Privacy Policy

1.Definitions

Capitalised terms used in this Policy have the following meanings, consistent with the DPDPA 2023 and SPDI Rules:

Data Fiduciary

The person who alone or in conjunction with others determines the purpose and means of processing personal data (Section 2(i), DPDPA). For Sanatani, this is Infopiy.

Data Principal

The individual to whom the personal data relates (Section 2(j), DPDPA). In this Policy, "you" or "user".

Personal Data

Any data about an individual who is identifiable by or in relation to such data (Section 2(t), DPDPA).

Processing

A wholly or partly automated operation on personal data, including collection, storage, use, sharing, disclosure, or erasure (Section 2(x), DPDPA).

Sensitive Personal Data or Information (SPDI)

Password, financial information, physical/physiological/mental health, sexual orientation, medical records, biometric information, and related categories as defined in Rule 3 of the SPDI Rules 2011.

Consent Manager

A registered entity, as defined under Section 2(g) of the DPDPA, that enables a Data Principal to give, manage, review, and withdraw consent. Sanatani does not currently use a Consent Manager.

Data Protection Board

The Data Protection Board of India, established under Section 18 of the DPDPA 2023.

Data Processor

A person who processes personal data on behalf of a Data Fiduciary (Section 2(k), DPDPA). For Sanatani, includes Google (Firebase, AdMob), Supabase, and Cloudflare.

2.Applicability and scope

This Policy applies to all personal data processed by Sanatani in connection with your use of the mobile application, whether such data is collected within the territory of India or outside India (where processing is in connection with any activity related to the offering of goods or services to Data Principals within the territory of India), as contemplated under Section 3 of the DPDPA 2023.

This Policy does not apply to (a) personal data made publicly available by you; (b) personal data processed by a court, tribunal, or public authority for statutory purposes; or (c) any third-party service you may access via links or SDKs, each of which is governed by its own privacy policy.

3.Data Fiduciary

Sanatani is not, as of the effective date, notified as a "Significant Data Fiduciary" under Section 10 of the DPDPA 2023. If we are so notified in future, we will comply with the additional obligations, including appointment of a Data Protection Officer and independent data audits, and will update this Policy accordingly.

4.Personal data we collect

4.1 Data collected automatically

• Anonymous Firebase User ID — a random string assigned by Google Firebase Authentication upon first launch. Unless and until you voluntarily choose to Sign in with Google (see Section 4.2), it is not linked to your name, phone number, email, or Google account.
• Device fingerprint — a one-way hash of your device model, Android OS version, and installation ID. Used solely for referral fraud prevention.
• Firebase Cloud Messaging (FCM) token — an opaque push-messaging token required to deliver notifications.
• Google Advertising ID (GAID) — a device-level identifier managed by Google Play Services. Used by Google AdMob to serve rewarded advertisements. You can reset or opt out from Android Settings → Google → Ads.
• Crash and diagnostic data — anonymised stack traces, Android version, device model, and app version, transmitted to Firebase Crashlytics for debugging.

4.2 Data you may voluntarily provide

• First name — optional; stored locally on your device only.
• Language preference — English / Hinglish / हिंदी / తెలుగు; stored locally.
• Referral code — optional; transmitted to our server to credit the referrer.
• Google account details (Sign in with Google) — entirely optional. Sanatani works fully without signing in. If — and only if — you choose to tap "Sign in with Google" (from the Account or Leaderboard screen), we receive from Google and store your name, email address, and profile photo. These are used solely to (a) display your name and photo on the community Leaderboard, and (b) let you restore your streak when you change or reinstall on a new phone. You may sign out at any time, and delete this data via the process in Section 10 or at our account deletion page.

4.3 Data stored only on your device (never transmitted)

• Daily task completion status (SVADHARMA Dashboard)
• Current and longest streak count
• Daily Blessing slots claimed today
• Ad-free bypass state
• Notification schedule cache

4.4 Sensitive Personal Data — expressly NOT collected

We do not collect any category of Sensitive Personal Data or Information as defined under Rule 3 of the SPDI Rules 2011, including passwords, financial information (bank details, card numbers, UPI VPA), health data, sexual orientation, medical records, biometric information, or precise geolocation.

5.Purposes of processing and legal basis

Under Sections 4 to 7 of the DPDPA 2023, personal data may be processed only for a lawful purpose for which consent has been given, or for certain "legitimate uses". The table below sets out each category we process, together with the specified purpose and the legal ground:

6.Consent

Where processing is based on consent, such consent shall be — in accordance with Section 6(1) of the DPDPA — free, specific, informed, unconditional, unambiguous, and given through a clear affirmative action. On first launch, before any personal data is processed, we present this Policy and require your affirmative acceptance.

Withdrawal. You may withdraw your consent at any time under Section 6(4) of the DPDPA by (a) uninstalling the app; (b) revoking notification permission from Android Settings; (c) resetting your Advertising ID; or (d) writing to the Grievance Officer at the address in Section 11. Withdrawal takes effect prospectively and does not affect processing carried out prior to withdrawal on the basis of the consent then given. Withdrawal of consent may materially limit or terminate your ability to use certain features of Sanatani.

7.Third-party processors (Data Processors under Section 2(k) DPDPA)

We engage the following Data Processors, each bound by contractual and technical safeguards, and each acting on our instructions in accordance with Section 8(3) of the DPDPA:

8.Cross-border transfer of personal data

Certain Data Processors listed in Section 7 store or process data outside the territory of India, including in the United States and the European Union. Such transfer is permitted under Section 16 of the DPDPA 2023 subject to any restrictions notified by the Central Government of India. As at the effective date of this Policy, no restricted country list has been notified; if one is notified, we will comply.

Each Processor employs industry-standard protection measures including encryption in transit (TLS 1.2+), encryption at rest, and independent certifications such as ISO/IEC 27001, SOC 2 Type II, and, where applicable, GDPR-standard contractual clauses.

9.Data retention

In accordance with Section 8(7) of the DPDPA, personal data is retained only for as long as necessary for the specified purposes, or as required to comply with applicable law:

10.Your rights as a Data Principal (Chapter III, DPDPA 2023)

Subject to reasonable identity verification, you have the following statutory rights:

1. Right to information (Section 11) — to obtain a summary of personal data being processed, the processing activities, and the identities of Data Processors with whom your data has been shared.
2. Right to correction and erasure (Section 12) — to request correction of inaccurate or misleading data, completion of incomplete data, and erasure of personal data that is no longer necessary.
3. Right of grievance redressal (Section 13) — see Section 11 of this Policy.
4. Right to nominate (Section 14) — to nominate any other individual to exercise your rights in the event of your death or incapacity.
5. Right to withdraw consent (Section 6(4)) — at any time, with prospective effect.
6. Right of access to public grievance mechanisms — including approaching the Data Protection Board of India under Section 27, once operational.

How to exercise your rights. Send an email to infopiyofficial@gmail.com with the subject [DPDPA] <Right requested>, quoting your anonymous Firebase User ID (visible in the app under Account → About) or, if you signed in with Google, your Google email address. We shall acknowledge your request within forty-eight (48) hours and resolve it within thirty (30) days.

Deleting your account. If you signed in with Google, you can request full deletion of your account and all associated data at our dedicated account deletion page, which lists the exact steps and the data that is deleted.

11.Grievance redressal (Section 13 DPDPA & Rule 5(9) SPDI Rules)

If your grievance is not resolved to your satisfaction, you may thereafter approach the Data Protection Board of India under Section 27 of the DPDPA 2023, or seek any other remedy available under law.

12.Data security

We implement and maintain reasonable security practices and procedures as required by Section 43A of the IT Act and Rule 8 of the SPDI Rules, including but not limited to:

• All network traffic secured with HTTPS/TLS 1.2 or higher;
• Firebase App Check (Play Integrity attestation) to protect backend endpoints from unauthorised or fraudulent clients;
• Supabase Row-Level Security (RLS) so that each Data Principal can access only their own records;
• ProGuard/R8 code obfuscation and resource shrinking on the release build;
• Screenshot and screen-recording protection (Android FLAG_SECURE) on the wallpaper preview screen;
• Android EncryptedSharedPreferences for any locally cached credentials;
• No secrets, API keys, or credentials shipped in the compiled binary;
• Principle of least privilege for third-party service access;
• Regular review of third-party dependencies against known vulnerabilities (npm audit + supply-chain audit prior to each release).

These practices meet the requirements of the internationally recognised standard IS/ISO/IEC 27001, as contemplated by Rule 8(2) of the SPDI Rules.

13.Data breach notification

In the event of a personal data breach that is likely to affect your rights, we shall notify the Data Protection Board of India and each affected Data Principal without undue delay, in the manner and form prescribed under Section 8(6) of the DPDPA 2023.

14.Advertising

Sanatani shows rewarded advertisements only — you affirmatively choose to watch an advertisement in exchange for unlocking a Daily Blessing, an additional wallpaper, or three ad-free days via the referral programme. No interstitial (forced) pop-up advertisements are shown. Advertisements are delivered by Google AdMob and are governed by Google's own privacy practices.

To opt out of personalised advertising, visit support.google.com/ads/answer/2662922 or reset the Advertising ID from Android Settings → Google → Ads.

15.Children and persons with disability (Section 9 DPDPA)

Sanatani is not directed at children under 18 years of age. Consistent with Section 9 of the DPDPA 2023, we do not knowingly process the personal data of children or of persons with disability who have a lawful guardian, without verifiable parental or guardian consent, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at such persons.

If we become aware that we have processed such data without the necessary consent, we will delete it. Parents and guardians may contact the Grievance Officer to report or request deletion.

16.Google Play Data Safety declaration mapping

Consistent with the declaration we make in the Google Play Console Data Safety form, the categories of data collected are:

Data is encrypted in transit and you can request deletion (Section 10 above).

17.Cookies and similar tracking technologies

Sanatani is a native Android application and does not use browser cookies. Certain Google Play Services SDKs (Firebase, AdMob) may use device-level identifiers as described in Section 4.

18.Automated decision-making

We do not use personal data for solely automated decision-making, profiling, or evaluation that produces legal or similarly significant effects for you, within the meaning of any applicable data protection standard.

19.Third-party links and integrations

The app may contain links to third-party platforms (e.g. Google Play, WhatsApp, Instagram) or invoke third-party sharing sheets. Such third-party services are governed by their own privacy policies and terms. We are not responsible for the privacy practices or content of any third-party service.

20.No sale of personal data

We do not sell, rent, trade, or otherwise transfer your personal data to any third party for monetary or other valuable consideration. We do not participate in cross-context behavioural advertising exchanges beyond the standard Google AdMob rewarded-ads placement described in Section 14.

21.Changes to this Policy

We may update this Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other operational reasons. Material changes will be notified in-app before they take effect. The "Last updated" and "Version" values at the top of this Policy will always reflect the latest revision. Your continued use of Sanatani after the effective date of any change constitutes fresh consent to the revised Policy under Section 6 of the DPDPA.

22.Severability

If any provision of this Policy is held to be invalid, unlawful, or unenforceable under applicable law by a competent authority, such provision shall be severed to the minimum extent necessary and the remaining provisions shall continue in full force and effect.

23.Governing law and jurisdiction

This Policy shall be governed by and construed in accordance with the laws of the Republic of India. Subject to the powers of the Data Protection Board of India and any other statutory forum, the courts and tribunals at Hyderabad, Telangana shall have exclusive jurisdiction over any dispute arising out of or in connection with this Policy.

24.Contact us