Privacy Notice

01 Who is responsible

SANKALPA-i is made by Activénse Holistic Solutions Private Limited, Pune, Maharashtra, India — recognised by the Department for Promotion of Industry and Internal Trade (DPIIT) as DIPP145329. We are the Data Fiduciary for everything described here.

02 What we collect

Four things, and only in service of the practice itself.

Your email address

Used to create your account, to send you a one-time password (OTP) that confirms the address is really yours, and to write to you about the beta. If you set a password, we never keep the password itself — only a scrambled, one-way version of it that cannot be turned back.

What you write or speak in the app

Your reflections, journal entries and spoken notes — in English, Hindi or Marathi. If you speak rather than type, the recording is converted into text so that the app can answer; it is the text we keep with your entries. We do not build a library of recordings of your voice.

Optionally, a coarse sense of place

Only if you allow it, and only approximately — enough to know roughly when the sun rises and sets where you are, and which day of the Hindu lunar calendar applies to you. Never a precise position, and never a trail of where you have been. You may refuse, and the app still works.

The app's own reflections back to you

What it said to you, when, and which small practice it offered. These are kept alongside your entries, because that is how tomorrow is able to follow on from today rather than starting from nothing.

The minimum needed to run the service

Ordinary short-lived operational records — that a request was served, and whether it failed — so we can keep the thing working. Personal details are masked in those records. If you turn on the dawn notification, your browser or device also gives us a subscription identifier so the notification can reach you; turning it off removes it.

03 What we do not collect

• No contacts, photo library, calendar or files from your device.
• No precise location and no movement history.
• No health records, no prescriptions, no financial or payment data.
• No Aadhaar number or any other government identity number. We will never ask you for one.
• No advertising trackers and no third-party analytics.
• This website sets no cookies.

We would rather this list stayed boring. If it ever has to grow, this notice changes first — see section 11.

04 Your reflections: the sensitive part

Your reflections, journal entries and spoken notes are the most sensitive thing we hold. We treat them as such.

In fairness we should say: the DPDP Act does not sort personal data into tiers of sensitivity the way some other laws do. Treating your inner writing as our most protected category is a standard we set ourselves, not one the Act imposes on us.

Where it is stored

In India, on managed cloud infrastructure in an Indian region.

Who can read it

You. Nobody else browses it. A named member of our team may open an entry only when you have asked us for support and only with your consent for that specific purpose; such access is restricted to named people and is recorded.

Kept apart from everyone else's

Your entries belong to your account alone. No other account can search or reach them.

What happens when the app answers you

To compose a reply, the words you have just sent are passed to the language-model provider we use, under a contract that forbids them from using your words to train their models. Some of that processing may happen on servers outside India; the copy we store stays in India.

Never

Never sold. Never rented. Never shared for advertising. Never used to train a model for anyone else, and never published or quoted anywhere without your explicit, specific permission.

05 Why we are allowed to hold it, and how to withdraw

Our lawful basis under the DPDP Act is your consent. We ask for it in plain language, for a stated purpose, and we ask separately for each of the following:

• Your account — when you sign up, for your email address and for the entries you go on to write.
• Your microphone — before you first speak to the app, and again through your device's own permission.
• A coarse sense of place — before it is ever asked for, and never as a condition of using the app.
• Notifications — before the dawn reflection can be sent to you.

Withdrawing is as easy as giving. Notifications have a switch in Settings. Microphone and place can be withdrawn in your device or browser settings at any time. To withdraw consent altogether, write to connect@sankalpai.in — that closes your account and erases its contents, as described in section 7.

Withdrawing stops any further use of your data. It cannot undo what was lawfully done while the consent stood, and we may keep the small number of records that a law requires us to keep.

06 The rights the Act gives you

Right to access

Ask us for a plain summary of the personal data we hold about you, what we are doing with it, and who else we have shared it with. We will send your entries back to you in a readable form.

Right to correction and completion

If something we hold about you is wrong, incomplete or out of date, ask us and we will correct, complete or update it.

Right to erasure

Ask us to erase your data and we will, unless a law obliges us to keep a particular record. Erasure of your account means the entries go too.

Right to grievance redressal

If you are unhappy with how we have handled your data or your request, bring it to our Grievance Officer — section 12 — before approaching the Data Protection Board of India. You do not need a lawyer, and it costs nothing.

Right to nominate

You may nominate another person to exercise these rights on your behalf if you die or become unable to act for yourself. Write to us with their name and how to reach them, and we will record the nomination against your account. You can change or remove it whenever you like.

How to exercise any of them

Write to connect@sankalpai.in from the email address on your account, and say plainly what you want. We may ask you to confirm from that address so that we are not acting for an impostor. We will respond within 30 days.

The Act also asks something of you: give us authentic information, do not impersonate someone else, and do not file a false or frivolous complaint.

07 How long we keep things

While your account is open

We keep your entries for as long as you keep the account, because the practice depends on remembering. That is the point of it, not a by-product.

When you ask us to erase, or close your account

We erase within 30 days. Copies inside routine encrypted backups fall away within a further 90 days, and are not touched in the meantime.

If you simply stop coming

After 24 months without a sign-in, we write to the email on file. If there is no reply within 30 days, we close the account and erase its contents.

Waitlist email addresses

Kept until the beta opens and you either join or tell us to remove you; in any case no longer than 24 months from the day you signed up.

Records the law requires

A small number of records — for example those needed for tax or company accounts — are kept for as long as the relevant law requires, and for nothing else.

08 Who else touches your data

We are a small company and we do not build everything ourselves. A few service providers process data on our instructions, under contract, and for no purpose of their own. Described by what they do:

• a cloud-hosting provider, in an Indian region, which stores the database and runs the service;
• a language-model provider, which processes the words you send in order to compose a reply, and which may do so on servers outside India;
• a speech provider, which turns speech into text and text into speech, if you choose to use your voice;
• an email service, which delivers your one-time password and the few emails we send;
• a notification service, only if you have turned the dawn notification on.

None of them may use your data for their own purposes. We do not sell, rent or trade your data with anyone. If a court or a law lawfully compels disclosure we must comply, and we will tell you unless we are forbidden from doing so.

If you would like the current list of named providers, ask us and we will send it. We name them on request rather than in this notice so that the notice does not quietly go stale when one of them changes.

09 How we protect it

• Everything travels between you and us over an encrypted connection.
• It is stored on managed Indian cloud infrastructure that encrypts data at rest.
• Each account's entries are isolated from every other account's.
• Passwords are never stored in a readable form.
• Personal details are masked in our operational records.
• Access by our own team is limited to named people, requires a reason, and is recorded.

No system is perfect and we will not pretend otherwise. If a breach affects your personal data we will tell you and the Data Protection Board of India, as the DPDP Act requires.

10 Children

SANKALPA-i is not intended for anyone under 18. We do not knowingly create accounts for children, and we do not direct any part of this site or the app at them.

The DPDP Act requires verifiable consent from a parent or guardian before a child's data may be processed. Rather than claim a standard we are not yet built to meet, we have chosen not to offer the service to children at all. If you believe a person under 18 has created an account, write to connect@sankalpai.in and we will close it and erase its contents.

11 Changes to this notice

The product will change, so this notice will change with it. The date at the top always says when it last did.

• A material change — anything that alters what we collect, why, who it goes to, or how long it is kept — is emailed to everyone with an account at least 14 days before it takes effect, and shown inside the app.
• A minor change, such as clearer wording or a corrected address, simply gets a new date.
• Where a change needs fresh consent under the DPDP Act, we will ask for it rather than assume it.

Earlier versions are available on request.

12 Grievance Officer, and where to escalate

If anything here troubles you — a request we have not answered, data you think we should not hold, a decision you disagree with — this is the person whose job it is to hear it.

We acknowledge every grievance within 7 days and aim to resolve it within 30 days. If you are not satisfied with our answer, you may complain to the Data Protection Board of India, the body established under the DPDP Act to hear exactly this.

Source: the Digital Personal Data Protection Act, 2023, published by the Ministry of Electronics and Information Technology (MeitY) — meity.gov.in.