Privacy Policy

1. Who we are

सारथि Sarathi (“Sarathi”, “we”, “us”) is a mobile app for daily reflection and inner growth on the Jain path. It is available on Google Play for Android (package com.meetsarathi.app) and on the Apple App Store for iPhone.

Sarathi is developed and operated by Marudeva Creations LLP, a limited liability partnership in India. Marudeva Creations LLP is the developer named on the Google Play and Apple App Store listings. It decides why and how your personal data is processed, so under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) it is the Data Fiduciary for Sarathi.

The Sarathi name, logo, content and other intellectual property belong to Mandan Parivar Trust, which licenses them to Marudeva Creations LLP. Mandan Parivar Trust does not receive your personal data from Sarathi.

Marudeva Creations LLP
Flat No 3, Unnati Sadan, Jain Mandir Road, Daulat Nagar,
Borivali East, Mumbai 400066, Maharashtra, India
Email: hello@meetsarathi.com
Phone: +91 78620 07078

2. About this policy

This policy covers the Sarathi app and our website, meetsarathi.com. It is our notice to you under section 5 of the DPDP Act. It also serves as our privacy policy under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”).

Some parts of the Digital Personal Data Protection Rules, 2025 (the “DPDP Rules”) come into force in stages up to May 2027. We have chosen to follow them from the start.

Sarathi is offered to adults in India. Please read this policy together with our Terms & Conditions.

You can ask us for this policy in Hindi, Gujarati or any other language listed in the Eighth Schedule to the Constitution of India. Write to hello@meetsarathi.com.

3. Data we collect and why

The table below lists every kind of personal data Sarathi handles, why we need it, the legal basis we rely on under the DPDP Act, and how long we keep it. “Account deletion” means the steps described on our Delete your account page.

How we collect your data

• You give it to us when you sign up, answer the onboarding and journal questions, check in on your mood, ask a question, tap Help-Me, report a reply, send feedback or contact us. You type it, choose it, or (if you turn voice on) say it.
• Sarathi creates it from what you share, such as reflections, Karma Mirror trait reflections and your level.
• Your phone sends it automatically when you use the app: the push token, device platform, app version and connection times, and, only if you allow it, usage analytics and crash reports.
• Google Firebase tells us when your phone number or email has been verified.

We do not buy data about you or collect it from other sources.

Signing in with Google or Apple (coming soon)

Today you sign in with your phone number or your email. We plan to add Sign in with Google and Sign in with Apple. When they are available:

• Google shares your name, email address and Google account ID with us, through Google Firebase Authentication. We do not keep or use your profile photo.
• Apple shares your Apple user ID and the email you choose to share, which can be a private relay address if you pick Hide My Email. Your name is shared only if you allow it.
• We never see your Google or Apple password, and we get nothing else from those accounts: no contacts, mail, files, photos or iCloud data.
• We use these details only to create and secure your account, exactly like the sign-in details in the table above, and keep them for the same time.
• You can disconnect Sarathi at any time: delete your Sarathi account, or remove Sarathi in your Google Account under Security, Your connections to third-party apps & services, or on iPhone under Settings, your name, Sign-In & Security, Sign in with Apple.

We will update this policy and its effective date when these options go live.

4. Sensitive information and extra care

Some of what you share with Sarathi is deeply personal. We treat the following as sensitive:

• your emotional state, mood check-ins and Karma Mirror trait reflections;
• your journal entries and Ask Sarathi conversations;
• life circumstances you share, such as losing a spouse;
• your Help-Me requests; and
• your password (which only Google Firebase holds, in hashed form).

For this information we:

• collect it only with your explicit consent, given on the consent screen before any personal question;
• encrypt it in transit and at rest;
• let only a small authorised team access it, and only for the reasons in section 8, with every access logged;
• send AI providers only what is needed to write your reply (see section 6); and
• never use it for advertising, never sell it, and never use it to make decisions about you outside the app.

5. What we never do

• We never sell or rent your personal data.
• We do not show ads, and we never share your data with advertisers or data brokers.
• We do not track you across other apps or websites.
• We do not ask for your religion or caste.
• We do not collect your location, contacts, photos or advertising ID.
• We do not use your journal or chats to train AI models, and our AI providers may not either.
• We do not use Sarathi to make decisions about you that have legal or similar effects. Karma Mirror and levels are for your own reflection only.

6. How Sarathi uses AI

Sarathi uses AI language models, run by third-party AI providers, to write your daily reflections, answer your Ask Sarathi questions, find relevant passages in our library of texts, and turn speech into text. We send each provider only what its task needs.

What is sent, and to whom

• Profile details that shape a reply: your first name, age band, gender, language, life profile, level, recent mood and trait reflections.
• What they never receive: your phone number, email address, password, date of birth or account ID.
• No training: our settings and agreements with these providers do not allow them to use your data to train or improve their models. Requests sent through OpenRouter go only to hosts that do not store or train on them.
• Short-term keeping by providers: some providers may keep a request for a short time, usually no more than 30 days, only to detect abuse and keep their service secure. They then delete it.
• The same protection: each AI provider is bound by contract to protect your data at least as well as this policy does (see section 9).

Our search index (Qdrant) receives only a numeric form of your question, never your words, name or account details.

We ask your permission first

Before any of your data is sent to an AI provider, the app shows you, on its own screen, that your journal and chat text and the profile details above are shared with third-party AI providers to write your replies, names those providers, and links to this policy. Nothing is sent until you tap to agree, and the choice is never pre-ticked. Voice recordings are sent only if you also turn on “Speaking instead of typing”.

Sarathi’s reflections and answers cannot be written without this step, so it is part of the required consent described in section 7. To withdraw it, delete your account. If we ever add an AI provider or send it new kinds of data, we will update this policy and ask you again in the app first.

AI can be wrong

Sarathi’s replies are generated automatically. We use safeguards to keep them on topic and to block harmful content, but they may still be inaccurate, incomplete or unsuitable for you, and may state or attribute a teaching wrongly. They are guidance for reflection, not religious authority and not medical, psychological, legal or financial advice. Our Terms & Conditions explain this further.

Reporting a reply

If a reflection or answer seems wrong, hurtful, offensive or unsafe, please tell us:

• In the app: tap Report this reply on the reflection or answer, choose a reason and, if you like, add a note. You stay in the app.
• By email: write to hello@meetsarathi.com with the subject “Report a reply”, and include a screenshot if you can.

A report sends us the reply, the journal answer or question it responded to, and your reason and note. Only our small authorised team reads it (section 8). We review every report within 2 working days and use what we learn to improve Sarathi’s safeguards. We keep the report as shown in section 3.

7. Your consent and choices

Before Sarathi asks you anything personal, it shows a consent screen. Each choice is recorded with the date and the version you saw.

What is required and what is optional

• Your journal and your profile (required). Sarathi cannot work without processing your profile, journal and conversations as described here, including sending them to the third-party AI providers named in section 6. The consent screen says this plainly and asks you to agree. If you do not want this, please do not create an account, or delete it.
• Usage analytics and crash reports (optional, off by default). Helps us find what is broken.
• Speaking instead of typing (optional, off by default). Lets you record your voice, which is turned into text.

Nothing on the consent screen is pre-ticked, and declining an optional item never stops you using the rest of Sarathi.

Phone permissions

Sarathi asks your phone for only two permissions: notifications, to deliver your nudges, and the microphone, asked only when you first choose to speak instead of type. Both are optional, and you can turn them off at any time in your phone’s settings. Sarathi does not ask for your location, contacts, photos, camera or permission to track you.

Changing your mind

Withdrawing consent is as easy as giving it. In the app, go to Settings → Privacy → What you agreed to and switch off any optional item. You can also email hello@meetsarathi.com from your registered email, or tell us your registered phone number.

When you withdraw consent, we stop that processing within a reasonable time, tell our service providers to stop too, and erase the data collected under that consent, unless the law requires us to keep it. For example, if you turn analytics off, we delete the analytics events linked to your coded ID. Withdrawing consent does not make processing that happened before it unlawful.

To withdraw the required consent, delete your account (see section 12).

Consent Managers

The DPDP Act lets you give, manage, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India. Sarathi does not yet connect to a Consent Manager. If we add one, we will update this policy and tell you in the app.

8. Who can see your data

People at Sarathi

No one at Sarathi reads your journal or conversations as a matter of course. A small authorised team may see them only when it is needed:

• to respond to a Help-Me request you made;
• to answer a support request or complaint you sent us (we will ask you first where we can);
• to fix a technical problem, or to investigate a security issue or misuse of Sarathi; or
• when the law requires it.

Each person on this team is bound by a written duty of confidentiality, sees only what the task needs, and every access is logged and reviewed.

Service providers

Companies that run parts of Sarathi for us (section 9), including the AI providers, process data only on our instructions and under contracts that require them to give it the same protection as this policy, or better.

No one else

We do not share your data with anyone else, except where the law requires it or to protect someone’s life (see section 18).

9. Service providers we use

These companies act as our Data Processors. They may use your data only to provide their service to us, and each must give your data the same protection as this policy and Indian law require, or better. No parent, subsidiary or related organisation, including Mandan Parivar Trust, has access to your personal data.

If we add or change a provider that handles your personal data, we will update this list before the change takes effect.

10. Processing outside India

Our main database is in India (AWS Mumbai). Some providers above process data in other countries, mainly the United States. We transfer personal data only:

• to countries that the Government of India has not restricted under section 16 of the DPDP Act;
• to providers bound by contract to protect it at least as well as this policy and Indian law require; and
• where it is needed to provide Sarathi to you, with your consent.

If the Government restricts transfers to a country we use, we will stop those transfers.

11. How long we keep data

We keep personal data only as long as we need it for the purposes in this policy. The table in section 3 gives the period for each kind of data. In short:

• While your account is active, we keep your profile, journal, conversations and settings so Sarathi can work.
• When you delete your account, we erase your data from our live systems within 30 days. Copies in our encrypted backups are overwritten within 90 days. Google Firebase removes its copies of your sign-in details within 180 days, as Google states.
• If you stop using Sarathi, we treat an account as inactive after 24 months with no sign-in or use. We will send you a notice at least 30 days before we delete it, by email, app notification or SMS, using whichever contact details we have. If you do not sign in or contact us during that time, we delete the account as described above.
• What the law makes us keep. We keep a small set of records for longer only when Indian law requires it or to show that we handled your requests properly:
  • your registered phone number or email and account ID, with security logs, for up to 180 days after deletion (IT Rules 2021 and CERT-In Directions 2022);
  • processing logs for up to one year from the date of processing, once the relevant DPDP Rules apply (from May 2027);
  • records of your requests and complaints, for up to 2 years after the matter is closed; and
  • billing and tax records if you buy a paid plan, for as long as tax and accounting laws require (at present up to 8 years).
  We keep these locked away, use them only for that purpose, and delete them when the period ends. Our Delete your account page lists them in full.

Information that has been made anonymous, so that it can no longer identify anyone, such as “1,000 journals were written this week”, is not personal data and may be kept.

12. Exporting and deleting your data

• Export: in the app, go to Settings → Privacy and choose to export your data. You will get a JSON file with your profile, journal entries, reflections, Karma Mirror, Ask Sarathi history, settings and consent record.
• Delete in the app: go to Settings → Privacy → Delete account and press and hold Hold to delete. This is permanent.
• Delete without the app: write to hello@meetsarathi.com with the subject “Delete my account”, from your registered email or giving your registered phone number. You do not need to reinstall the app.
• Delete some data but keep your account: turn off analytics or voice in Settings → Privacy → What you agreed to, or email us to delete particular journal entries, conversations or other records. See Deleting some data.

Our Delete your account page explains exactly what is deleted, what is kept, and for how long.

13. How we protect your data

We follow reasonable security practices, as required by section 43A of the IT Act, the SPDI Rules and the DPDP Rules. These include:

• encrypting data in transit (HTTPS) and at rest;
• giving access only to people who need it, with strong sign-in and access logs that are kept and reviewed;
• monitoring for unauthorised access and investigating it;
• regular, encrypted backups so the service can recover from failures;
• a documented information security programme and incident response plan; and
• contracts that require our service providers to keep data secure.

No system is perfectly secure. Please keep your phone locked and your password private, and tell us at once if you think someone else has accessed your account.

14. If a data breach happens

If your personal data is affected by a breach, we will tell you without delay, through the app, by email or by SMS. We will explain in plain language:

• what happened, when, and how much data was involved;
• what it may mean for you;
• what we are doing to limit the harm;
• what you can do to protect yourself; and
• who to contact with questions.

We will also report the breach to the Data Protection Board of India, as the DPDP Rules require (first without delay, then in full within 72 hours), and to CERT-In within six hours of noticing a reportable cyber incident.

15. Your rights

Under the DPDP Act you have the right to:

• Access: get a summary of the personal data we hold about you and how we process it, and the names of other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared. The in-app export gives you a full copy.
• Correct and update: fix data that is wrong, incomplete or out of date. You can change most of your profile in the app.
• Erase: ask us to delete your data, or delete your account in the app.
• Withdraw consent: at any time, as explained in section 7.
• Grievance redressal: complain to our Grievance Officer (section 19) and get a response.
• Nominate: name a person who can exercise your rights if you die or become unable to act yourself.
• Complain to the Data Protection Board of India: if you are not satisfied with our response to your grievance.

How to make a request

Email hello@meetsarathi.com from your registered email, or give your registered phone number, and tell us what you would like. Your registered phone number or email is the identifier we use to find your account. To protect you, we may ask you to confirm the request from that email or phone. We will never ask for your password. Making a request is free.

We acknowledge requests within 24 hours and respond within 15 days. Every reply includes the contact details of our Grievance Officer.

Nominating someone

To nominate someone, email us their name, their relationship to you, and their email or phone number. If you die or become unable to act, your nominee can contact us with proof (for example a death certificate or medical certificate) and their own ID, and we will act on their request as the law allows.

Your duties

The DPDP Act also asks you to give accurate information, not to impersonate anyone, and not to file false or frivolous complaints.

16. Adults only

Sarathi is only for people aged 18 and over. We check your age once at sign-up and do not knowingly collect data from anyone under 18. If we learn that someone under 18 has created an account, we will delete the account and its data. If you think a child is using Sarathi, please tell us at hello@meetsarathi.com.

If you are the lawful guardian of an adult with a disability who would like to use Sarathi, please contact us first, so we can obtain your verifiable consent as the law requires.

17. Our website

meetsarathi.com does not use cookies, analytics or advertising trackers. Our web hosting provider keeps standard server logs (IP address, browser type, pages requested and time) to keep the site secure. Fonts are loaded from Google Fonts, so Google receives your IP address when you visit. If you email us from the website, we handle your message as described for support in section 3.

18. When we may disclose data

• When the law requires it: we disclose personal data to a government authority or court only when Indian law or a valid legal order requires it, and only what is required. Unless the law forbids it, we will tell you.
• To protect life: if we believe someone’s life or health is in immediate danger, we may share the minimum information needed with emergency services.
• If Sarathi changes hands: if Sarathi is transferred to another organisation (for example as part of a restructuring), your data would move only under the same protections. We will tell you in advance, so that you can export your data or delete your account if you wish.

19. Grievance Officer and contact

For any question, complaint or request about your personal data, contact our Grievance Officer. This is also the person who answers on our behalf about the processing of your data under the DPDP Rules.

Grievance Officer: Project Coordinator, Sarathi
Marudeva Creations LLP
Flat No 3, Unnati Sadan, Jain Mandir Road, Daulat Nagar,
Borivali East, Mumbai 400066, Maharashtra, India
Email: hello@meetsarathi.com
Phone: +91 78620 07078

We acknowledge every grievance within 24 hours and resolve it within 15 days of receiving it.

If you are not satisfied with our response, you may complain to the Data Protection Board of India, using the process the Board publishes. The DPDP Act asks you to contact us first, so we have the chance to put things right.

20. Changes to this policy

We may update this policy when Sarathi or the law changes. If a change is significant, we will tell you in the app at least 15 days before it takes effect. Where the law needs your fresh consent, we will ask for it and will not apply the change to you until you agree. The version and effective date at the top of this page always show the current policy.

Version 1.1. Effective 17 October 2026.