Privacy Policy

Effective: 2026-05-24 Version: 1.0 App: Esha Operator (Data Fiduciary under DPDP 2023 / Data Controller under GDPR): Solo individual (not a company). Operator legal name: Phanidhar Rao Madduri (sole proprietor), India. Operator country of residence: India. Primary regulatory framework: India Digital Personal Data Protection Act, 2023 (DPDP). Additionally applicable: EU General Data Protection Regulation 2016/679 (GDPR) for EU/EEA visitors; UK GDPR + Data Protection Act 2018 for UK visitors; California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) for California residents. Privacy contact (Data Protection Officer / Grievance Officer under DPDP §10): privacy@askesha.com (operator-monitored mailbox; replies issued from this address within the SLAs in §17). Public account-deletion page: https://askesha.com/delete-account

1. Plain-English summary

This summary is informational only; the sections below control if there is any conflict.

2. Who Esha is

Esha is operated by Phanidhar Rao Madduri (sole proprietor), a solo individual based in India. References to "Esha," "we," "us," or "our" mean that operator and any service providers acting on the operator's behalf. There is no company, partnership, or limited-liability entity behind Esha at version 1.0. The operator is the Data Fiduciary under India DPDP 2023 §2(i), and the Data Controller under GDPR Art. 4(7) / UK GDPR / CCPA-CPRA "business".

The operator is also the named Grievance Officer for DPDP §10 purposes; complaints under DPDP, GDPR data-subject rights requests, UK GDPR DSARs, and CCPA "right to know / delete / opt-out" requests all reach the same address listed at the top of this document.

If Esha later becomes operated by a legal entity, an acquirer, or a successor, this Privacy Policy will be updated and you will be notified before that change takes effect.

3. What we collect

We collect only what we need to run the product. Each row below maps to a real field in our database; nothing on this list is hypothetical.

We do not collect: phone numbers, contact lists, photos, microphone or camera input, current GPS location, Apple Health or Google Fit data, browsing history outside Esha, payment-card numbers, government IDs, or biometric data.

We do not use third-party advertising or analytics SDKs at version 1.0.

First-party usage telemetry (server-side analytics): Esha collects a curated allowlist of telemetry events — for example, today_screen_viewed, pillar_opened, chat_message_sent, paywall_viewed, subscription_purchase_initiated — linked to your user_id. The full allowlist lives in backend/main.py under TELEMETRY_EVENT_ALLOWLIST and is also visible to App Store / Google Play reviewers on request. The data is used to (a) measure feature adoption, (b) detect breakages (e.g. a screen that nobody can open), (c) inform product decisions. It is NEVER sold, NEVER shared with any third-party analytics service, and is silently dropped for users who opt out via Profile → Privacy. The default is off (opt-in only, per GDPR Art. 7(2)). See §10 (Retention) for storage duration.

4. Why we use it (purpose limitation)

We do not use your data for automated decisions that produce legal or similarly significant effects. Esha's outputs are reflective content, not determinations.

5. AI processing — what OpenAI sees

Esha uses OpenAI to generate chat responses and structured interpretations.

When you chat with Esha, we send OpenAI:

• Your message
• Up to ten recent prior messages from the same conversation
• Up to three short summaries of your previous conversations (top topics, emotional tone, decisions, follow-up hooks, prose summary) — so Esha can pick up where you left off rather than starting cold
• Auto-extracted life-event tags relevant to your profile (career change, relationship, loss, etc.)
• A compact, redacted snapshot of your chart (planetary placements, current dasha, the houses relevant to your question)
• A system prompt that instructs the model how to behave
• A response contract requiring the model to ground its reply in your chart

What we do not send to OpenAI:

• Your email address
• Your password (it is hashed and never leaves our database)
• Numeric strength scores from internal calculations (these are redacted before transmission)
• Crash diagnostics

OpenAI processes these inputs to produce a reply and may retain limited request metadata for safety, abuse prevention, and reliability under its own privacy terms. We do not control OpenAI's infrastructure.

Two important properties of how we use the model:

1. Output validation. Every AI reply passes through a deterministic fact validator before you see it. The validator rejects answers that misplace a planet, misidentify a karaka, or promise a specific date for marriage, childbirth, death, or disease. Failed validations trigger a regeneration. This does not eliminate AI mistakes — it constrains them.
2. Hard refusals. Requests for medical diagnosis, legal advice, financial advice, the date of someone's death, exact marriage timing, fertility prediction, or harm to another person are refused before they reach the model.

You should not submit information to Esha that you do not want processed by an AI provider.

6. Third-party services we actually use

We do not use Mixpanel, Amplitude, Firebase Analytics, PostHog, Google Analytics, or any other analytics SDK at version 1.0. We do not embed advertising SDKs of any kind. If we add any of these in the future, this Privacy Policy will be updated and you will be notified in-app before the change takes effect.

7. Data retention

When you delete your account, every row tied to your user_id in the tables listed in Section 3 is removed in a single database transaction, except backup snapshots which roll off naturally and aggregated cost totals where required for fraud and accounting purposes.

8. Your rights

We respond to verifiable rights requests within 30 days, or sooner where required by local law. We may need to verify your identity before fulfilling sensitive requests.

9. Account deletion

You can delete your account in three ways:

1. In-app: Settings → Delete account (calls DELETE /api/v1/user).
2. Web: https://askesha.com/delete-account.
3. Email: the privacy contact below; we will verify and delete within 30 days.

Deleting your account does not cancel a paid subscription. Subscriptions are managed by Apple, Google, or RevenueCat under their own rules. To stop being billed, cancel the subscription in your App Store or Google Play account before deleting your Esha account.

After deletion, we retain only what is strictly necessary: aggregated cost-accounting totals, fraud signals, and backup snapshots that roll off naturally. We do not keep your chat content or birth profiles after deletion completes.

10. Children and minors (DPDP §9 / GDPR Art. 8 / COPPA)

Esha is intended for users 18 years of age and older. The app enforces this floor at registration: you cannot create an account if your supplied date of birth indicates you are under 18.

The 18-year floor is a single global rule that satisfies three independent regimes:

If a parent or guardian believes a person under 18 has nonetheless created an account (for example, by providing an inaccurate date of birth), please contact the privacy address at the top of this document and we will delete the account and all associated data.

Esha does not produce content intended to be sexual, exploitative, manipulative, or upselling toward minors. The app does not give marriage, fertility, or death timing for any user — adult or otherwise.

11. International transfers

Esha's production servers are hosted on Railway, in the US region. If you use Esha from outside the US — including from the EU, the UK, India, or anywhere else — your data is transferred to and processed in the US.

Specific transfer mechanisms by jurisdiction:

Sub-processors listed in Section 6 transfer and process data under their own contractual safeguards. Specifically:

• OpenAI: US-based; DPA at https://openai.com/policies/data-processing-addendum executes the EU SCCs Module 2 (controller-to-processor) and UK Addendum on the operator's behalf.
• Railway: US-based; provides DPA + SCCs to its customers under its Terms of Service.
• Apple App Store / Google Play / RevenueCat: US-based; each maintains its own privacy posture for billing flows that the operator does not control.
• Razorpay: India-based payment processor used for web-subscription billing on app.askesha.com. Card data is processed by Razorpay under PCI-DSS; Razorpay processes payment details under its own privacy policy (https://razorpay.com/privacy/) and the operator's merchant agreement. As an India-resident processor, Razorpay does not introduce an additional cross-border transfer for India-based users.
• Sentry (if enabled): US-based; DPA available at https://sentry.io/legal/dpa/.
• Expo Push (Apple APNs / Google FCM): Push tokens transit through Apple/Google infrastructure under their own terms.

12. Security

We use:

• TLS for all traffic in transit
• bcrypt password hashing (we never see your plaintext password after the moment you create or change it)
• JWT-based session authentication with bounded lifetimes
• Environment-isolated secrets (the JWT signing key is required to be present in production; the application will refuse to boot otherwise)
• An admin endpoint guard requiring a separate admin token in production
• Per-user daily message and AI-cost caps to prevent abuse
• A deterministic AI output validator that blocks fact hallucinations and deterministic event-timing claims before they reach you

No system is completely secure. If we become aware of a personal-data breach affecting you, we will notify the relevant supervisory authority within the time window required by applicable law (72 hours under GDPR / UK GDPR for qualifying breaches) and notify affected users where the law requires direct notice.

You are responsible for the security of your device, your email account, your app-store account, and your Esha password.

13. AI accuracy and the nature of astrology

Esha is a reflective astrology product. Three things you must understand:

1. AI outputs may be wrong. Even with our validation layers, AI replies may be inaccurate, incomplete, biased, outdated, or unsuitable for your situation.
2. Astrology is not deterministic. Esha gives windows of activation and reflective patterns, never calendar guarantees. We block the model from claiming a specific date for marriage, childbirth, death, or disease, and we refuse user requests for that kind of prediction.
3. Esha is not professional advice. It is not medical, legal, financial, or psychological advice. For any of those, see a licensed professional.

14. Crisis and safety

If you tell Esha you are thinking about self-harm or suicide, the app will replace the astrology reply with a crisis response that lists helplines (US 988, UK Samaritans, India Tele MANAS, and a global pointer to local emergency services). The app cannot replace emergency services. If you are in immediate danger, call your local emergency number.

We do not share crisis-detection metadata with third parties.

15. No sale, no targeted advertising

We do not sell personal data. We do not run third-party ads. We do not share birth data, chat content, or chart data with anyone for advertising purposes. If this changes, we will update this Privacy Policy and obtain any consent required by law before the change takes effect.

16. Changes to this policy

We may update this Privacy Policy. The effective date at the top of the document changes when we do. Material changes — for example, adding a new third-party processor, changing retention defaults, or starting to use data for a new purpose — will be communicated in-app, or by an email to your account address, before the change takes effect.

17. Contact

For privacy questions, rights requests, or deletion requests: privacy@askesha.com

The operator is the named Grievance Officer for the purposes of DPDP 2023 §10 and the Data Protection Officer equivalent for other jurisdictions. Verifiable rights requests will be acknowledged within 7 days and completed within the timelines required by the applicable law (typically 30 days under GDPR Art. 12(3) / DPDP 2023 §11(2); 45 days under CCPA §1798.130(a)(2)).

If you do not receive a reply within 30 days, you may contact your local data-protection authority. For India users specifically, the Data Protection Board of India (https://www.dpb.gov.in once notified into operation under DPDP §28). For EU users, the supervisory authority of your member state of habitual residence (list at https://edpb.europa.eu/about-edpb/about-edpb/members_en). For UK users, the Information Commissioner's Office (https://ico.org.uk). For California residents, the California Privacy Protection Agency (https://cppa.ca.gov).