Privacy Policy

Last updated: 7 June 2026

This policy explains what data P2P Track ("we", "us") collects when you use the app at p2ptrack.in, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have over it.

P2P Track is operated by CURIOSTEM LEARNING PRIVATE LIMITED — RSF No 34/3, Door No 155/1, Sakthi Nagar, Thindal, Erode – 638012, Tamil Nadu, India (GST: 33AAMCC6984A1ZM), the data controller for your information.

If you have any questions, or want to exercise any of the rights below, contact us at info@stemlabs.co.in.

What we collect

Account information. When you sign up or log in, we collect your email address and authentication details (a password and one-time codes), handled through AWS Cognito. We use your email to identify your account, sign you in, and send service emails.

Loan/tracker data you enter. P2P Track stores the information you put into a tracker: the loan's name, the other person's name (if you add it), the amount, interest rate, dates, recorded payments and notes, and any payment screenshots you choose to upload.

Technical data. Like any web service, our infrastructure processes standard request data (such as IP address and basic request metadata) to operate the service securely and reliably.

We do not collect payment-card details, and we do not move or hold money — P2P Track is a record-keeping tool only.

Why we use it (legal bases)

• To provide the service (performance of a contract): creating, storing, and displaying your trackers; authenticating you; sending sign-in codes and notifications.
• Legitimate interests: keeping the service secure, preventing abuse, and operating and improving it.
• Consent: where specifically required, for example optional features you choose to use.

Cookies and local storage

We use strictly-necessary cookies only — set by our authentication layer to keep you signed in and to protect against cross-site request forgery. We do not use analytics, advertising, or tracking cookies, and we do not share data with ad networks. Because we only use essential cookies, no cookie-consent banner is required.

We also store a small flag in your browser's local storage to remember if you dismissed the "Add to Home Screen" prompt. This stays on your device and is not sent to us.

Who processes your data (sub-processors)

We rely on Amazon Web Services (AWS), with data hosted in the Asia Pacific (Mumbai) ap-south-1 region:

• AWS Cognito — authentication and account/email storage.
• AWS DynamoDB — stores your account and tracker data.
• AWS S3 — stores payment screenshots you upload.
• AWS SES — sends transactional emails (sign-in codes, access-request notifications).
• AWS Amplify — hosts the web application.

We do not sell your personal data, and we do not share it for advertising.

Link sharing and "capability URLs"

P2P Track is designed so you can create a tracker and share it instantly. You should understand how this works:

• Until you claim a tracker, anyone who has its link can view and edit it. The link itself is the key — treat it like a password and only share it with people you trust.
• Once you claim a tracker (by signing in), it is locked to your account and others can no longer access it, except through any read-only share link you choose to generate.
• You can also approve specific people's requests to access a private tracker.

Please keep this in mind before sharing a link, and don't put information in a tracker that you wouldn't want a recipient of the link to see.

How long we keep it

We keep your data for as long as your account and trackers exist. Deleting a tracker removes that tracker and its payment records. If you ask us to delete your account, we erase your account data as described below. We may retain limited records where required by law or to resolve disputes.

Your rights

Depending on where you live (for example under the EU/UK GDPR), you have rights to access, correct, delete (erasure), export, and object to the processing of your personal data.

How to exercise them:

• Delete individual trackers yourself at any time from within the app — this removes the tracker and its records.
• Delete your whole account and all associated data (your trackers, payment records, uploaded screenshots, and your authentication record): email info@stemlabs.co.in from your account's email address and we will erase it. (We're also adding a self-service "delete my account" option in the app.)
• For access, correction, or export requests, email the same address and we'll respond within a reasonable period.

Children

P2P Track is not intended for children under 16, and we do not knowingly collect their data.

International users

Your data is stored and processed on AWS infrastructure in India (ap-south-1). By using the service you understand your data is processed there.

Changes to this policy

We may update this policy from time to time. We'll change the "last updated" date above and, for material changes, take reasonable steps to let you know.

Contact

Questions or requests: info@stemlabs.co.in.