Privacy Policy.

1 · The covenant.

What we keep.

Your account: a name to call you by, a phone number once phone sign-in ships with the open beta, and an email if you give us one. The transcripts of your Darpan sessions and the verses they composed. The Notes the mirror writes about themes you sit with. That is all.

What we don't.

We do not retain the audio you speak; it is transcribed and discarded. We do not train any model on what you share, ours or anyone else's. We do not sell your data, ever, to anyone. We do not show advertising. We do not use Google or Apple sign-in, because we do not want either company to know you opened Adhyatm.

What disappears.

Vyom releases hard-delete after 24 hours. Server logs roll off after 30 days. When you ask, your account and everything that identifies you deletes within seven days; an anonymized safety record (a label, never anything you wrote) may remain, no longer tied to you.

2 · Who is "we."

"Adhyatm," "we," "us," and "our" refer to the Adhyatm project, operated by Shubham Kumar as a sole proprietorship in Kolkata, India. Privacy questions go to privacy@adhyatm.co; anything else to hello@adhyatm.co. A real person reads both.

3 · What we collect.

Your account starts with a name to call you by; it does not have to be your legal name. When the beta opens fully, sign-in will be by phone number and a one-time SMS code, with an optional email for occasional notes and account recovery. The earliest testers get accounts set up by us directly.

Inside Darpan, we keep the transcript of what you say or type, the timestamps, and the verse and reflection composed at session close. The transcripts and the Notes (small structured summaries the mirror writes about themes you sit with) are the substance of the mirror's memory. They are stored in your account, visible only to you and narrowly to operators of the system.

If you speak rather than type, the audio is uploaded to our servers, transcribed, and then discarded. We do not retain the audio file; the transcript stays.

Vyom releases are stored anonymously (no account identifier on the post body) and hard-deleted after 24 hours. We keep an internal link to your account so we can show you "your releases," keep your own words out of what we hand you as a stranger's, and delete your releases if you ask; that link is not exposed to readers and is not shared.

A safety classifier reads every turn for signs of acute self-harm. When it fires, we log a crisis event with timestamp, session ID, classifier label and confidence, so we can route you to the appropriate helpline. We do not log the message text in the crisis-event row.

Standard server logs (IP, user-agent, timestamps) live for 30 days, for security and abuse prevention. App version and OS, to deliver the right updates. No advertising or third-party analytics SDKs.

This marketing site sets one first-party cookie to remember your theme preference. The app stores a sign-in token and small offline caches on your device. Nothing else.

What we do not collect. Location. Contacts. Camera or photos. Microphone except when you press hold-to-record. Calendar. Browser history. Any data from other apps on your device. Adhyatm asks for what it needs to run, and no more.

4 · What we do with it.

• Run your sessions. Transcripts and Notes are read by the language models that compose your verse and reflection. This is the core of the product.
• Safety. The crisis classifier reads each turn so we can route you to a helpline when it matters. A human operator may review patterns to tune the classifier.
• Send you occasional notes if you signed up for them. Unsubscribe in one click from the bottom of any note.
• Improve the corpus and the retrieval. Aggregate signals (which verses lift, which fall flat) shape what we add and how we tune the match. Aggregate means we do not look at your transcript with your identity attached.
• Keep the lights on. Backups, security, abuse prevention, and payment processing if and when paid tiers exist.

What we will never do.

• Train any language model on your sessions, Vyom releases, or Notes. Not our own (we don't train one). Not a third party's. This is a covenant, not a preference.
• Sell your data. Ever. To anyone.
• Show you advertising inside Adhyatm.

5 · Who else touches it.

Adhyatm runs on DigitalOcean (Bangalore-region hosting), Cloudflare (DNS, TLS, and database backups in R2), DeepSeek (session composition), Google Vertex AI (safety classifier and voice transcription), and Sentry (error monitoring, configured to scrub session content from reports). We pay for these services and choose them for API terms that exclude training on customer content; we never hand any of them your sessions as training data. Sign-in OTPs will go via an Indian SMS gateway and a transactional email provider; both are still being chosen, and we will name them here before they go live. If we add or replace any of these, we will update this paragraph before the change ships.

6 · Your rights.

• See what we have. Write to privacy@adhyatm.co and we will assemble a full export by hand within seven days. An in-app export ships with the open beta.
• Delete it. Write to privacy@adhyatm.co and everything (transcripts, Notes, Vyom history, account row) is deleted within seven days, and we will tell you when it's done. An anonymized safety record (a label, never anything you wrote) may remain, no longer tied to you. An in-app delete control ships with the open beta.
• Correct it. Edit your profile fields, or email us if it's something only we can touch.
• Withdraw consent. Stop using Adhyatm. We retain only what we are legally required to (almost nothing) and delete the rest.
• Be told if a court asks. If a court ever orders us to produce your data, we will inform you to the extent the law allows.

If you are in the EU, the UK, California, or another jurisdiction with statutory data rights, those rights apply to you whether or not we name them here.

How long we keep things.

• Audio: not retained. Transcribed and discarded within seconds.
• Vyom releases: 24 hours, hard-deleted.
• Server logs: 30 days.
• Backups: kept for disaster recovery; we are putting a fixed 30-day retention window in place and will state it plainly here once it is enforced.
• Transcripts, Notes, and account data: until you delete your account, or seven years from your last activity, whichever is sooner.

Adults only.

Adhyatm is for adults. You must be 18 or older to use it. We will delete any account we learn belongs to someone under 18. If you are a parent or guardian and believe your child has signed up, write to us and we will delete the account.

7 · Talk to us.

For anything privacy-related (questions, requests, complaints) write to privacy@adhyatm.co. A real person reads it and replies within a few days.

When we change this notice in a meaningful way, we will email subscribers, post a notice in the app, and update the effective date at the top. Cosmetic edits will not be announced; rights-altering edits will.