Last updated: 20 September 2026 Data Fiduciary / Controller: Ateeshay Jain ("we", "us", "our") Contact: ateeshay.jain@gmail.com Applies to: the Tattvam mobile application (the "App") on iOS.
Tattvam is an educational app for exploring ancient Indian philosophy. We have designed it to collect as little personal data as possible. Most of your data stays on your device. This policy explains what we collect, where it lives, what leaves your device, and the rights you have.
We are based in India, so this policy is written to comply with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and, for users in the European Economic Area and the United Kingdom, the EU/UK General Data Protection Regulation ("GDPR").
Tattvam works fully as a guest. You are not required to create an account or provide any personal information to read content, track your progress, take quizzes, or journal.
Stored locally using your device's app storage (AsyncStorage) and, for authentication tokens, the operating system's secure keystore (Expo SecureStore / iOS Keychain / Android Keystore):
We cannot see this data. It is removed if you delete the App or clear its data.
We use Supabase (project reference dkjlludfdfmfgzxfdapr) as our hosted
database and authentication backend. When you sign in, the following may be
stored. Private tables are protected by Row-Level Security. Leaderboards and
community reading use restricted database functions that expose only the fields
needed for those features, not the underlying private table rows:
| Table | What it holds |
|---|---|
user_profiles |
A display name, optional avatar URL, wisdom XP, current/longest streak, weekly XP, last-active date, and your selected themes. The display name may come from Apple on first sign-in, or defaults to "Seeker". The leaderboard function exposes only display names and XP totals; the profile table is not publicly readable. |
community_reflections |
A reflection you have explicitly chosen to share with the community (opt-in). See Section 3. |
reflection_reports / blocked_authors |
A report you file on a community reflection, or an author you block. |
We also receive, from our authentication provider at sign-in, the basic account identifier and profile fields (name, email-derived identifier, avatar) that Apple passes through to create your account.
We do not collect your contacts, photos, precise location, advertising identifiers, or browsing history. We do not use any analytics or tracking SDK. We do not track you across other apps or websites.
Version 1.0.1 does not enable crash reporting and does not send diagnostic events to Sentry. If a later release enables crash reporting, we will update this policy and the App Store privacy label before that release is distributed.
The philosophical content in the App (questions, quotes, translations) is shipped inside the App as static files. It contains no personal data and does not require a network connection to read.
On certain reflection screens you may choose to share a written reflection with other users. This is off by default and happens only when you actively tap "Share".
When you share, your reflection text is stored in the community_reflections
table linked to your account internally so that you can later edit or withdraw
it. However, when other users view community reflections, they are served
through a special read-only database function (a SECURITY DEFINER function)
that returns only an aggregate count and anonymized excerpts — it never
exposes your user ID or any identifier. Other users cannot tell who wrote a
reflection.
You can withdraw a shared reflection at any time, which removes it from public view. Please do not include personal or sensitive information in text you choose to share.
The App can show local reminders (e.g. a daily-practice nudge) that are scheduled on your device. We do not run a push-notification server and we do not collect or transmit device push tokens. You can disable notifications in your device settings at any time.
If you share a question to WhatsApp or another app, the App opens that app with a pre-filled text message via a system link. No personal data is sent to us in this process; what you share, and with whom, is controlled entirely by you in the other app.
| Provider | Role | When data is involved |
|---|---|---|
| Supabase (database & auth host) | Stores account data and powers sign-in | Only if you create an account |
| Apple (sign-in provider) | Authenticate you | Only if you sign in |
We do not sell your personal data, and we do not share it with advertisers or data brokers.
We process personal data only to:
Under GDPR, our legal bases are performance of a contract (providing the App and account you requested), consent (for optional features such as community sharing and notifications, withdrawable at any time), and our legitimate interests in operating and securing the service. Under the DPDP Act, we process personal data on the basis of your consent and for the specified purposes above.
Tattvam is intended for a general audience and is not directed at children. We do not knowingly collect personal data from children. Under the DPDP Act, processing the data of a child (under 18 in India) requires verifiable parental consent; we do not knowingly process such data and ask that minors use guest mode (which stores nothing with us) or obtain a parent's/guardian's consent before creating an account. Under GDPR, the App is not intended for children under 16. If you believe a child has provided us personal data, contact us and we will delete it.
If you create an account, your account data is stored on Supabase's hosted infrastructure, which may be located outside your country (including outside India or the EEA). Where required, such transfers are made with appropriate safeguards (such as standard contractual clauses, where applicable). Guest data never leaves your device and is not transferred.
Private account data is protected by Row-Level Security. Restricted database functions return only leaderboard fields and anonymous community excerpts. Authentication tokens are stored in your device's secure keystore. Network connections use HTTPS. No method of transmission or storage is perfectly secure, but we apply reasonable, industry-standard safeguards.
You can exercise the following rights. Many are also available directly in the App.
Everyone (in-app):
Under the DPDP Act (India), you have the right to access a summary of your personal data and processing, to correction and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity.
Under GDPR (EEA/UK), you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your data protection authority.
To exercise any right, or to raise a grievance, contact us at ateeshay.jain@gmail.com. We will respond within the timelines required by applicable law.
We may update this policy. Material changes will be reflected by updating the "Last updated" date and, where appropriate, an in-app notice.
Ateeshay Jain Email: ateeshay.jain@gmail.com
For users in India, this email also serves as the contact point for grievances under the DPDP Act.