Privacy Policy

Grahachara ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service"). Please read this policy carefully.

1 Information We Collect

1.1 What you tell us

When you sign in and use the Service, we collect:

• Account: your name and the email address of the Google or Apple account you sign in with, and your profile picture if you upload one.
• Birth details: your date, time and place of birth. These are the whole basis of every reading.
• About you, when you choose to add it: gender, relationship status, work, life events you record, your answers to the ten personality questions, and the optional religion you pick for a report.
• Other people's birth details that you enter yourself, for a compatibility match, a partner portrait or a baby's chart.
• What you ask and how you rate it: your questions and their answers, your nightly rating of the day, and your answers about whether a prediction came true.
• Palm photos, when you ask for a palm reading. The photo itself is never stored. We do not keep it, but it is sent to the AI service that reads it (see section 4), and Google keeps what Gemini receives for up to 55 days to check for abuse, where flagged material may be looked at by its staff. What we keep is your written reading, a description of what was seen on your hand (its shape and which lines were found), where the mounts sit on the photo as positions, and a hash of the image so the same photo is not charged twice. For a deep reading, a copy of your photo with the lines drawn on it is sent back to your phone. We do not store that copy. The app keeps it on your phone so it is there when you reopen the reading, and removes it when you sign out.
• Messages you send us through Send feedback, and the phone number you give us if you ask for access over WhatsApp (Android only).
• Payment: which plan you bought, from Apple or Google. Card numbers never reach us; the stores handle payment.
• If you buy over WhatsApp by bank transfer: your WhatsApp number, your messages, the birth details you send, and the photo of your payment slip. The slip image goes to the owner's WhatsApp and we do not copy it to our servers. We keep what is read from it, such as the amount and reference, and a hash of the image so the same slip cannot be used twice.
• Preferences: language, notification settings, and whether you allow offers.

1.2 Collected automatically

• Device: an installation identifier we generate, your push notification token, device type, app version and platform.
• Usage: which screens you open, when you open the app, and which offers you were shown.
• Where your install came from (Android): the Google Play install referrer, which tells us whether you came from an ad, a shared link or an ordinary store visit. If the link carried them, this includes its source, medium, campaign and content tags and an ad click identifier (gclid).
• Where you are, roughly: the time zone your device reports, or the city you pick yourself. The app never asks for or uses GPS, so we have no precise location.
• Ordinary server logs, which record the requests your app makes, including the address it came from.

1.3 What we never collect

We do not collect your contacts, the messages on your phone, your browsing history, your health or fitness records, your precise location, or any advertising identifier. There is no advertising or attribution software in the app, and we do not track you across other apps or websites. The install referrer above tells us only about the link you arrived from.

1.4 Sensitive details

Some of what you give us can be sensitive: the religion you pick for a report, a question about your health or your relationship, details about a child, and what was seen on your hand in a palm reading. We use these only to write what you asked for, and we rely on your consent to do so.

2 How We Use Your Information

We use the information we collect to:

• Provide personalized Vedic astrology readings, birth charts, and Porondam reports.
• Calculate accurate Rahu Kalaya, Nakath times, and planetary transits for your location.
• Send daily horoscope notifications and auspicious time alerts (with your consent).
• Process subscriptions and manage your account.
• Improve and optimize the Service's features and user experience.
• Respond to customer support inquiries.
• Comply with legal obligations.

Our legal grounds are your consent (AI-written readings, sensitive details, notifications and offers), our contract with you (providing what you signed up for or bought), and our legal obligations (such as keeping purchase and tax records). You can withdraw consent at any time, as section 6 explains.

3 Data Storage & Security

Your data is held in Google Firebase (Cloud Firestore and Cloud Storage), and the app's own server runs on Amazon Web Services. In practice that means:

• Google encrypts what is stored, as standard, on its own infrastructure.
• Everything the app sends travels over HTTPS.
• Access to the database is restricted to the accounts that run the Service, and reading another person's data is refused by the database's own rules.

Your data leaves Sri Lanka

The app's server runs on Amazon Web Services in India. Google, Anthropic and the other companies listed in section 4 may handle your data in other countries, including the United States. The Service cannot work without them. Before your details go to the AI services, the app asks for your consent.

4 Data Sharing & Disclosure

We do not sell your personal data, and we do not share it for anyone's advertising. It is shared only here:

• Anthropic Claude and Google Gemini, which the app calls Grahachara AI. Grahachara works out your chart itself, with its own astronomical engine. The words are written by these two AI services. Claude usually writes paid reports, compatibility reports and Pro chat, Gemini usually writes the rest, including deep palm readings, and either can take over when the other is unavailable. To write them we send your name, your birth details, the other details you have added about yourself, details you enter about other people, your questions, and your palm photos when you ask for a palm reading. No person reads your chart. There is no astrologer. The app asks your permission before any of this is sent, and you can withdraw it at any time in Profile; readings cannot be written while it is withdrawn.
• The companies that run the Service: Google Firebase (sign-in, database, file storage), Amazon Web Services (hosting), RevenueCat (managing subscriptions), Apple and Google (payment), Expo (delivering push notifications), PostHog (usage statistics), and Resend (sending you email such as a receipt or a notice).
• OpenStreetMap, when you search for your birth city: the words you type are sent to look the place up. Place data is © OpenStreetMap contributors.
• Telegram, which is how a message you send through Send feedback, or a WhatsApp access request, reaches us.
• WhatsApp, run by Meta, if you message us there. Our automatic replies are written by the AI services above, which also read your payment slip. A person checks every payment before anything is delivered.
• When the law requires it, or to establish or defend a legal claim.
• If the Service is ever sold or transferred, in which case you will be told before anything moves.

5 Third-Party Services

What each one does, and what it sees:

• Google Firebase: signs you in, stores your account and readings, and holds your profile picture and any partner portrait.
• Anthropic Claude and Google Gemini: write the readings, as described above.
• Amazon Web Services: runs the server that does the astronomical calculations.
• RevenueCat, with Apple and Google: handles subscriptions and purchases. They see a purchase identifier, never your chart.
• Expo: delivers push notifications to your device.
• PostHog: counts how features are used. This is sent from our server, not from your phone.
• Resend: sends email we owe you.
• OpenStreetMap: answers birth-city searches.
• Telegram: carries your support messages to us.
• WhatsApp: carries your messages and payment slip if you buy or ask for help there.

Each has its own privacy policy, and we encourage you to read them. Sharing a reading to Facebook, Instagram, TikTok or WhatsApp happens only when you tap share, and then only what you chose to share.

6 Your Rights

You have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate information.
• Deletion: Delete your account yourself, in the app: Profile › Delete account. You do not have to ask us. See Delete your account for exactly what goes.
• Portability: Receive your data in a portable format.
• Opt-Out: Turn off offers and any notification in Profile, at any time.
• Withdraw consent: Turn off "Grahachara AI" in Profile and nothing more of yours is sent to write a reading. Notification permission can be taken back in your device settings.

To exercise any of these rights, contact us at privacy@grahachara.com. If you are not satisfied with our answer, you can complain to the Data Protection Authority of Sri Lanka.

7 Children's Privacy

Grahachara is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will promptly delete it. If you believe a child has provided us with personal information, please contact us at privacy@grahachara.com.

If you are 13, 14 or 15, a parent or guardian must agree before you use the Service.

Details about other people

Enter a child's details only if you are their parent or guardian, and another adult's details only with their permission. Those details are handled and sent to the AI services in the same way as your own.

8 Data Retention

We keep your data for as long as your account exists. Some things go sooner on their own: a quick palm reading is kept for 90 days, records of which offers you were shown for 90 days, and a message you send us for two years. Records of a WhatsApp sale, including your number and what was read from your slip, are deleted after 180 days.

When you delete your account in the app, the deletion runs immediately and takes your account, birth details, charts, reports, conversations, palm readings, compatibility matches, partner portraits and their images, your profile picture, ratings, notifications and remaining credits with it. Two things are deliberately kept:

• Purchase records, for up to twelve months. They are the only evidence a purchase happened, and without them a refund dispute cannot be answered.
• Usage counts with your identifier stripped out, so past figures stay comparable. These can no longer be traced to you.

Ordinary server logs are kept briefly and then rotate away.

9 Cookies & Tracking

This website sets no cookies at all. It stores one thing in your browser, and only if you use the language switch: which language you chose, so the site opens in it next time. It is kept on your own device and is never sent anywhere.

There is no analytics script, no advertising tag and no third-party tracker on this website. For more detail, see our Cookie Policy.

10 Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date above and notify you through the app or via email for material changes. Your continued use of the Service after changes constitutes acceptance of the updated policy.

11 Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: