App privacy policy

This policy covers the Kaya5 app — everything after you sign in, on iPhone, Android and the web app. The logged-out marketing site and the dosha quiz are covered separately by our website privacy notice.

Kaya5 is educational. It is not medical advice, not a diagnosis, and not a substitute for a clinician. Do not use it for an emergency.

What we collect, and why

Your account. When you sign in with Google, Apple or an email address, we receive your email address and, if your provider supplies it, your name. We use it to identify your account and to email you about it. Sign-in is handled by Google Firebase Authentication; we never see your Google or Apple password.

Your assessment and check-ins. The answers you give in the constitution (prakriti) assessment, your current-state (vikriti) readings, and your daily check-ins. This is the core of the product: it is what your routine and its reasons are calculated from.

Health data from Apple Health or Health Connect — only if you grant it. With your permission we read a limited set: steps, active energy, heart rate, resting heart rate, and sleep sessions. We read only; we never write anything back into Apple Health or Health Connect. You can decline, and the app works without it — your routine is then calculated from your assessment and check-ins alone. You can revoke access at any time in your device settings.

Approximate location — on the web app only, and only if you grant it. Used to adapt guidance to your climate and season, because Ayurvedic routine depends on both. If you grant it, your browser sends us a single set of coordinates at that moment; we do not track your movements and we do not build a location history. The iOS and Android apps do not ask for or collect location at all.

Notes you type. Free-text you write — a note on a practice, or a correction to a recommendation. Free-text health notes are encrypted at rest with a key held separately from the database.

Notification tokens.If you allow notifications, your device’s push token, so a reminder can reach that device.

Usage analytics and crash reports. Which screens are opened and which actions are taken, plus crash and error diagnostics, so we can tell what is working. Analytics events are scrubbed of health values before they are sent — we send that you completed a check-in, not what you recorded in it.

Where your data lives, and the one border it crosses

Your account and health data are stored in India, in our primary database in Bangalore. We are telling you this specifically because the exception matters: our analytics provider (Amplitude) processes its data in the United States, and that region cannot be changed. So while your health values stay in India, the analytics events described above — which identify you by an account identifier and carry no health values — are processed in the US. Crash reporting (Sentry) is likewise US-processed.

Who else can see it

Not other users. Every query for your data is scoped to your account on the server, from your verified sign-in token — never from anything an app or a browser can ask for.

A practitioner, only when you choose.If you book a consultation or share a record with a Kaya Guru, they see what that action shares and no more. Following a practitioner’s content is not the same as being their patient and shares nothing.

Our processors. Google (sign-in, notifications), DigitalOcean (hosting and database), Amplitude (analytics), Sentry (crash reporting), Resend (transactional email). They process data on our instructions to run the service.

Nobody buying it. We do not sell your data, and we do not run third-party advertising or ad-tracking in the app.

Deleting your account

You can delete your account from inside the app, or from this page if you no longer have it installed. Deletion removes your account and the data described above, including your sign-in identity. It is not a deactivation and it is not reversible.

Two honest limits. Backups roll off on their own schedule, so a copy may persist in an encrypted backup for a short period after deletion. And aggregate analytics that can no longer be linked to you — counts, not records — are not deleted, because they are no longer about you.

How long we keep it

Your account data is kept while your account exists. Delete the account and it goes. We do not have a separate retention schedule to disclose yet; when we set one, it will appear here.

Children

Kaya5 is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from children.

Your choices

Health data, location and notifications are each separately optional and each revocable in your device settings — declining any of them leaves the rest of the app working. You can export your data or delete your account from inside the app. To ask us anything about your data, or to make a request we have not built a button for, use our contact page.

Changes

We will update this page and the date above when our practices change. This policy describes what the app does today; where a protection is planned rather than in place, we have said so above rather than implying it.

Educational content only — not medical advice.