Privacy policy

Applies to the Devalay Android app and its backend service.

The short version

• You can use Devalay fully without an account.
• No ads, no advertising IDs and no analytics. Crash reports (Firebase Crashlytics) are used only to fix bugs.
• We never sell or share your personal data.
• You can delete your account and all its data from inside the app at any time.

What we collect

• Account (optional): email, a hashed password, display name, language, chosen deity and rashi, and your synced favourites.
• Device identifier for guests: a random ID created by the app, stored only as a keyed hash, used to apply daily limits to AI features.
• Location (optional): if you allow it, the app sends coarse coordinates (rounded to about 10 km) to compute sunrise and Panchang timings. They are not stored.
• Purchases: if you subscribe, Google Play handles payment. We store a hashed purchase token, product and expiry to unlock Premium. We never see card or UPI details.
• Usage counters: anonymous play and download counts per item, not linked to you.

Crash reports, notifications and updates (Google Firebase)

The Android app uses three Google Firebase services, run by Google under the Firebase privacy terms:

• Crashlytics: if the app crashes, it sends the error trace, device model, Android version, app version and a random Firebase installation ID so we can fix the bug. No name, email, contacts or location are included.
• Cloud Messaging: a push token, used to deliver festival greetings and announcements. The app subscribes to an "everyone" topic and one for your app language; we cannot see who you are.
• Remote Config: the app checks whether an important update is required. This uses the same installation ID.

You can turn notifications off in Android settings at any time.

Videos

Bhakti videos play inside YouTube's own embedded player (privacy-enhanced mode, youtube-nocookie.com). YouTube may process data about your viewing under the Google privacy policy. Devalay does not receive or store your viewing history.

AI features

When AI is enabled, the text you enter for AI Status or a Gita question is sent to Anthropic (Claude) to generate a reply. Do not include personal information you do not want processed. Requests are not used to build a profile of you. When AI is not enabled, everything is generated on our server without third parties.

On your device

Favourites, downloads, settings, japa counts and Mandir preferences are stored locally. Downloads stay in the app's private storage and are removed if you uninstall the app.

Retention and deletion

Account data is kept until you delete your account (Profile → Delete account), which permanently removes it. Operational logs are kept for at most 30 days.

Security

All traffic uses HTTPS. Passwords are hashed with Argon2. Sessions use short-lived tokens with rotation.

Children

Devalay is suitable for all ages and does not knowingly collect personal data from children.

Contact

Questions or requests: dchandrachaan@gmail.com