explanations in PC Advisor, only with your consent
• GlitchTip: crash reports, if enabled
• Cloudflare (Turnstile): bot protection on login and signup
• GitHub: delivery of app updates (receives your IP when the app checks for updates)

Each service provider is contractually bound by confidentiality and security obligations and is restricted from processing your data for any unauthorized purpose.

8. Data Sharing & Disclosure

We do not sell, rent, trade, or disclose your personal data to any external parties, with the exception of the following strictly limited scenarios:

• Service Delivery: Sharing required information with our designated cloud providers (as described in Section 7) solely to operate the service;
• Legal Compliance: Disclosing information when required by lawful court order, subpoena, search warrant, or applicable statute;
• Safety & Protection: Enforcing our Terms & Conditions, protecting against system fraud, and safeguarding the rights, property, and safety of Propel and its users;
• Corporate Transactions: In connection with any merger, consolidation, restructuring, or asset sale, subject to equivalent confidentiality protections.

9. Data Retention

We retain your account information, plan history, and entitlement records for as long as your account remains active and in good standing. If you request account deletion, we will delete or anonymize your personal data within thirty (30) days, except where retention is legally mandated for financial auditing, tax compliance, or dispute resolution.

10. Data Security Safeguards

We implement comprehensive technical, administrative, and physical safeguards to protect your personal data against unauthorized access, loss, or alteration:

• All cloud communications, API calls, and authentication handoffs enforce Transport Layer Security (TLS 1.3 / HTTPS);
• Passwords are cryptographically salted and hashed using modern algorithms;
• Browser and desktop tokens are cryptographically isolated in client storage;
• Backend database access is strictly restricted by role-based permissions and firewall policies.

Please note that no method of electronic storage or transmission over the internet can be guaranteed to be 100% invulnerable. We encourage users to maintain unique, secure passwords and safeguard their local devices.

11. User Privacy Rights

Depending on your country or state of residence (including the European Economic Area under GDPR and California under CCPA/CPRA), you may hold specific legal rights regarding your personal data:

• Right of Access: You may request confirmation of whether we process your personal data and receive a copy of that data;
• Right to Rectification: You may request the correction of inaccurate, obsolete, or incomplete personal information;
• Right to Erasure (Right to be Forgotten): You may request the permanent deletion of your account and associated personal data;
• Right to Restriction & Objection: You may request that we restrict or discontinue certain processing activities;
• Right to Data Portability: You may request a machine-readable export of your personal account information.

To exercise any of these rights, please contact our privacy desk at support@cleanmasterpro.in. We respond to verified requests within statutory timeframes.

12. Children's Privacy

Propel is designed for general audiences and is not directed at children under the age of 13 (or under 16 where required by local law). We do not knowingly solicit or collect personal information from children. If you become aware that a minor has provided us with personal data without parental consent, please contact us immediately so we can promptly delete the account and purge the data.

13. International Data Transfers

Our cloud infrastructure and third-party service providers operate servers in multiple regions worldwide. By accessing the website or using the software, you acknowledge that your information may be transferred to, stored, and processed in cloud facilities outside your country of residence, where data protection standards may differ. We ensure appropriate contractual safeguards are implemented to protect your data during cross-border transfers.

14. Changes to This Privacy Policy

We may revise this Privacy Policy periodically to reflect new software capabilities, operational updates, or legal compliance requirements. When changes are published, the "Last Updated" date at the top of this document will be updated accordingly. We encourage you to review this policy periodically.

15. Contact & Privacy Requests

For inquiries, concerns, or formal privacy requests concerning this Privacy Policy, please reach out to:

• Privacy Email: support@cleanmasterpro.in
• Official Website: cleanmasterpro.in
• Legal Business: [LEGAL BUSINESS NAME]
• Registered Address: [BUSINESS ADDRESS]