Privacy policy

Who is responsible for your data

We are the controller of your personal data (the "data fiduciary" under India's Digital Personal Data Protection Act 2023).

Questions, requests and complaints about your data: hello@aaradhyah.com.

What we collect and why

• Account: your email address, a display name if you add one, and sign-in records. Why: to create your account and let you sign in. Basis: contract.
• Access and purchases: which poojas you can open, when access starts and ends, and, once payments open, the plan, price, currency and region of each purchase and the payment status from Razorpay (never your card number). Why: to provide what you bought, handle refunds and keep accounting records. Basis: contract; legal obligation for tax and accounting records.
• Preferences: your language, your region (worked out from your country when you first visit, until you choose one) and, if you choose one, your city with its time zone. Why: to show the site in your language, prices in your currency, and festival dates and reminder times for your place. Basis: contract.
• Festival reminders: the poojas you asked to be reminded about. Why: to email you before the festival. Basis: consent, which you give by turning a reminder on and withdraw by turning it off.
• Security and reliability: request details such as your IP address in short-lived server logs, a one-way hash of the IP address to limit repeated sign-in attempts, and error reports with emails, addresses and tokens removed. Why: to keep accounts and the service safe and working. Basis: legitimate interests.
• Usage measurement: Vercel Web Analytics counts page views by page address (without query strings) and a few product events (such as a pooja being started or completed) with only the pooja name, the site section (region and language) and the step number. Speed Insights measures how fast pages load. Neither uses cookies or identifies you. Basis: legitimate interests in understanding and improving the service.

We do not sell your data, show advertising, or use your data for automated decisions that have legal or similarly significant effects on you. The region we work out from your country only chooses which prices and dates you see first; you can change it at any time.

Where we ask for consent, as for reminder emails, you can withdraw it at any time, as easily as you gave it.

Cookies and storage on your device

We only use cookies and browser storage that the site needs to work or that remember a choice you made. We do not use advertising or tracking cookies, and our analytics are cookieless, so we do not show a cookie banner.

• Sign-in session (sb-…-auth-token cookies, set by Supabase Auth): keeps you signed in. Until you sign out or the session expires.
• NEXT_LOCALE: the language you chose. 1 year.
• REGION and region_source: your region for prices and dates, and whether you chose it or it was worked out from your country. 1 year.
• locale_suggest_dismissed, region_notice_dismissed, region_mismatch_dismissed: that you closed a language or region suggestion, so it is not shown again. Up to the end of the browser session or 1 year.
• Browser storage (not sent to us): your place in a pooja so you can resume, player settings (scripts, text size, auto-advance) and light or dark theme.

You can clear cookies and storage in your browser settings; you will be signed out and your preferences reset.

Who processes data for us

We use these service providers under contracts that only allow them to process data on our instructions:

• Supabase: database, sign-in and file storage.
• Vercel: website hosting, server logs, Web Analytics and Speed Insights (global network; United States company).
• Resend: sending sign-in and reminder emails (United States).
• Cloudflare: domain name (DNS) services (global network; United States company).
• Google: only if you choose "Continue with Google" to sign in.
• Razorpay: payments in India and internationally, once payments open (India).

International transfers

Our providers process data in several countries, including the United States and India. When data about readers in the United Kingdom or the European Union leaves those areas, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework and the UK extension, for certified providers) or on the European Commission's Standard Contractual Clauses with the UK Addendum in our providers' data processing terms. You can ask us for a copy of the relevant safeguards.

How long we keep data

• Account, preferences and reminders: while your account is open; deleted within 30 days after you ask us to close it.
• Purchase and refund records: for as long as tax and accounting law requires (typically 8 years in India and 6 years in the United Kingdom), even after the account is closed.
• Server logs and error reports: up to 30 days. Sign-in attempt counters: about an hour.
• Analytics: aggregated counts only, kept by Vercel under its own retention.

Your rights

Depending on where you live, you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; send it to you or another service in a portable format; and withdraw consent. Under India's Digital Personal Data Protection Act you can also have a grievance addressed and nominate someone to exercise your rights if you die or become unable to.

Email hello@aaradhyah.com from the address on your account. We may ask you to confirm the request from that mailbox. We answer within one month (UK and EU) and resolve grievances within 30 days (India); there is no charge.

If you are not satisfied you can complain to a supervisory authority: in the United Kingdom the Information Commissioner's Office (ico.org.uk), in the European Union the data protection authority of your country, and in India the Data Protection Board of India once it accepts complaints. We would appreciate the chance to put things right first.

Children

The site is for adults. We do not knowingly create accounts for, or collect personal data from, anyone under 18. If you believe a child has given us data, email us and we will delete it.

Changes to this policy

We will update this policy when what we collect or who processes it changes, and tell signed-in readers about important changes before they apply. The date at the top shows the latest version.

Contact us

Email hello@aaradhyah.com for any question about these documents, your account, your data, a purchase or a refund. We reply personally, usually within two working days.