Ojas — Privacy Policy
Status: publisher identity, contact details and pricing completed 26 August 2026. ⚠️ NOT REVIEWED BY A LAWYER, and that matters more for a worldwide listing than it would for an India-only one — Ojas ships globally from day one, so GDPR and UK GDPR apply to EU/UK users and CCPA/CPRA to California, on top of the DPDP Act. A food diary combined with Health Connect readings is arguably health data, which GDPR Article 9 treats as a special category with a higher consent bar, and Article 27 can require an EU representative for a controller established outside the EU. None of that has been assessed by counsel. Reviewed against the DPDP Act 2023, Google Play's Data Safety and Health Connect policies, and — if you list outside India — GDPR/UK GDPR and CCPA. This text describes Ojas's actual behaviour as implemented in code on 16 August 2026; §16 records exactly what was audited so a reviewer can verify each claim against the source.
1. The short version
| Your food diary, weight and profile | Live on your phone. A private, compressed backup is also stored against your account so a lost phone doesn't cost you your history. |
| What leaves your phone | Meal text, dish names and your day's totals (to generate coaching); food photos (to identify the food); barcode numbers; a monthly summary of numbers. Each is described field-by-field in §5. |
| Who else processes it | Two AI providers — OpenAI (writes your daily, weekly and monthly coaching) and Anthropic (reads your food photos, estimates dishes, and writes the coaching if OpenAI is unreachable) — plus Google Firebase (accounts and storage, Mumbai region). Nobody else. |
| Photos | Sent for identification, never stored by us — not in any database, not in any file store. |
| Health Connect activity | Read live, shown on screen, never sent anywhere and never included in your backup. |
| Advertising & tracking | None. No ad SDKs, no analytics SDKs, no third-party trackers, no profiling for advertising. |
| Selling data | Never. Not sold, not rented, not shared for anyone else's marketing. |
| AI training | Your data is not used to train AI models. |
| Deleting | Delete account in Profile → Help & account erases your cloud backup, your account and everything on the device. You can also ask us by email — see https://sulabs.in/delete/ojas. |
US residents: several states treat what you log here as consumer health data and require a separate notice for it. Ours is at https://sulabs.in/health-data/ojas — it repeats what is below, organised the way those laws ask, and adds the request route and appeal they require.
This summary is for orientation only. The sections below are the actual terms.
2. Who we are
Ojas is an Indian calorie and macro tracker published by Gulladurthi Hari Priya (Su Labs), Cuddapah, India. For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act) we are the Data Fiduciary for the personal data described here. For the GDPR, where it applies, we are the controller.
Questions, requests and complaints: sulabsstudio@gmail.com.
3. The data we handle, in full
We collect nothing about you that you did not enter, capture, or explicitly connect. There is no background collection, no contact-list access, no location access, no advertising identifier, and no cross-app tracking.
3.1 Account and identity
| Data | Where it comes from | Why |
|---|---|---|
| An anonymous account identifier (uid) created when you first open the app, before you sign in | Generated by Firebase Authentication | Gives your data an owner from the first launch, so nothing is stranded if sign-in happens later |
| Google account identifier, display name and email address | Google Sign-In, when you sign in (required to use the app) | Identifies your account so your backup can be restored on a new phone |
| Firebase Authentication's own sign-in records — IP address, timestamps, device/user-agent information | Collected by Google Firebase when you sign in | Account security and abuse prevention, by Google as our processor |
| Data-owner marker — the uid that owns the data currently on this device | Written by the app locally | Stops a second Google account signing in on the same phone from inheriting the previous person's health record |
Signing in links Google to the anonymous account already created; it does not create a second one.
3.2 A per-installation identifier
The app generates a random 32-character installation ID on first use and stores it on the device. It is sent with every AI request so we can attribute API costs to an installation and detect abnormal usage (see §5.6). It is not your account, not your Google ID, and not a device or advertising identifier. It is cleared and regenerated if you delete your account or reinstall.
3.3 Health and dietary data you enter
Under the DPDP Act this is personal data; under the GDPR most of it is special category (health) data. We treat all of it as sensitive.
- Body profile: name (optional), age, sex, height, weight, activity level.
- Goals: calorie and macro targets, target weight, goal history (each change, with the date it took effect), and your look-and-feel/body goals (hair, skin, energy, weight loss, weight gain).
- Life stage: whether you have told the app you are pregnant or breastfeeding, which raises your daily target.
- Allergies and diet: declared allergies/intolerances, vegetarian / eggetarian / non-vegetarian preference, lactose-free preference.
- Consent record: timestamped records of what you agreed to and when — the Privacy Policy and Terms versions you were shown, the two consents described in §3.3.1, and your acceptance of the health-goal disclaimer.
3.3.1 The two consents we ask for, separately
Before you can use Ojas you are asked to tick two separate boxes, neither pre-ticked, on top of accepting this policy and the Terms:
- Health data. That Ojas may keep and use your food diary, weight and profile — health information — to track and coach you.
- AI processing. That Ojas may send your meal descriptions, food photos and daily totals to its AI providers (OpenAI and Anthropic) to estimate food and write your coaching. Your weight and target weight are never sent — see §5.1.
They are asked apart from the documents because the GDPR treats health data as a special category needing explicit consent, which a single "I accept the terms" button does not give. Each tick is stored with the moment it was given.
Ojas cannot work without both: the diary is the product, and the estimates come from the AI. If you do not want either, please do not use Ojas — and if you change your mind later, deleting your account (§13) withdraws both and erases what they covered.
- Food diary: every entry — food name, emoji, meal slot, portion, calories, protein, carbs, fat, and the date.
- Weight history: each weight you record, with its date.
- Derived and learned local data: your custom foods, your own dish vocabulary (the words you use for dishes — e.g. logging dal as "pappu"), typical portion sizes you use, scan-correction labels (what the photo scanner read versus what you said it was), foods you searched for that we didn't have, streaks and earned seals.
- Subscription state: trial start date and status.
3.3a Purchase records, if you subscribe
When a subscription is bought, Google Play tells us it is real and we keep a record of it against your account. We never see your card, UPI or bank details — Google handles the payment and we are not in it.
What we store:
- The purchase token and order ID Google issues for the purchase. The token is how we ask Google whether your subscription is still valid, and we would have no way to check it without keeping it.
- Which product and which offer you bought on — for example the yearly plan at an introductory price.
- Status and expiry: whether it is active, whether it renews, and when the current period ends.
- An offer code, if you used one, and whether the purchase completed or was later refunded. This is how somebody who recommended Ojas to you is credited.
⚠️ These rows are keyed to your account identifier, not to your name or email. They are deleted with the rest of your data when you delete your account — see §11 and §13.
3.4 Photos of food
When you scan a meal or a package label, the photo is captured (or picked from your gallery), downscaled by the app, and sent for identification. See §5.3 for exactly what happens to it — including the fact that we never store it.
3.5 Meal descriptions you type
Free text such as "3 idli with sambar and a glass of buttermilk" is sent to be parsed into items and nutrition. Whatever you type in that field is sent as written, so please don't type anything there you wouldn't want processed.
3.6 Barcodes
Scanning a packaged product sends the barcode number only to Open Food Facts. No account, profile or diary data accompanies it. Open Food Facts will see the request's IP address, as any web service does.
3.7 Activity from Health Connect (Android, optional)
Only if you tap Connect and grant permission. Covered in full in §7.
3.8 Technical and cost telemetry
Every AI request writes one operational record containing: the installation ID (§3.2), which feature was used, which AI model, the date, input/output token counts, the computed cost, server processing time, and whether the server had to cold-start. Photo scans additionally record whether a correction was requested and how many hint items were sent — counts only. These records are deleted after 90 days (§11).
These records never contain your food, your photo, your text, your name or your account. They exist so we can see what the service costs to run and spot abuse.
3.9 Server logs
Our backend and Google Cloud keep short-lived operational logs (errors, request metadata, IP addresses). One warning log — an oversized backup — records your account uid. We don't use logs for analytics or profiling.
3.10 What we do not collect
No location, contacts, calendar, microphone, call or SMS data. No advertising ID. No device fingerprinting. No analytics SDK, no attribution or marketing SDK — the app ships with none of them. The one diagnostics SDK it does include, Firebase Crashlytics, is described in §3.11. No third-party cookies (there is no web app). We do not buy or receive personal data about you from data brokers or any other source.
3.11 Crash reports
If the app crashes or hits an error it cannot recover from, Firebase Crashlytics (Google) receives a crash report: the stack trace, the app version, your device model and Android version, whether the app was in the foreground, the time, and a random Crashlytics installation identifier. Crash reports never contain your food diary, photos, meal text, name or email. We use them only to find and fix bugs. Crashlytics keeps them for 90 days.
3.12 Reports you make about AI responses
Every AI-written text in the app (the coach's daily and weekly insights, the monthly letter, and AI food estimates) has a Report link. If you use it, we receive the text of that response, the reason you chose, any note you type, and your installation ID (§3.2), so we can review it and improve what the app says. Nothing else from your diary is sent. Reports are kept for 12 months.
4. Where your data is stored
| Store | What's in it | Location |
|---|---|---|
| Your device | Everything in §3.3, plus your settings and learned local data. Held in the app's private storage (an encrypted-at-rest SQLite database and preferences file that only Ojas can read). | Your phone |
Your account backup — Firestore user_backups/{your uid} |
One compressed blob containing your entire local state (§3.3), plus its size, a diary-entry count and the last-updated time. | asia-south1 (Mumbai) |
Anonymous food contributions — Firestore contributions and verified_foods |
See §6. No identifier of any kind. | asia-south1 (Mumbai) |
Cost telemetry — Firestore usage |
§3.8. Installation ID only. | asia-south1 (Mumbai) |
AI response reports — Firestore ai_reports |
§3.12: the reported text, reason, your note, installation ID. | asia-south1 (Mumbai) |
| Crash reports — Firebase Crashlytics | §3.11. No diary content. | Google infrastructure (may be outside India) |
| Account records | Your uid, Google identifier, name, email, sign-in metadata, held by Firebase Authentication. | Google infrastructure, which for authentication may be outside India (see §12) |
| AI processing | Transient — the request content is processed by Anthropic to produce the response. | See §10 |
Android's own automatic backup is switched off. By default Android copies an
app's data to your Google Drive; we have disabled that (allowBackup="false"
plus explicit extraction rules) so your health data is not silently duplicated
somewhere you were never told about. Direct phone-to-phone transfer during
new-device setup remains enabled, because that copies between your own devices
and never touches a third party's servers.
5. Every transfer, feature by feature
This is the complete list of things the app sends off your device. If a feature isn't here, it doesn't transmit.
5.1 Daily and weekly coaching
- Sent to: our backend (Google Cloud Functions, Mumbai) → OpenAI (GPT-5.6 Luna). If that request fails — an outage, or a rejected key — the same contents go to Anthropic (Claude Haiku 4.5) instead, so your coaching still appears. Nothing else changes about what is sent.
- Contents: the day or week under review — your calorie/macro targets and totals; each logged meal with food names, portions and macros; the day's nutrient estimates (such as fibre, iron and sodium) that your phone calculates from those same foods; which meal slots have no entry; a list of food names per day for the recent week; the week's averages and extremes; a short history of previous days' totals; the app's own computed summary and detected patterns; which past suggestions you acted on or ignored; a minimal profile of goal direction, diet preference and lactose-free flag; and, when you have a weight goal, how it is going as relative numbers only — kilograms still to go, your planned and measured pace per week, a likely date range and a status such as "on pace" — with the names of your most filling logged foods.
- Not sent: your name, email, uid, age, sex, height, exact weight, target weight, allergies, pregnancy/breastfeeding status, or photos.
- Purpose: to write the coaching text. Every number shown is calculated on your device; the AI only phrases it.
5.2 Estimating a dish or a typed meal
- Sent to: our backend → Anthropic (Claude Haiku 4.5).
- Contents: the dish name or the meal text you typed, the portion, your diet preference, and — for typed meals — a short list of dish names you have logged before, so your own vocabulary is understood.
- Not sent: anything else about you.
5.3 Photo scan of a meal or label
- Sent to: our backend → Anthropic (Claude Sonnet 5).
- Contents: the downscaled image; your diet preference; a short list of dishes you've logged before; the scanner's own past mistakes on this device (pairs of "read as X, was actually Y"); and, if you correct a result, the correction so the same photo can be re-read.
- Storage: the image is held in memory only for the duration of the request. It is never written to our database or any file storage, and we keep no copy of it. On your phone, the camera or gallery leaves a temporary copy in the app's private cache, which Android clears; the photo is not attached to your diary entry or included in your backup.
5.4 Barcode lookup
- Sent to: Open Food Facts (open database, ODbL licence).
- Contents: the barcode number.
- If the barcode isn't found, we offer to read the printed label from a photo instead — that path is §5.3.
5.5 Monthly report note
- Sent to: our backend → OpenAI (GPT-5.1), once per month, with the same fallback to Anthropic (Claude Haiku 4.5) described in §5.1.
- Contents: the finished month's summary numbers — days logged, average calories and protein, your targets, on-goal days, longest streak, best day's date, weight change over the month, the names of the foods you logged most, a comparison against the previous month, and your goal direction and diet.
- Not sent: your diary itself. Every number in the report is computed on your device; the AI writes only the closing note.
5.6 Cost telemetry
- Sent to: our own backend, with every request in §5.1–5.5.
- Contents: §3.8.
5.7 Account backup
- Sent to: our backend → Firestore, Mumbai.
- Contents: one compressed copy of everything in §3.3.
- When: automatically, at most once every 20 hours, when you leave the app, and only while signed in — or immediately if you tap back up now.
- Who can read it: it is stored compressed and our backend reads nothing inside it except the number of diary entries, so the restore screen can tell you what you're about to replace.
- Restoring replaces whatever is on that device.
5.8 Anonymous food contributions
See §6.
5.9 Reporting an AI response
- Sent to: our backend → Firestore, Mumbai.
- Contents: §3.12 — the response text, your reason and note, installation ID.
- When: only when you tap Report and send.
5.10 Crash reports
- Sent to: Firebase Crashlytics (Google).
- Contents: §3.11 — no diary content.
- When: after a crash, the next time the app runs.
6. Anonymous contributions and how Ojas learns
When you log a food that the AI estimated, the app sends a record to our backend containing: the dish name, the AI's estimate, the amount you actually logged, your diet preference, the category, the confidence, and whether you edited the numbers.
This record carries no account, no uid, no installation ID, no device identifier and no timestamp of your session — only the server's write time. It cannot be linked back to you by us or by anyone else.
Each night these are grouped by dish and rolled up into crowd-verified estimates that everyone's app then uses, so common dishes get more accurate and cheaper to look up over time. This is the mechanism by which the app improves.
Because these records carry no identifier, they cannot be traced to you and therefore cannot be individually retrieved or withdrawn. Deleting your account does not remove them, because there is nothing in them that says they were yours. If you would prefer not to contribute at all, do not log AI-estimated foods, or contact us and we will discuss options. [If a consent toggle is added, document it here.]
Correction labels from the photo scanner (§3.3) stay on your device and are not part of this pipeline.
7. Health Connect (Android) — special disclosure
If you tap Connect on the Activity card, Ojas requests read-only access through Android Health Connect to:
- Steps
- Active calories burned
- Total calories burned (only because Samsung Health writes total rather than active; we derive the active part from it)
- Exercise sessions (for duration)
We use this solely to display your activity on the Home and Insights screens and to suggest — never automatically apply — a calorie target that matches your real activity.
This data is:
- read-only — Ojas never writes to Health Connect;
- never transmitted to our servers or to Anthropic or any other third party;
- never persisted by Ojas — it is read live each time a screen needs it and held only in memory;
- not included in your account backup or in any export.
You can revoke access at any time in Health Connect → App permissions → Ojas. Revoking it removes the Activity card's data immediately and affects nothing else.
We do not use Health Connect data for advertising, for any purpose other than those stated above, and we do not transfer it to any third party. We do not share it with data brokers, information-resellers, or for any determination of credit, insurance or employment.
8. Permissions the app asks for, and why
| Permission | Why | Optional? |
|---|---|---|
| Internet | AI features, backup, barcode lookup | Required |
| Camera | Scanning barcodes and photographing meals | Yes — only asked when you use the scanner |
| Photo picker | Choosing an existing photo of a meal, through Android's own picker — Ojas holds no storage or media permission and sees only the photo you pick | Yes — only when you pick from gallery |
| Notifications | Local meal reminders you schedule | Yes |
| Run at boot | Re-arms your reminders after a restart | Tied to notifications |
| Alarms & reminders | Lets a reminder arrive at the time it names. Without it Android may deliver an 8pm reminder hours later. | Yes — reminders still work without it, just imprecisely |
| Physical activity / Health Connect | Steps and activity for the Activity card | Yes — off unless you connect it |
Reminders are scheduled on your device by Android. There is no push notification service; we cannot send you a message and we do not know whether a reminder was shown.
9. Accuracy — what Ojas knows, and what it doesn't
We consider this a privacy matter as much as a product one: you should know how reliable the numbers about your own body are.
AI estimates are estimates. When a dish isn't in our database, the nutrition figures are a model's best reconstruction from a typical recipe and portion — not a laboratory measurement. They are labelled as estimates in the app, carry a stated confidence, and are editable before you log them. Real dishes vary enormously with oil, ratio and portion.
Photo identification can be wrong. The scanner misreads unfamiliar dishes, and we ask you to confirm or correct what it saw. We measure how often it is right using your corrections, kept on your device — and we treat that figure as a floor, not a score, because people correct obvious errors and let subtle ones pass.
Packaged-food data is crowd-sourced. Barcode results come from Open Food Facts, which is entered by volunteers. The same product can appear with different numbers. We pick the most complete record and show its source, but we cannot guarantee it matches the pack in your hand. Check the label.
Numbers are computed on your device; the AI only writes. Averages, streaks, totals and the monthly report's figures are calculated by the app itself. The model is given the finished numbers and is instructed never to compute new ones or to state a measurement it wasn't given.
We do not fabricate what we don't measure. Our food data carries calories, protein, carbs and fat, plus thirteen micronutrients (fibre, sugars, calcium, iron, magnesium, potassium, sodium, zinc, and vitamins A, C, D, B12 and folate). Every micronutrient figure comes from USDA FoodData Central food-composition data — directly for single foods, and for dishes, scanned meals and described meals by adding up USDA values for their ingredients; the AI lists what a dish is made of but never supplies a vitamin or mineral number. Where the data does not cover a food or a nutrient, the app shows "no data" rather than a figure. These are estimates, not measurements, and they have not been reviewed by a clinician; reference amounts shown beside them are general guidance, not personal requirements.
Logging is not eating. A day with no entries means it wasn't logged. The app is explicitly built never to conclude that you skipped a meal or ate too little from an absence of data.
Activity figures come from your phone or wearable, not from us, and are only as accurate as the device that recorded them.
Ojas is not a medical device and does not provide medical advice. Nothing in the app — including the calorie targets, the pregnancy/breastfeeding adjustment, the wellness goals and the coaching text — is a diagnosis, a treatment, or a substitute for a qualified doctor or dietitian. If you have a medical condition, are pregnant or breastfeeding, or are considering a significant dietary change, consult a professional. Do not use the app to restrict intake below what your clinician advises.
10. Who else processes your data
| Processor | What they receive | Where | Their terms |
|---|---|---|---|
| OpenAI (ChatGPT models) | The request contents in §5.1 and §5.5 — your coaching and monthly-report inputs. No food photos, and no dish or meal estimates | OpenAI's infrastructure | Processes API content to return a response; does not use API content to train models. Content may be retained for a limited period for abuse monitoring under OpenAI's published API policy. See openai.com/policies |
| Anthropic PBC (Claude) | The request contents in §5.2 and §5.3 — dish and meal estimates, and food photos — plus §5.1 and §5.5 whenever the OpenAI request fails | Anthropic's infrastructure | Processes API content to return a response; does not use it to train models. Content may be retained for a limited period for safety and abuse-prevention purposes under Anthropic's published policy. See anthropic.com/legal |
| Google — Firebase Authentication | Your Google account identifier, name, email, sign-in metadata and IP | Google infrastructure (may be outside India) | firebase.google.com/support/privacy |
| Google — Cloud Functions & Firestore | Your account backup, anonymous contributions, cost telemetry, AI response reports, request logs | asia-south1 (Mumbai) | firebase.google.com/support/privacy |
| Google — Firebase Crashlytics | Crash reports (§3.11) | Google infrastructure (may be outside India) | firebase.google.com/support/privacy |
| Google Play | Purchase and subscription processing, if you subscribe | play.google.com/about/play-terms | |
| Open Food Facts | Barcode numbers you scan, and your IP | Open Food Facts servers | openfoodfacts.org — data under ODbL |
We do not use any other processor. We have no advertising, analytics, attribution or A/B-testing vendor.
Payments. Subscriptions are sold and processed by Google Play. We never receive or store your card, UPI or bank details — Google takes the payment and tells us only that a subscription exists, what it covers and when it expires. What we keep from that is listed in §3.3a.
Attribution. If you installed Ojas from a creator's link, Google Play may pass the app a referral string. Today that string is read once and kept on your phone; it is not sent to us or to anyone else. If that ever changes, this policy and the Play Data safety form change with it, before the code does.
11. How long we keep things
| Data | Retention |
|---|---|
| Everything on your device | Until you delete it, delete your account, clear the app's storage, or uninstall |
| Account backup | For as long as your account exists. Each backup replaces the last — we keep the current one, not a history. Deleted with your account. Logging out does not delete it; that is what lets you come back. |
| Account record (uid, Google identity) | Until you delete your account |
| Cost telemetry | 90 days. Records older than that are deleted automatically every night. |
| AI response reports | 12 months, then deleted automatically. |
| Crash reports | 90 days, by Crashlytics. |
| Anonymous contributions and verified foods | Retained indefinitely as part of the community food database. They carry no identifier and are not linked to you (§6). |
| Server logs | Short-lived, per Google Cloud's default log retention |
12. International transfers
Our backend, your backup and all contributions are held in Google's asia-south1 (Mumbai) region. Two exceptions:
- Firebase Authentication stores account records on Google's global infrastructure, which may be outside India.
- AI processing by OpenAI and by Anthropic happens on their own infrastructure, which is outside India.
Both are transfers to processors acting on our instructions, under their respective data-processing terms. [If you distribute in the EU/UK: state the transfer mechanism — SCCs — here after confirming it with counsel.]
13. Your rights and how to use them
Under the DPDP Act 2023 (and, where it applies, the GDPR) you have the rights below. Most are exercisable inside the app immediately; for the rest, write to sulabsstudio@gmail.com and we will respond within [30] days.
| Right | How |
|---|---|
| Access / a copy of your data | Profile → Help & account → Backup & restore → Full backup (JSON) or CSV. This is a complete machine-readable export of everything the app holds about you. |
| Correction | Edit any entry, goal or profile field in the app. |
| Erasure | Profile → Help & account → Delete account. This deletes your cloud backup first, then your account, then wipes the local database and all settings on the device. It is irreversible. (Anonymous contributions are unaffected — see §6.) Without the app — for example after uninstalling — follow https://sulabs.in/delete/ojas: email sulabsstudio@gmail.com from the Google account you signed in with, and we delete your backup and account within 30 days. |
| Withdraw consent | Disconnect Health Connect; turn off reminders; stop using AI features; or delete your account entirely. |
| Portability | The JSON export is complete and re-importable. |
| Grievance redressal | Gulladurthi Hari Priya, sulabsstudio@gmail.com — the escalation route required by the DPDP Act. |
| Nominate someone (DPDP) | Write to us to nominate a person who may exercise your rights if you die or become incapacitated. |
| Complain to a regulator | To the Data Protection Board of India, or your local supervisory authority. |
If you sign in on a phone that already holds another account's data, the app detects the mismatch and does not merge the two records.
14. Security
- All network traffic uses HTTPS.
- Your backup is stored compressed, and our backend never reads inside it except to count diary entries.
- Backend endpoints are access-controlled, and the AI provider's API key exists only on the server — never in the app.
- On-device data sits in the app's private sandbox, protected by Android's own app isolation and device encryption. Ojas does not add a separate passcode.
- Android's automatic cloud backup is disabled (§4).
- Deleting your account removes the cloud copy before the account itself, so your data cannot outlive the account that consented to it.
No system is perfectly secure and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board of India as the DPDP Act requires.
15. Children
Ojas is for adults aged 18 and over, and the app enforces it. Onboarding asks for your date of birth and will not continue if it is under 18; Personal details refuses to change it to one; and a date of birth under 18 already on the phone blocks the app entirely, offering only to correct a mistyped date or to delete the data on the device (and its backup). We do not seek parental consent and do not knowingly process a child's data. If you believe a child has given us data, contact us and we will delete it.
16. What was audited, and what is still open
This section is for our own record and for reviewers; it is published for transparency. It is not a term of the policy.
Verified against the source on 16 August 2026: the Flutter client (lib/),
the backend (functions/src/index.ts, 2,152 lines) and the Android manifest.
Confirmed by code: the five AI endpoints and their exact payloads
(dailyInsight, estimateFood, estimateMeal, scanFood, monthlyNote); no
image is written to any store; contributions carries no identifier and the
installation-ID header is not sent on that call; usage telemetry carries no
food content; Health Connect data is read through a short-lived provider, never
persisted and never in the backup payload; Android auto-backup is disabled in
both the modern and legacy rule files; account deletion removes the cloud backup
before the account; the app bundles no analytics or advertising SDK.
Re-verified 15 September 2026 for version 1.1: Firebase Crashlytics is
enabled in release builds (setCrashlyticsCollectionEnabled(!kDebugMode)); the
reportAiContent endpoint stores only the fields in §3.12; the merged Android
manifest carries no RECORD_AUDIO or storage permission (removed from the camera
plugin, tools:node="remove"); micronutrients are computed on the device from
bundled USDA tables and the AI endpoints no longer return any micronutrient
field.
Re-verified 16 September 2026 for version 1.2: the coaching surfaces
(dailyInsight, monthlyNote) now call OpenAI, with an automatic fallback
to Anthropic when that call fails — both are named in §5.1, §5.5 and §10. The
photo scan and the dish/meal estimates still call Anthropic only, so no food
photo reaches OpenAI. The payload fields are unchanged by the switch; what
changed is which provider receives them. Superseded the 25 August decision to
run a single AI vendor (recorded in docs/LAUNCH_CHECKLIST.md).
Clarified 17 September 2026 (not a material change, so no new version or in-app notice): the daily coaching request now also carries the day's nutrient estimates, which the phone computes from the food names and portions already listed in §5.1. No new kind of data leaves the phone.
Version 1.4, 15 October 2026. Billing went live, so one paragraph stopped being true and a new kind of record started existing:
- §3.3a is new — what a purchase records: the Google Play purchase token and order ID, the product and offer bought, status and expiry, and an offer code if one was used. Keyed to the account identifier, deleted with the account.
- §10 no longer says Ojas is free while in testing. It was accurate in September and would have been false on the day the listing went public, which is the worst moment for a privacy policy to be wrong.
- Install attribution is described — Google Play may hand the app a referral string when it is installed from a creator's link. It is read once and kept on the phone; it is not transmitted. Stated because the honest answer to "do you collect this" is "we receive it and keep it local", not silence.
Version 1.3, 22 September 2026. Two changes, both in how consent is taken and both re-prompting every existing user:
- The age line is now enforced in the app — §15. Ojas is 18+, and a date of birth under 18 cannot get past onboarding or into the app.
- Consent is asked per purpose — §3.3.1. Health-data processing and AI processing are two separate, unticked boxes rather than one combined acceptance, which is what the GDPR's "explicit consent" for special-category data asks for. Ojas lists worldwide from day one, so this applies to everyone.
Clarified 18 September 2026 (treated as not material — confirm with
counsel): when a weight goal is set, the coaching request also carries the
goal's progress as relative numbers (kg to go, pace per week, a likely date
range, a status) and the names of the person's most filling logged foods. The
weight and the target weight themselves are still not sent; the app test
test/goal_coaching_test.dart fails if either appears in the request. The
week's weight change was already sent in the computed summary.
Open items before this is published:
Fill every placeholder, including the Grievance Officer.Done (26 August 2026). The DPDP Act requires a Grievance Officer to be named and reachable; Gulladurthi Hari Priya is named, with an email and a phone number that both work. ⚠️privacy@sulabs.inwas NOT used — the domain has no MX records, so mail to it bounces.Set a retention limit on theDone — 90 days, enforced nightly by theusagecollection.pruneUsagescheduled function.Children: decide the age line and whether the DPDP Act's parental-consent requirement is met.The age line is 18+ and is enforced in the app (22 September 2026) — see §15. Ojas does not process children's data, so no parental-consent flow is needed. Remaining for counsel: confirm that a self-declared date of birth is the expected standard for an app of this kind.- Consent for contributions (§6): confirm with counsel whether an opt-out or opt-in toggle is needed, and build it if so.
- Confirm and cite both providers' current API retention terms rather than describing them generally — OpenAI's abuse-monitoring window and Anthropic's safety retention, each with its published source.
Host this at a public URL and link it from the Play listing, the Health Connect permissions screen, and Profile → Help & account.Live at https://sulabs.in/privacy/ojas (27 August 2026). The Health Connect hooks are declared in the manifest and Profile → Help & account renders the bundled copy. Remaining: paste the URL into the Play listing.Payments (§10) are described for Google Play Billing; billing is stubbed in the app today— billing is live (15 October 2026):in_app_purchaseis wired, the product and its five offers exist in Play Console, and §3.3a now lists exactly what a purchase records.- Backend endpoint authentication is being strengthened before public launch (tracked in the compliance register).
Publish a matching Terms & Conditions— live at https://sulabs.in/terms/ojas. Still outstanding: a Play Data Safety form whose answers agree with this document. A mismatch there is the single most likely cause of a listing being pulled.
17. Changes to this policy
If we change how we handle your data we will update this document, change the "Last updated" date, and — for anything material — tell you in the app before the change takes effect.
18. Contact
Gulladurthi Hari Priya (Su Labs), 1/118, Malepadu, Cuddapah, Andhra Pradesh 516360, India — sulabsstudio@gmail.com Grievance Officer: Gulladurthi Hari Priya, sulabsstudio@gmail.com