Privacy Policy

In Sanatana Dharma, every guest is Atithi — a form of the Divine arriving at our threshold. When you step across this threshold, you bring your thoughts, your questions, and certain digital traces. We receive those traces the way a devoted host receives a guest: with respect, discretion, and purpose.

We do not sell your data. We do not profile you for advertisements. We hold only what is needed to serve you well, and we release it when that purpose ends. This policy fulfils our obligations under India's Digital Personal Data Protection Act, 2023 (DPDPA 2023) and reflects Privacy by Design — your privacy is built into this platform from its foundation, not bolted on.

1. Who We Are

2. What Data We Collect — The Panchabhoota Framework

Just as the universe is composed of five elements, the data we collect can be understood through five kinds of information. We collect only what each element truly requires.

Prithvi (Earth) — Identity Data

• Full name — collected at registration
• Email address — for login and transactional emails
• Preferred language — so we can speak your tongue

Jal (Water) — Conversation Data

• Questions and responses in your dialogue sessions
• Feedback signals (helpful / not helpful) that you choose to give
• Session timestamps
• Summaries of your conversations, generated to give continuity across sessions
• An evolving understanding of your nature (your "Svabhava") — a distilled reflection of recurring themes and the texts you return to, formed from your conversations so AtmaSarathy can remember you with continuity
• If you choose to look into the Antardarpana (inner mirror), a gentle reading of the classical four aims and three threads, distilled from your reflections or from your answers to a few questions — offered tentatively, adjustable by you at any time, and erased with your account
• Sankalpas (vows) you choose to take, and your chosen mode of accompaniment

Authenticated users have conversation history and the above stored. Guest users have no data stored beyond what is processed transiently in the current session. You may view, rebuild, export, or delete all of this at any time from your Svabhava page — including the understanding AtmaSarathy holds of you.

A private ("incognito") reflection is never stored and never shapes the understanding AtmaSarathy holds of you — no message, no summary, no Svabhava update is written. The only trace is brief, content-free fair-use metadata (an identity token and timestamp, never your words), which is deleted within about a day.

Agni (Fire) — Technical Data

• IP address (anonymised after 30 days; for guests, used only as a salted, non-reversible hash to apply fair-use limits — your raw IP is not stored for this)
• Browser type and device class
• Pages visited and navigation flow (session-scoped)
• Country (derived at the network level, not precise location) — used to route you to the correct regional support helpline if signs of distress are detected
• Counts of requests, to apply fair-use limits and protect the service from abuse
• Error logs (retained 14 days, then deleted)

Vayu (Air) — Preference Data

• Language preference stored in session and, if logged in, in your profile
• Cookie consent choice (stored locally)
• Your acknowledgement of our service notice — including your confirmation that you are 18 or older — recorded, if you are signed in, with the date and version, as a record that you were shown and accepted it
• Your sadhana accompaniment preference (silent / gentle / active)
• Your optional "waters" preference — if you choose, the scripture-families (e.g. the Upanishads, the Itihasas, the stotras) whose voice you would like AtmaSarathy to lean on. This is an affinity of texts, set by you and changeable or removable at any time; it is used only to shape which teachings are drawn upon, never shared, and defaults to none.

Akasha (Space) — What We Do Not Collect

• No caste or community information; no religious identity or sect affiliation is required or requested. (The only exception is the optional, seeker-chosen "waters" preference described above — an affinity of scriptural texts you may set, and remove, entirely at your discretion.)
• No financial or payment data (AtmaSarathy is free)
• No precise location beyond country-level
• No biometric data
• No data from minors under 18

3. Why We Use Your Data

We do not use your data for targeted advertising, sale to third parties, or automated decision-making with significant effects on you.

4. How Long We Keep Your Data

Our principle is simple: we hold what you share on the basis of your consent and our need to serve you — and no longer than that. So we keep your reflections for as long as you are in relationship with AtmaSarathy, so that it can remember you with continuity. When you delete them, they are erased completely and promptly. And if you go entirely dormant for a long time, we let go on our own.

5. Your Rights as a Data Principal

6. Who We Share Your Data With

We do not sell, rent, or trade your data. The following sub-processors receive limited data to operate the platform:

A note on how your reflections are processed: to generate a response, the text of your message is sent to Anthropic's AI service as plaintext — this is unavoidable, as the model must read what you write in order to respond. At rest in our database, your stored history is held within Supabase's encrypted infrastructure. We are exploring stronger, seeker-held encryption for stored reflections; until then, we describe our protection honestly rather than over-promise. We never sell your data, and we do not use your reflections to train AI models.

7. Cross-Border Transfers

Anthropic, Resend, and Vercel are based in the United States. Your data may be processed there through processors who maintain adequate safeguards. We will update this section as India's cross-border transfer regulations under DPDPA 2023 are notified.

8. Security — The Kavacham

• All data in transit encrypted via TLS 1.2+
• All data at rest encrypted (AES-256) in Supabase's managed infrastructure
• Row-level security (RLS) on every table, so one seeker's data is walled off from every other — no seeker can reach another's reflections
• Authentication tokens are short-lived JWTs with rotating refresh tokens; no plaintext passwords are ever stored
• API keys and secrets stored as environment variables, never in code
• Rate limiting on all API routes
• Complete cascading erasure on account deletion, verified so that content is truly removed, not merely de-linked

An honest word on what this does and does not mean. Your reflections are walled off from other users and encrypted at rest. But because AtmaSarathy remembers you across visits — your Svabhava, your continuity — the service itself must be able to read your conversations to provide that memory. So we do not claim that "even we cannot see your reflections": as long as memory works, that would not be true, and we would rather be truthful than reassuring. Access is limited to the running service and is never sold, shared for advertising, or used to train AI models. For those who would prefer that even we could not read a session, a private ("incognito") reflection is available today — it is never stored — and we are designing an opt-in "sealed" mode of stronger, seeker-held encryption for the future, in which memory would be set aside in exchange for that privacy. We will describe it plainly, and only offer it, when it genuinely delivers what it promises.

In the event of a data breach likely to cause high risk to your rights, we will notify affected seekers and the relevant authority without undue delay, and within 72 hours of becoming aware wherever feasible.

9. Children's Privacy

AtmaSarathy is designed for adults. Before beginning, seekers are asked to confirm they are 18 or older. We do not knowingly collect personal data from individuals under 18. If you believe your child has used this platform, contact us at privacy@atmasarathy.com and we will delete their data.

10. Changes to This Policy

We will notify registered users by email of material changes at least 15 days before they take effect. The version history is maintained at this page.

11. Contact