The data, the paper, and the limits.
Sukoon is a small, pilot-stage product. This page is the whole data story: what leaves a device, what reaches HR, who processes it, how long it is kept, and what we do not have yet.
Status, plainly
What is in place today, and what isn't. Four statuses only: In place, Partial, Not started, Not configured.
| Area | Status | Detail |
|---|---|---|
| Personal data collected | In place | No names, emails or device IDs. Anonymous team counts only. |
| Hindi and Marathi screens | In review | The app reads and replies in English, Hindi and Marathi. Translations are written in plain everyday language; a native-speaker review of the safety screens is due before a paid pilot. |
| Small-number suppression | In place | Teams under 10 are hidden, plus a second team if subtraction could reveal one. |
| HR dashboard data | In place | Company name, team names, seats and weekly counts. No person, no email, no employee ID, no session record. |
| Subprocessor list | In place | Complete list below, with location and data. |
| Incident response | Partial | Named contact and a two-working-day reply. No formal runbook yet. |
| Accessibility | Partial | Keyboard and reduced motion tested; automated checks run. No independent WCAG audit. |
| DPA and terms | Partial | Founder drafts. Not reviewed by a lawyer. |
| SOC 2 / ISO 27001 / pen test | Not started | None yet. We'll say so in writing before any paid contract. |
| Data residency | Not configured | Hosting uses Vercel's default region. We'll pin a region if your DPA requires it. |
The HR dashboard holds four things and nothing else: your company name, your team names, the seat count per team, and the weekly counts. There is no field for a person, an email address, an employee ID, a device ID, or a session record, so none can be stored by accident.
What is collected
Only counts leave a device. A pilot link carries a short team code. When someone starts or finishes a break, the app adds one to that team's count. There is no row for a person and no session history.
| Event | What it means |
|---|---|
session-started | Someone opened a break. |
session-finished | The break reached the end. |
came-back | Someone returned on a later day. |
reminder-set | Someone made their own calendar or Slack reminder. |
opened-from-reminder | A break was opened from that reminder. |
team-reset-joined | Someone opened a shared team-break link. |
The count path is pilot/<team>/<event>. Nothing else is in it.
What the report contains
Per team, per week: how many started, how many finished, and how many started but did not finish. That is the four-field row: team, week, started, finished.
What is never collected
- Names, email addresses, employee IDs, device IDs, or IP addresses in the report.
- Individual sessions, timestamps per person, or a person's history.
- What anyone typed, what they chose, or how they felt afterwards.
- Anything about pain or a safety stop. Those are care, not a metric, and are never counted.
- Location, contacts, camera, microphone, or health-app data.
There is no login, no profile, and nothing to install. Choose a team code, not a person's name.
Small numbers are suppressed
A team appears in a weekly email only when at least 10 people started that week. We also hide the next-smallest team, so a hidden team cannot be worked out by subtracting the visible rows from a company total. Counts are weekly, never daily, so one person’s day of leave cannot reveal who usually takes part.
We call this aggregated with small numbers suppressed. We do not call it anonymous. A team code can describe a group, and a group can be small. Suppression is what protects the group, not a promise that the data contains no person at all.
If too few teams pass the threshold, the week's email says so and shows no team rows.
Who is responsible
Sukoon is built for India's Digital Personal Data Protection Act, 2023 and the Rules notified in November 2025. We do not claim “DPDP compliant”. We do claim purpose limitation, data minimisation, a notice template, a DPA, and deletion on request.
Subprocessors
| Vendor | Purpose | Data | Location |
|---|---|---|---|
| Vercel | Hosting and delivery of the site and app | Short-lived access logs, which may include an IP address. Not exported and not used for reporting. | United States / global edge |
| GoatCounter | Aggregate page counts on the marketing site | No cookies, no persistent IP. A daily hash counts unique visits, then is discarded. | European Union |
| Google (Gmail) | Pilot correspondence | Only what you send in an email. | Global |
| Anthropic | Optional guided mode, only if you switch it on yourself | The text you type. Deleted within 30 days. Not used for training by default. | United States |
That is the list. There is no HRIS sync, no Slack read access, no WhatsApp or SMS, no ad network, and no data broker. Sukoon does not sell data. We will tell you before adding a subprocessor.
Retention
- Team counts: kept for the pilot plus 30 days, then deleted. Deleted earlier on request.
- Pilot email: kept while the pilot and any contract run, then deleted on request.
- Host logs: short-lived (about an hour to three days, depending on the plan). We do not export them.
- Analytics: aggregate counts only. Raw IP addresses are not retained.
- AI: off in every pilot. If you switch it on yourself, Anthropic keeps the text for up to 30 days and Sukoon stores nothing.
These are the intended periods. A signed DPA sets the final ones for your pilot.
AI
AI is off by default, and off in every pilot. The public demo is scripted; no text is sent anywhere.
The local build has an optional guided mode. If you run it yourself with your own API key and switch it on, the text you type goes to Anthropic to choose a break. It is not used to train models by default and is deleted within 30 days. Sukoon does not store it.
AI never decides whether someone is safe. Safety stops are fixed rules, not a model's judgement.
DPA summary
I sign a data processing agreement before the first pilot link goes out. This is the plain-language summary.
- Roles: your company is the data fiduciary; Sukoon is the processor.
- Scope: team-level counts only, as listed above. No employee identifiers.
- Purpose: running and reporting the pilot. Nothing else.
- Subprocessors: the four listed above. Notice before any change.
- Security: HTTPS in transit, access limited to the founder, no employee-level store to breach.
- Deletion: on request, within 30 days, with written confirmation.
- Breach: tell you without undue delay, and within 72 hours of becoming aware.
- Audit: answer reasonable questions about this page and the code. No audit certificate yet.
The employee notice
You send this before the link. It is short on purpose.
What this is. Sukoon is a three-minute seated movement break. It is optional. There is no login and nothing to install.
What is counted. If our team joins the pilot, Sukoon counts how many people in the team started and finished a break each week. It does not record who.
What is not counted. What you type, how you feel, and anything about pain are never sent. If you stop or report pain, no one at the company is told.
Your choice. You can ignore the link, turn counting off in the app, and clear the device log at any time.
Questions. Ask rupakr2g@gmail.com.
This is a template, not legal advice. Your company decides the final wording.
Security today
Being small means being precise about what exists.
- HTTPS everywhere. No accounts, passwords, or employee database.
- Access to the deployment and email is limited to the founder.
- No SOC 2, ISO 27001, or penetration test yet. We will not show a badge we have not earned.
- Report a security issue to rupakr2g@gmail.com. I reply within two working days.
If your procurement process requires certifications Sukoon does not have, the honest answer is that this is not the right stage for that process yet.
The pilot pack
Everything your legal, IT, and HR team needs, in one place.
Next: Safety and limits →