Esha Privacy Policy

Effective: 19 August 2026 App: Esha Operator (Data Fiduciary under DPDP 2023): Solo individual (not a company). Operator legal name: Phanidhar Rao Madduri (sole proprietor), India. Operator country of residence: India. Primary regulatory framework: India Digital Personal Data Protection Act, 2023 (DPDP). Service area: Esha is not offered to individuals in the EU/EEA, the United Kingdom, or Switzerland — account creation from those regions is blocked (see §11). For California residents, the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) applies to the extent its thresholds and provisions are applicable to the operator. Privacy contact (grievance redressal under DPDP §8(10) and §13; Data Protection Officer equivalent): privacy@askesha.com (operator-monitored mailbox; replies issued from this address within the SLAs in §17). Esha has not been notified as a Significant Data Fiduciary under DPDP §10; a designated DPO is a §10 obligation for notified fiduciaries, and we provide one voluntarily.

Where DPDP enforcement stands (honest framing): the DPDP Act received assent on 11 August 2023, and the DPDP Rules, 2025 were notified on 14 November 2025. Under the phased commencement (Rule 1 of the Rules and the corresponding Act notifications), the substantive obligations — notice, consent, security safeguards, breach notification, children's data, and data-principal rights — come into force eighteen months after publication, i.e. around May 2027. Until then, the legally operative Indian data-protection floor is the IT Act, 2000 (§43A) and the SPDI Rules, 2011. This policy states DPDP-aligned commitments now, voluntarily and ahead of that date, and we treat them as binding promises by the operator rather than as descriptions of currently mandatory law. Public account-deletion page: https://askesha.com/delete-account

1. Plain-English summary

This summary is informational only; the sections below control if there is any conflict.

2. Who Esha is

Esha is operated by Phanidhar Rao Madduri (sole proprietor), a solo individual based in India. References to "Esha," "we," "us," or "our" mean that operator and any service providers acting on the operator's behalf. There is no company, partnership, or limited-liability entity behind Esha at version 1.0. The operator is the Data Fiduciary under India DPDP 2023 §2(i). Esha is not offered to individuals in the EU/EEA, the UK, or Switzerland, and the operator does not designate itself a controller under those regimes; for California residents, CCPA/CPRA applies to the extent applicable.

The operator is also the named contact for grievance redressal under DPDP §8(10) and §13; complaints under DPDP and CCPA "right to know / delete / opt-out" requests all reach the same address listed at the top of this document.

If Esha later becomes operated by a legal entity, an acquirer, or a successor, this Privacy Policy will be updated and you will be notified before that change takes effect.

3. What we collect

We collect only what we need to run the product. Each row below maps to a real storage location in our database or with a named processor; nothing on this list is hypothetical.

We do not collect: phone numbers, contact lists, photos, microphone or camera input, current GPS location, Apple Health or Google Fit data, browsing history outside Esha, payment-card numbers, government IDs, or biometric data.

We do not use third-party advertising SDKs, or any analytics SDK that tracks you individually or across sites. We use Vercel Web Analytics — cookieless, first-party, aggregate page metrics only; see §6.

First-party usage telemetry (server-side analytics): Esha collects a curated allowlist of telemetry events — for example, today_screen_viewed, pillar_opened, chat_message_sent, paywall_viewed, subscription_purchase_initiated — linked to your user_id. The full allowlist lives in backend/main.py under TELEMETRY_EVENT_ALLOWLIST and is also visible to App Store / Google Play reviewers on request. The data is used to (a) measure feature adoption, (b) detect breakages (e.g. a screen that nobody can open), (c) inform product decisions. It is NEVER sold, NEVER shared with any third-party analytics service, and is silently dropped for users who switch it off via Profile → Privacy. During the beta the default for NEW accounts is on, disclosed at the point of signup; switching it off stops collection immediately. Accounts created before 17 August 2026 keep their earlier default (off unless they opted in). See §10 (Retention) for storage duration.

4. Why we use it (purpose limitation)

One account-level AI choice

Esha has one optional account-level AI features decision. If you allow AI, it covers the purposes itemised before you decide: OpenAI-written Life Blueprint and personalised-reading prose (including optional daily and forecast wording), OpenAI Chat answers, and Google Gemini safety checks for Chat. If you continue without AI, deterministic chart facts remain available and no AI request is made. A changed notice is treated as no current consent until you decide again. You may withdraw at any time in Profile.

Using your chart to tailor AI-written reflective content is a form of profiling. It does not make automated decisions that produce legal or similarly significant effects.

5. AI processing — what OpenAI and Google Gemini see

Esha uses OpenAI to generate chat responses and structured interpretations. Esha also uses Google Gemini as a separate safety processor to classify the current request and screen the draft reply before it is shown.

When you chat with Esha, we send OpenAI:

• Your message
• Up to ten recent prior messages from the same conversation
• Up to three short summaries of your previous conversations (top topics, emotional tone, decisions, follow-up hooks, prose summary) — so Esha can pick up where you left off rather than starting cold
• Auto-extracted life-event tags relevant to your profile (career change, relationship, loss, etc.)
• A compact, redacted snapshot of your chart (planetary placements, current dasha, the houses relevant to your question)
• A system prompt that instructs the model how to behave
• A response contract requiring the model to ground its reply in your chart

When the current AI features consent is granted and Blueprint prose is requested, Esha may asynchronously send OpenAI a bounded chart-derived verdict for each available Blueprint area (for example, the area label, support/challenge band, confidence, cited chart witnesses, and permitted plain-language meanings) to write its headline and body. This worker does not send your email, password, profile name, raw birth date/time/place, chat history, or stored conversation summaries. Consent is checked again immediately before every provider request; withdrawing it blocks the next request, although a request already in flight cannot be recalled. Its response is discarded and cannot become visible or be checkpointed.

For other personalised readings, Esha may send OpenAI a bounded subset of the same derived chart facts, including relevant placements, verdicts, witnesses, and current timing facts, to phrase pillar, daily, or forecast prose. These requests do not add your email, password, profile name, raw birth details, or Chat history. Without current AI consent, Esha uses deterministic engine facts and does not send this reading request.

What we do not send to OpenAI:

• Your email address
• Your password (it is hashed and never leaves our database)
• Numeric strength scores from internal calculations (these are redacted before transmission)
• Crash diagnostics

OpenAI processes these inputs to produce a reply and may retain limited request metadata for safety, abuse prevention, and reliability under its own privacy terms. We do not control OpenAI's infrastructure.

For each chat safety check, we send Google Gemini only:

• Your current message
• A selected, bounded portion of your recent user and assistant messages needed to understand references
• The draft reply for the final pre-release safety check
• Safety instructions and a structured response contract

We do not add your email address, password, stored birth details, chart snapshot, planetary evidence, internal profile identifiers, or stored conversation summaries to Google safety requests. The selected conversation portion can include prior assistant replies when they are needed to understand your current message. Information you type in a message is included in that message. Google is used for safety classification, not to write your astrology reading. Esha uses the paid Gemini API. Under Google's paid-service terms, prompts and responses are not used to improve Google's products, although Google may log them for a limited period for abuse prevention, security, and legal compliance. We do not opt chat data into feedback datasets or model-improvement sharing.

Two important properties of how we use the model:

1. Output validation. Every AI reply passes through an automated safety layer before you see it. Replies that would name a specific date for marriage, childbirth, death, or disease are blocked and replaced with a safe response that frames life timing as windows and tendencies. This reduces, but does not eliminate, AI mistakes.
2. Layered refusals. Requests for medical diagnosis, legal advice, financial advice, the date of someone's death, or harm to another person are designed to be refused before they reach the model. Questions about life timing such as marriage or children are answered as windows or tendencies rather than dates. No automated safety layer is perfect; treat every reply as reflection, not instruction.

You should not submit information to Esha that you do not want processed by an AI provider.

6. Third-party services we actually use

We do not use Mixpanel, Amplitude, Firebase Analytics, PostHog, Google Analytics, or any other tracking-based analytics SDK. We do not embed advertising SDKs of any kind. If we add any of these in the future, this Privacy Policy will be updated and you will be notified in-app before the change takes effect.

7. Data retention

When you delete your account, every row tied to your user_id in the tables listed in Section 3 is removed in a single database transaction, except backup snapshots which roll off naturally, aggregated cost totals where required for fraud and accounting purposes, and subscription billing-lifecycle events (subscription_events), which are retained for legal/accounting compliance as stated in the retention table above and §9.

8. Your rights

We respond to verifiable rights requests within 30 days, or sooner where required by local law. (The DPDP Rules, 2025 will allow data fiduciaries up to ninety days once in force — our 30-day commitment is deliberately stricter and is the one we hold ourselves to.) We may need to verify your identity before fulfilling sensitive requests.

9. Account deletion

You can delete your account in three ways:

1. In-app: Settings → Delete account (calls DELETE /api/v1/user).
2. Web: https://askesha.com/delete-account.
3. Email: the privacy contact below; we will verify and delete within 30 days.

Deleting your account does not cancel a paid subscription. Subscriptions are managed by Apple, Google, or RevenueCat under their own rules. To stop being billed, cancel the subscription in your App Store or Google Play account before deleting your Esha account.

After deletion, we retain only what is strictly necessary: aggregated cost-accounting totals, fraud signals, subscription billing-lifecycle records (see §7 — retained for legal/accounting compliance; numeric IDs and gateway identifiers only, no name/email/content), and backup snapshots that roll off naturally. We do not keep your chat content or birth profiles after deletion completes.

10. Children and minors (DPDP §9 / GDPR Art. 8 / COPPA)

Esha is intended for users 18 years of age and older. The app enforces this floor at registration: to create an account you must confirm that you are 18 or older. We do not collect a full date of birth purely to age-gate — your birth date is collected later, only as the input to your astrological chart.

The 18-year floor is a single global rule that satisfies three independent regimes:

If a parent or guardian believes a person under 18 has nonetheless created an account (for example, by giving an inaccurate age confirmation), please contact the privacy address at the top of this document and we will delete the account and all associated data.

Esha does not produce content intended to be sexual, exploitative, manipulative, or upselling toward minors. The app does not give marriage, fertility, or death timing for any user — adult or otherwise.

11. International transfers

Esha is not offered to users in the European Union, the European Economic Area, the United Kingdom, or Switzerland; account creation from those regions is blocked (app-store availability, marketing, and a signup geo-fence are all scoped accordingly). The GDPR / UK-GDPR mechanisms described below are retained purely as a matter of good practice for any data that nonetheless reaches us; they are not an offer of service to, or an assumption of controller obligations for, those regions.

Esha's production servers are hosted on Railway, in the US region. If you use Esha from outside the US — including from the EU, the UK, India, or anywhere else — your data is transferred to and processed in the US.

Specific transfer mechanisms by jurisdiction:

Sub-processors listed in Section 6 transfer and process data under their own contractual safeguards. Specifically:

• OpenAI: US-based; DPA at https://openai.com/policies/data-processing-addendum executes the EU SCCs Module 2 (controller-to-processor) and UK Addendum on the operator's behalf.
• Google Gemini API: Google processes paid-service prompts and responses under its Data Processing Addendum and does not use them to improve its products. Limited abuse-prevention logging may occur under the Gemini API terms.
• Railway: US-based; provides DPA + SCCs to its customers under its Terms of Service.
• Apple App Store / Google Play / RevenueCat: US-based; each maintains its own privacy posture for billing flows that the operator does not control.
• Razorpay: India-based payment processor used for web-subscription billing on app.askesha.com. Card data is processed by Razorpay under PCI-DSS; Razorpay processes payment details under its own privacy policy (https://razorpay.com/privacy/) and the operator's merchant agreement. As an India-resident processor, Razorpay does not introduce an additional cross-border transfer for India-based users.
• Sentry (if enabled): US-based; DPA available at https://sentry.io/legal/dpa/.
• Expo Push (Apple APNs / Google FCM): Push tokens transit through Apple/Google infrastructure under their own terms.

12. Security

We use:

• TLS for all traffic in transit
• bcrypt password hashing (we never see your plaintext password after the moment you create or change it)
• JWT-based session authentication with bounded lifetimes
• Environment-isolated secrets (the JWT signing key is required to be present in production; the application will refuse to boot otherwise)
• An admin endpoint guard requiring a separate admin token in production
• Per-user daily message and AI-cost caps to prevent abuse
• An always-on, deterministic output screen that blocks AI replies naming a specific date for marriage, childbirth, death, or disease before they reach you

No system is completely secure. If we become aware of a personal-data breach affecting you, we will notify the relevant authorities and affected users within the time windows required by applicable law:

• EU / UK GDPR: the relevant supervisory authority within 72 hours of becoming aware, for qualifying breaches, and affected users without undue delay where the breach is likely to result in a high risk to their rights.
• India — DPDP Act 2023 (§8(6)) and DPDP Rules 2025 (Rule 7): every affected user is informed without delay, in plain language, with a description of the breach, its likely impact, the protective steps you can take, and a contact for help; the Data Protection Board of India receives a description of the breach without delay and updated details within 72 hours of our becoming aware (extendable only by the Board on written request). India's regime has no severity threshold, so we give intimation of each personal-data breach, not only high-risk ones. (These provisions formally commence with the substantive DPDP core — around May 2027 — and we follow them voluntarily until then.)
• India — CERT-In Directions (2022): where the breach is a reportable cyber-security incident, we report it to CERT-In within 6 hours of becoming aware.

You are responsible for the security of your device, your email account, your app-store account, and your Esha password.

13. AI accuracy and the nature of astrology

Esha is a reflective astrology product. Three things you must understand:

1. AI outputs may be wrong. Even with our validation layers, AI replies may be inaccurate, incomplete, biased, outdated, or unsuitable for your situation.
2. Astrology is not deterministic. Esha gives windows of activation and reflective patterns, never calendar guarantees. We screen the model's output for, and regenerate or replace, replies that claim a specific date for marriage, childbirth, death, or disease, and we refuse direct requests for the date of someone's death and for medical, legal, or financial determinations. These checks reduce but do not eliminate the risk of an over-confident reply.
3. Esha is not professional advice. It is not medical, legal, financial, or psychological advice. For any of those, see a licensed professional.

14. Crisis and safety

If you tell Esha you are thinking about self-harm or suicide, the app will replace the astrology reply with a crisis response that lists helplines (US 988, UK Samaritans, India Tele MANAS, and a global pointer to local emergency services). The app cannot replace emergency services. If you are in immediate danger, call your local emergency number.

We do not share crisis-detection metadata with third parties.

15. No sale, no targeted advertising

We do not sell personal data. We do not run third-party ads. We do not share birth data, chat content, or chart data with anyone for advertising purposes. If this changes, we will update this Privacy Policy and obtain any consent required by law before the change takes effect.

16. Changes to this policy

We may update this Privacy Policy. The effective date at the top of the document changes when we do. Material changes — for example, adding a new third-party processor, changing retention defaults, or starting to use data for a new purpose — will be communicated in-app, or by an email to your account address, before the change takes effect.

17. Contact

For privacy questions, rights requests, or deletion requests: privacy@askesha.com

The operator is the named contact for grievance redressal under DPDP 2023 §8(10) and §13, and the Data Protection Officer equivalent for other jurisdictions (a designated DPO is formally a Significant-Data-Fiduciary obligation under §10; Esha is not one, and provides this contact voluntarily). Verifiable rights requests will be acknowledged within 7 days and completed within the timelines required by the applicable law (typically 30 days under GDPR Art. 12(3) / DPDP 2023 §11(2); 45 days under CCPA §1798.130(a)(2)).

If you do not receive a reply within 30 days, you may contact your local data-protection authority. For India users specifically, the Data Protection Board of India — established November 2025 as a digital-first Board: complaints can be filed online through its portal, and appeals against its decisions lie to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). For EU users, the supervisory authority of your member state of habitual residence (list at https://edpb.europa.eu/about-edpb/about-edpb/members_en). For UK users, the Information Commissioner's Office (https://ico.org.uk). For California residents, the California Privacy Protection Agency (https://cppa.ca.gov).

18. Free tools (no signup)

askesha.com/tools offers free birth-chart, kundli-matching, Mangal dosha, panchang, nakshatra, and dasha calculators that anyone can use without creating an account. These tools work differently from the rest of Esha: your birth details are computed in memory and never saved. The one exception is the birth place you type: to turn it into map coordinates, that place name alone is sent server-side to OpenStreetMap's Nominatim geocoder (see §6) — never your name, date, or time. Standard server logs (IP address, timestamp — no birth data) are kept briefly for abuse prevention, the same as any web request to our servers. No profile, chat history, or account record is created from using a free tool. If you choose to continue from a free tool into a paid report, only an opaque, short-lived draft identifier travels to checkout — never your birth date, time, place, or name in the URL or in your browser's storage; that draft expires automatically and is not linked to your identity unless you create an account. A newsletter form shown near a free tool is separate: it sends only the email address and short page-source label you submit to Brevo after you separately choose to subscribe; it never sends or saves the birth details entered in the tool.

19. Data you provide about others

Some features — adding a family member's profile, or buying a Compatibility Report for you and a partner — require you to enter someone else's birth details (name, date, time, place). When you do this:

• You confirm you have that person's permission to share their birth details with Esha for this purpose. The Compatibility Report checkout requires an explicit attestation checkbox ("I have this person's permission to use their birth details") before the purchase can proceed, and we record that you attested, and when. The same confirmation is now required on every other path that accepts another person's birth details, including the free ones — a free compatibility reading in the app, and the free kundli-matching tool on askesha.com when you continue from it towards a report — and we refuse the request without it.
• Processing basis: we rely on the permission you attest to, together with our legitimate interest in delivering the report you paid for. This basis is under review as part of our India entity setup; we will update this section if that review changes it — we do not claim more legal certainty here than we currently have.
• Minimization: for a one-time Compatibility Report, the partner's birth details are retained only long enough to generate the report and for the report link's lifetime — we do not create a separate profile or account for the partner, and we do not reuse their details for anything else. The rendered report itself shows only the partner's first name and chart placements — never their full birth date, time, or place.
• Their rights: the person whose details you entered can ask us to erase that data by contacting privacy@askesha.com (or asking you, the account holder, to request deletion on their behalf) — §8 (Your rights) and §9 (Account deletion) apply the same way to data you entered about someone else.
• Family profiles work the same way: only enter another person's birth details with their permission (or, for a minor in your care, your own authority to do so), consistent with §10.