1. Introduction
Sakha ("we", "our", "us") is a spiritual-wellness app published under the Kiaanverse brand and operated by an individual based in Germany (EU). This one policy applies everywhere Sakha is offered: the website at kiaanverse.com (including the mobile web at kiaanverse.com/m), the Android app on Google Play, and the iPhone/iPad app on the Apple App Store. This Privacy Policy explains — in plain language — what we collect, why, how we protect it, and the rights you have to inspect, export, correct, or erase your data. We treat your reflections with care.
We aim to comply with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Apple App Store and Google Play requirements. If local law grants you more rights than this policy describes, those local rights prevail.
2. Data We Collect
We collect the minimum data required to run the app. We do not sell your data, and we do not share your reflections, journals, or emotional state with advertisers.
2.1 Account Data
When you create an account we collect an email address, a hashed password (or an OAuth identifier from Apple or Google), and a display name. Email is used for essential service messages.
2.2 Journey & Reflection Data
Your Shadripu Journey journal entries are encrypted on your device before they reach us, using a key held in your device's secure keystore. We store only the ciphertext and non-content metadata (counts, timestamps), so we cannot read the content of a normally-authored journal entry. Please note this key is device-local — it is not derived from your password, so entries cannot be recovered on a new device or after reinstalling the app. Your KarmaLytix weekly-reflection answers stay on your device and are not uploaded to us.
2.3 Emotional State & AI Conversation Data
Mood tags, Emotional Reset content, and your KIAAN conversation/voice transcripts are treated as sensitive. They are encrypted in transit (TLS) and encrypted at rest with keys we control, which means our systems can access them to operate the features. To generate responses, this content is sent to third-party AI providers (see Section 6). We select providers that support API use without training on customer content where available, but we do not control their internal practices.
2.4 Technical Data
We collect device type, operating system, app version, crash reports, and anonymized performance metrics. Crash reports (via Sentry) are scrubbed of personal data before upload.
2.5 Data We Explicitly Do Not Collect
| Category | Collected | Notes |
|---|---|---|
| Advertising identifiers (IDFA, AAID) | No | Never read, never stored. |
| Precise location (GPS) | No | Only coarse timezone, for daily reminders. |
| Contacts | No | Sakha never asks for your address book. |
| Photos, microphone, camera | Only with consent | Used only for the voice companion and profile picture, when you enable them. |
| Browsing history | No | We do not track you across other sites or apps. |
3. How We Use Your Data
3.1 Providing the Service
We process your account, journey progress, and reflections so you can continue your practice across devices. Legal basis: performance of contract (GDPR Art. 6(1)(b)).
3.2 Improving the Service
We use aggregated, anonymized metrics to understand feature adoption and to fix bugs. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).
3.3 Sending Essential Communications
We send security alerts, password resets, and critical service notices. You cannot opt out of these. Marketing emails, if any, are strictly opt-in and separate.
4. How We Protect Your Data
4.1 Encryption
Journal and reflection content in the "sacred spaces" is encrypted on your device with AES-256-GCM before it leaves your device, using a key stored in your device's secure keystore (Android Keystore / iOS Keychain). Other data — KIAAN conversations, Emotional Reset content, quick-saved insights — is encrypted at rest with keys we control so we can operate those features. Data is encrypted in transit with TLS.
4.2 Infrastructure
Production services are hosted on reputable cloud providers (backend on Render, web on Vercel). Database connections use TLS. Secrets are stored in environment configuration, not in the codebase. We limit access to production systems.
4.3 Incident Response
If we suffer a data breach affecting your personal data, we will notify you and the relevant authorities without undue delay and, where required, within 72 hours, as required by GDPR Art. 33 and 34.
5. Your Rights
You have the following rights over your data. We respond to every verified request within 30 days at no cost.
5.1 Access and Portability
You may download a machine-readable export of your account, journeys, reflections, and history from Settings → Privacy → Download My Data.
5.2 Correction
You may correct inaccurate personal data directly in the app, or by writing to us at thesacredquest2@gmail.com.
5.3 Erasure (Right to Be Forgotten)
Settings → Account → Delete Account permanently removes your data within 30 days. You can also request deletion without signing in at kiaanverse.com/delete-account. Some anonymized aggregated metrics may be retained for integrity and security.
5.4 Objection and Restriction
You may object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.
5.5 California Rights (CCPA/CPRA)
California residents have the right to know, delete, correct, and opt out of the sale or sharing of personal information. Sakha does not sell or share personal information, so there is nothing to opt out of. You may designate an authorized agent to exercise these rights on your behalf.
6. Data Sharing
We share data only in the narrow circumstances below. We never sell your data.
| Recipient | Purpose | Data Shared |
|---|---|---|
| AI providers (Sarvam, Together AI, Hugging Face, DeepInfra, OpenAI) | Generate KIAAN responses | Your conversation text / voice transcript |
| ElevenLabs | Text-to-speech for spoken replies | Text to be spoken |
| LiveKit | Real-time audio for live voice rooms | Audio during a live session |
| Cloud infrastructure (Render, Vercel, Upstash) | Hosting, cache, backups | Account + app data (encrypted where noted) |
| Payment processors (Google Play on Android, Apple App Store on iOS, Stripe on web) | Process subscriptions | Billing details — never journal content |
| Email delivery (Resend) | Send password resets and receipts | Email address, message contents |
| Error monitoring (Sentry) | Diagnose crashes | Crash reports, PII-scrubbed |
| Legal authorities | Only when legally compelled | Minimum necessary, with notice when allowed |
We are in the process of putting formal Data Processing Agreements in place with these vendors. The specific AI provider used for a given request depends on availability, language, and feature.
7. International Transfers
If you are in the European Economic Area, the United Kingdom, or Switzerland and your data is transferred to the United States or elsewhere, we rely on Standard Contractual Clauses approved by the European Commission and on supplementary safeguards. You may request more information at thesacredquest2@gmail.com.
8. Cookies and Local Storage
We use a small number of strictly-necessary first-party cookies and local storage entries: a session cookie to keep you signed in, a CSRF token, and a preferences key for theme and language. We do not use third-party advertising cookies, pixels, or trackers.
9. Data Retention
We retain personal data only as long as we need it to provide the Service, meet legal obligations, and defend legal claims. Journals and reflections are kept while your account is active and deleted within 30 days of account closure. Security logs are retained for 90 days. Subscription/invoice records are held by the app store or payment processor as required by applicable tax and accounting law.
10. Children & Families
Sakha is a general-audience app. You must be at least 13 to hold an account (or the minimum digital-consent age in your country). A kid-friendly section (Kids Dharma Adventure) is intended for younger children under adult supervision and sits behind a parental gate; the supervising adult owns and controls the account. Where the service is made available to children, we act in accordance with applicable children's-privacy laws (including COPPA and the GDPR's rules on a child's consent). Parents may contact us at thesacredquest2@gmail.com.
11. Platform-Specific Disclosures
11.1 Apple App Store
Per Apple's privacy label, Sakha links the following data to your identity when you sign in: contact info (email), user content (journals, reflections), usage data (app interactions), and diagnostics (crash logs). No data is used for tracking.
11.2 Google Play
Per the Google Play Data Safety form, Sakha collects personal info, messages (AI conversations), audio (voice), health/wellness content, app activity, and app info & performance. Some of this is shared with the AI/voice providers in Section 6 to operate the features. All data is encrypted in transit. You can request deletion in Settings → Account → Delete Account, or at kiaanverse.com/delete-account.
12. Changes to This Policy
We may update this policy to reflect new features or legal requirements. We will notify you in the app before material changes take effect. The "Last updated" date above always reflects the most recent change.
13. Contact Us
For any privacy question or to exercise your rights, email us at thesacredquest2@gmail.com. Please send privacy and data requests by email only, so we can verify your identity and keep a record of the request. If you are in the EU/EEA, you may also lodge a complaint with the data-protection supervisory authority in your country of residence.
For general support you can also reach us on Instagram at @the_sacredquest or join our WhatsApp community. Those platforms are operated by Meta under their own privacy policies; please do not share sensitive personal data there. Feedback and ratings are welcome on Google Play and the Apple App Store.