Privacy Policy.

1 · The covenant.

What we keep.

Your account: a name to call you by, your email address, and the account identifier Google gives us when you sign in. The transcripts of your Darpan sessions and the verses they composed. The Notes the mirror writes about themes you sit with. That is all.

What we don't.

We do not retain the audio you speak; it is transcribed and discarded. We do not train any model on what you share, ours or anyone else's. We do not sell your data, ever, to anyone. We do not show advertising. When you sign in with Google we ask for the least it will give us, which is who you are and your email address. We never ask for your contacts, your files, or anything else in your Google account.

The tradeoff we made.

Signing in with Google does mean Google knows you have an Adhyatm account. An earlier version of this notice promised we would never use it. We changed our minds, and you deserve the reason rather than a quiet edit: without an account tied to something you can prove is yours, losing your phone lost every session you had ever had, permanently and with no way to ask for them back. We would rather Google know you have an account than lose your work for you.

What disappears.

Vyom releases hard-delete after 24 hours. Server logs roll off after 30 days. Deleting your account from Profile removes it and everything that identifies you immediately; ask us by email instead and it happens within seven days. An anonymized safety record (a label, never anything you wrote) remains, no longer tied to you. The deletion page spells all of this out.

2 · Who is "we."

"Adhyatm," "we," "us," and "our" refer to the Adhyatm project, operated by Shubham Kumar as a sole proprietorship in Kolkata, India. Privacy questions go to privacy@adhyatm.co; anything else to hello@adhyatm.co. A real person reads both.

3 · What we collect.

Sign-in is with your Google account. From it we receive the account identifier Google uses for you, your email address, and your first name, which becomes the name Adhyatm calls you by until you change it. We ask Google for nothing else. We never see your Google password.

Inside Darpan, we keep the transcript of what you say or type, the timestamps, and the verse and reflection composed at session close. The transcripts and the Notes (small structured summaries the mirror writes about themes you sit with) are the substance of the mirror's memory. They are stored in your account, visible only to you and narrowly to operators of the system.

If you speak rather than type, the audio is uploaded to our servers, transcribed, and then discarded. We do not retain the audio file; the transcript stays.

Vyom releases are stored anonymously (no account identifier on the post body) and hard-deleted after 24 hours. We keep an internal link to your account so we can show you "your releases," keep your own words out of what we hand you as a stranger's, and delete your releases if you ask; that link is not exposed to readers and is not shared.

A safety classifier reads every turn for signs of acute self-harm. When it fires, we log a crisis event with timestamp, session ID, classifier label and confidence, so we can route you to the appropriate helpline. We do not log the message text in the crisis-event row.

Standard server logs (IP, user-agent, timestamps) live for 30 days, for security and abuse prevention. App version and OS, to deliver the right updates. No advertising or third-party analytics SDKs.

This marketing site sets one first-party cookie to remember your theme preference. The app stores a sign-in token and small offline caches on your device. Nothing else.

What we do not collect. Location. Contacts. Camera or photos. Microphone except when you press hold-to-record. Calendar. Browser history. Any data from other apps on your device. Adhyatm asks for what it needs to run, and no more.

4 · What we do with it.

• Run your sessions. Transcripts and Notes are read by the language models that compose your verse and reflection. This is the core of the product.
• Safety. The crisis classifier reads each turn so we can route you to a helpline when it matters. A human operator may review patterns to tune the classifier.
• Send you occasional notes if you signed up for them. Unsubscribe in one click from the bottom of any note.
• Improve the corpus and the retrieval. Aggregate signals (which verses lift, which fall flat) shape what we add and how we tune the match. Aggregate means we do not look at your transcript with your identity attached.
• Keep the lights on. Backups, security, abuse prevention, and payment processing if and when paid tiers exist.

What we will never do.

• Train any language model on your sessions, Vyom releases, or Notes. Not our own (we don't train one). Not a third party's. This is a covenant, not a preference.
• Sell your data. Ever. To anyone.
• Show you advertising inside Adhyatm.

5 · Who else touches it.

Adhyatm runs on DigitalOcean (Bangalore-region hosting), Cloudflare (DNS, TLS, and database backups in R2), DeepSeek (session composition), Google Vertex AI (safety classifier and voice transcription), and Sentry (error monitoring, configured to scrub session content from reports). We pay for these services and choose them for API terms that exclude training on customer content; we never hand any of them your sessions as training data. Sign-in OTPs will go via an Indian SMS gateway and a transactional email provider; both are still being chosen, and we will name them here before they go live. If we add or replace any of these, we will update this paragraph before the change ships.

6 · Your rights.

• See what we have. Write to privacy@adhyatm.co and we will assemble a full export by hand within seven days. An in-app export ships with the open beta.
• Delete it. Profile, then Delete account, deletes everything (transcripts, Notes, Vyom history, account row) immediately. If you cannot open the app, write to privacy@adhyatm.co and we will do it within seven days and tell you when it's done. An anonymized safety record (a label, never anything you wrote) remains, no longer tied to you. Full detail on the deletion page.
• Correct it. Edit your profile fields, or email us if it's something only we can touch.
• Withdraw consent. Stop using Adhyatm. We retain only what we are legally required to (almost nothing) and delete the rest.
• Be told if a court asks. If a court ever orders us to produce your data, we will inform you to the extent the law allows.

If you are in the EU, the UK, California, or another jurisdiction with statutory data rights, those rights apply to you whether or not we name them here.

How long we keep things.

• Audio: not retained. Transcribed and discarded within seconds.
• Vyom releases: 24 hours, hard-deleted.
• Server logs: 30 days.
• Backups: kept for disaster recovery; we are putting a fixed 30-day retention window in place and will state it plainly here once it is enforced.
• Transcripts, Notes, and account data: until you delete your account, or seven years from your last activity, whichever is sooner.

Adults only.

Adhyatm is for adults. You must be 18 or older to use it. We will delete any account we learn belongs to someone under 18. If you are a parent or guardian and believe your child has signed up, write to us and we will delete the account.

7 · Talk to us.

For anything privacy-related (questions, requests, complaints) write to privacy@adhyatm.co. A real person reads it and replies within a few days.

When we change this notice in a meaningful way, we will email subscribers, post a notice in the app, and update the effective date at the top. Cosmetic edits will not be announced; rights-altering edits will.