Privacy Policy

1.Introduction#

Sakha ("we", "our", "us") is a spiritual-wellness app published under the Kiaanverse brand and operated by an individual based in Germany (EU). This Privacy Policy explains — in plain language — what we collect, why, how we protect it, and the rights you have to inspect, export, correct, or erase your data. We treat your reflections with care.

We aim to comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Apple App Store and Google Play requirements. If local law grants you more rights than this policy describes, those local rights prevail.

2.Data We Collect#

We collect the minimum data required to run the app. We do not sell your data, and we do not share your reflections, journals, or emotional state with advertisers.

Account Data

When you create an account we collect an email address, a hashed password (or an OAuth identifier from Apple or Google), and a display name. Email is used for essential service messages.

Journey & Reflection Data

Your Shadripu Journey journal entries are encrypted on your device before they reach us, using a key held in your device's secure keystore. We store only the ciphertext and non-content metadata (counts, timestamps), so we cannot read the content of a normally-authored journal entry. Please note this key is device-local — it is not derived from your password, so entries cannot be recovered on a new device or after reinstalling the app. Your KarmaLytix weekly-reflection answers stay on your device and are not uploaded to us.

Emotional State & AI Conversation Data

Mood tags, Emotional Reset content, and your KIAAN conversation/voice transcripts are treated as sensitive. They are encrypted in transit (TLS) and encrypted at rest with keys we control, which means our systems can access them to operate the features. To generate responses, this content is sent to third-party AI providers (see Section 6). We select providers that support API use without training on customer content where available, but we do not control their internal practices.

Technical Data

We collect device type, operating system, app version, crash reports, and anonymized performance metrics. Crash reports (via Sentry) are scrubbed of personal data before upload.

Data We Explicitly Do Not Collect

3.How We Use Your Data#

Providing the Service

We process your account, journey progress, and reflections so you can continue your practice across devices. Legal basis: performance of contract (GDPR Art. 6(1)(b)).

Improving the Service

We use aggregated, anonymized metrics to understand feature adoption and to fix bugs. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).

Sending Essential Communications

We send security alerts, password resets, and critical service notices. You cannot opt out of these. Marketing emails, if any, are strictly opt-in and separate.

4.How We Protect Your Data#

Encryption

Journal and reflection content in the "sacred spaces" is encrypted on your device with AES-256-GCM before it leaves your device, using a key stored in your device's secure keystore (Android Keystore / iOS Keychain). Other data — KIAAN conversations, Emotional Reset content, quick-saved insights — is encrypted at rest with keys we control so we can operate those features. Data is encrypted in transit with TLS.

Infrastructure

Production services are hosted on reputable cloud providers (backend on Render, web on Vercel). Database connections use TLS. Secrets are stored in environment configuration, not in the codebase. We limit access to production systems.

Incident Response

If we suffer a data breach affecting your personal data, we will notify you and the relevant authorities without undue delay and, where required, within 72 hours, as required by GDPR Art. 33 and 34.

5.Your Rights#

You have the following rights over your data. We respond to every verified request within 30 days at no cost.

Access and Portability

You may download a machine-readable export of your account, journeys, reflections, and history from Settings → Privacy → Export My Data.

Correction

You may correct inaccurate personal data directly in the app, or by writing to us at thesacredquest2@gmail.com.

Erasure (Right to Be Forgotten)

Settings → Account → Delete Account permanently removes your data within 30 days. You can also request deletion without signing in at kiaanverse.com/delete-account. Some anonymized aggregated metrics may be retained for integrity and security.

Objection and Restriction

You may object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.

California Rights (CCPA/CPRA)

California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information. Sakha does not sell or share personal information, so there is nothing to opt out of. You may designate an authorized agent to exercise these rights on your behalf.

6.Data Sharing#

We share data only in the narrow circumstances below. We never sell your data.

We are in the process of putting formal Data Processing Agreements in place with these vendors. The specific AI provider used for a given request depends on availability, language, and feature.

7.International Transfers#

If you are in the European Economic Area, the United Kingdom, or Switzerland and your data is transferred to the United States or elsewhere, we rely on Standard Contractual Clauses approved by the European Commission and on supplementary safeguards. You may request more information at thesacredquest2@gmail.com.

8.Cookies and Local Storage#

We use a small number of strictly-necessary first-party cookies and local storage entries: a session cookie to keep you signed in, a CSRF token, and a preferences key for theme and language. We do not use third-party advertising cookies, pixels, or trackers.

9.Data Retention#

We retain personal data only as long as we need it to provide the Service, meet legal obligations, and defend legal claims. Journals and reflections are kept while your account is active and deleted within 30 days of account closure. Security logs are retained for 90 days. Subscription/invoice records are held by the app store or payment processor as required by applicable tax and accounting law.

10.Children & Families#

Sakha is a general-audience app. You must be at least 13 to hold an account (or the minimum digital-consent age in your country). A kid-friendly section (Kids Dharma Adventure) is intended for younger children under adult supervision and sits behind a parental gate; the supervising adult owns and controls the account. Where the service is made available to children, we act in accordance with applicable children's-privacy laws (including COPPA and the GDPR's rules on a child's consent). Parents may contact us at thesacredquest2@gmail.com.

11.Platform-Specific Disclosures#

Apple App Store

Per Apple's privacy label, Sakha links the following data to your identity when you sign in: contact info (email), user content (journals, reflections), usage data (app interactions), and diagnostics (crash logs). No data is used for tracking.

Google Play

Per the Google Play Data Safety form, Sakha collects personal info, messages (AI conversations), audio (voice), health/wellness content, app activity, and app info & performance. Some of this is shared with the AI/voice providers in Section 6 to operate the features. All data is encrypted in transit. You can request deletion in Settings → Account → Delete Account, or at kiaanverse.com/delete-account.

12.Changes to This Policy#

We may update this policy to reflect new features or legal requirements. We will notify you in the app before material changes take effect. The "Last updated" date above always reflects the most recent change.

13.Contact Us#

For any privacy question, contact us at thesacredquest2@gmail.com. If you are in the EU/EEA, you may also lodge a complaint with the data-protection supervisory authority in your country of residence.