Privacy Policy

Last updated 5 November 2026

AIKYATO is a private community app for a network of people, operated by AIKYATO LLP, Udaipur, Rajasthan, India (“AIKYATO”, “we”). This policy explains what the app stores about you, why, who can see it, where it is kept, and how to get rid of it. It applies to the AIKYATO apps for iPhone and Android and to the web app at app.aikyato.com.

1. What we collect, and why

Your email or mobile number to sign you in, your profile so members know you, and what you post. No location, no contacts, nothing from other apps.

• Email address or mobile number — to sign you in. A one-time code is sent to it by email or text message (SMS); there is no password. Sign-in by mobile is for Indian (+91) numbers. You can add the other one in You › Account › Ways to sign in.
• Name, bio, photo, cover photo — your profile, as shown to other members of your networks.
• Company, city, department — shown on your profile and celebration posts.
• Mobile — never shown on your profile or in the member list, not even to owners and admins; other members see it only when you share it, for example when you give someone an item.
• Position, college and course, about me, interests, fun fact, passionate about — optional, shown on your profile.
• Birthday (day and month) — birthday posts. The year is not collected.
• Anniversary date — anniversary posts and the years count.
• Blood group (optional) — used only to reach you first when someone in your network posts a blood request. Not shown on your profile unless you switch that on.
• Posts, comments, wishes, reactions, praise, Explore activity — the feed and channels themselves, including who asked for an item or joined a session.
• Stories — photos and videos you share to your story, which disappear 24 hours after you post them. The person who posts a story sees who viewed it.
• Chat messages — what you write in direct chats, groups and your network’s Watercooler room. Every message is deleted automatically 7 days after it is sent. Messages are stored encrypted.
• Contact details you put on an Explore post — a phone or WhatsApp number you type into “How to reach you” is shown to every member of that network, next to your name, for as long as the post lives. Leave it blank and people can only reach you through the post itself.
• Blood requests — the blood group needed, the hospital and a contact number, shown to every member of that network. Members whose blood group matches are notified first. Only post a request with the patient’s or family’s agreement.
• Health and activity data — see section 3.
• Mood check-ins (optional) — If you turn them on, the mood you choose each day and any note you add are stored with your account. Only you can see them. They are never shared with your group, its admins or anyone else, and are not used for analytics or advertising. You can delete them or turn check-ins off at any time, and deleting your account erases them.
• Water (optional) — If you log water in Move, the glasses you log and your daily goal are stored with your account. Only you see them. Deleting your account erases them.
• Medicines (optional) — If you add medicines in Move, their names, the dose and times you enter, how many tablets are left (if you enter it) and each dose you mark taken or skipped are stored with your account. Only you can see them; they are never shared with your group, its admins or anyone else, and are not used for analytics or advertising. Dose reminders show the medicine’s name only if you turn that on in My Medicines. Fasting timers and breathing sessions stay on your phone and are not sent to us. You can remove a medicine at any time, your data export includes them, and deleting your account erases them.
• My habits and habit buddy (optional) — If you choose daily habits in Move, the habits you pick, your daily ticks and the amounts you log are stored with your account. To show you which habits go with better days, the app compares your own ticks with your sleep, steps, mood check-ins (if you have turned them on) and, when a watch is connected, your resting heart rate; this is a pattern in your own days, not medical advice, and the result is shown only to you. Your group’s owners and admins see counts only, never which habits you have or whether you did them. If you choose a habit buddy, that person sees how many of your habits you did each day; which habits only if you switch that on; your sleep, mood and heart data never. Habits marked private, such as “No alcohol”, never appear in any count. You can remove a habit, stop a buddy or switch sharing off at any time, and deleting your account erases all of it.
• Lab reports (optional) — If you upload a lab report in Move, we store the values read from it, the lab’s name, the collection date, and the name, sex and age printed on the report, with your account. To read the values, the PDF or photos you upload are sent to Anthropic, an AI service, which copies the test results into the app and does not use them to train its models. The original file is deleted as soon as you save the values, unless you choose to keep it, and the password of a locked PDF is used once to open it and never stored. Only you can see your lab reports; they are never shared with your group, its admins or anyone else, and are not used for analytics or advertising. Each value is compared only with the range printed by your own lab; this is not medical advice and does not replace a doctor. You can delete one report or all of them at any time, your data export includes them, and deleting your account erases them.
• Steps Journey gifts — If you claim a gift, we collect the name, mobile number and postal address you give us (and your T-shirt size, for a T-shirt) only to send it to you. We share them with our courier for that delivery. Your group never sees them. You can choose not to keep the address for your next gift, and all of it is deleted with your account.
• Deals — which offers you redeem or join, so group deals and your member card work.
• Device and push tokens — the token your phone or browser gives us so we can send you notifications you have turned on.
• Preferences — notification settings, theme, default network.
• Sign-in and usage events — when you sign in (including failed attempts), the device type and name, an identifier the app creates for that device, the IP address, and how long you spend in the app and on each tab. Used only by AIKYATO’s own administrators to keep the service reliable and to investigate abuse. Kept for 90 days, then deleted. Never shared.
• Usage analytics — which screens you open and how often, measured with Google Analytics so we can see which features are used. Google receives an identifier for this app on your device (on iPhone, the app’s vendor identifier), the device type, the app version and the screen names. It never receives your name, email, posts, steps or health data, and no advertising identifier is used. From your connection, Google also works out an approximate region (city or country); AIKYATO itself never collects your location. Switch it off any time in You › Privacy › Share Usage Analytics.
• Your consent — when you tick the consent box at sign-up, we record the time, your IP address and the version of this policy you agreed to, as proof of your consent. It is deleted with your account.
• Reports, blocks and bug reports — what you send us when you report a post, block a member or report a bug, so we can act on it. If you report a chat message, a copy of that message and up to ten messages before it is attached to the report.

We do not collect your precise location, your contacts, or anything from other apps on your phone.

2. Device permissions

Asked for only when you first use the feature. The app works without them.

The app asks for each of these only when you first use the feature, and works without them otherwise.

• Camera and microphone — to take a photo or record a video for a post or your profile. Nothing is captured until you tap the shutter.
• Photo library — to choose an existing photo or video. On iPhone you can limit AIKYATO to selected photos.
• Notifications — for the alerts described in You › Notifications. You can refuse this permission and the app still works.
• Apple Health / Health Connect — read-only access to the data types in section 3.

3. Health and activity data

Read-only, only the types listed, never written back. Daily summaries and workouts on our servers, raw readings on your phone.

If you connect Apple Health (iPhone) or Health Connect (Android), AIKYATO reads these types, and only these: steps, walking and running distance, cycling distance on iPhone, heart rate and resting heart rate, sleep (duration and stages), exercise minutes, and workouts (type, start and end time, duration, distance, calories). AIKYATO never writes to Apple Health or Health Connect.

• What each is used for. Steps and distance show on your Move tab, count toward the leaderboard and any Challenges in your network, move you along the Steps Journey, and appear in a daily Steps post in your network’s feed. Heart rate, sleep, exercise minutes and workouts show only on your own Move tab.
• Who can see it. You. Members of the same network, including its owners and admins, see your steps, distance and rank on the leaderboard, Challenge boards and the Steps Journey. Nobody else sees your heart rate, sleep, exercise or workouts. Switch off “Show me on leaderboards” in You › Privacy and your steps, rank and daily Steps posts are hidden, including from Challenge boards.
• What we never do with it. Health data is never used for advertising or marketing, never sold, never shared with data brokers, insurers, employers or any third party, and never used to make decisions about you. It is not used to train any machine-learning model.
• Storage. Daily totals and your workouts are stored on our servers so your progress and the leaderboard work across devices. For sleep and heart rate, that means one summary per day: when you fell asleep and woke, the minutes in each sleep stage, and your average and resting heart rate. Individual heart-rate samples stay on your phone.
• Stopping. Disconnect in You › Connected apps, or revoke the permission in your phone’s Health / Health Connect settings. Deleting your account removes all stored activity records.

Nothing in AIKYATO is medical advice, and the app is not a medical device.

4. Who can see your information

Members of your networks, and nobody else. Admins see their member list; AIKYATO staff see records to run the service.

• Members of your networks. Your profile, posts and celebration posts are visible to people in the same network as you, and to nobody else. AIKYATO has no public feed and no search across networks.
• Owners and admins of a network can also see its member list, join requests, the moderation queue, and reports about members of their network (the reason and note, never chat messages). They cannot see members' email addresses or mobile numbers.
• AIKYATO’s own administrators can see account, membership and usage records to run the service, answer support requests and act on reports.
• Photos and videos. Photos and videos are stored at long, random web addresses that the app shows only inside your network. Anyone who is given one of those addresses can open that file.
• Chat. Only the members of a chat can read it. A network’s owners and admins can pause the Watercooler and delete messages in it; they cannot read your direct or group chats. AIKYATO’s administrators cannot read chats; we see chat messages only when a member attaches them to a report.
• Nobody outside. We do not sell your data, show advertising, or share your information with anyone for their own purposes.

5. Where your data is stored

A few companies host and deliver AIKYATO for us, in India, Singapore, the European Union and the United States. None may use your data for themselves.

A few companies store or move data for us, under contracts that limit them to that job. None may use it for their own purposes.

• Supabase — database and photo storage, in Mumbai, India.
• Render — the servers that run AIKYATO, in Singapore.
• Cloudflare — protects and speeds up the connection to our servers.
• Brevo — sends the sign-in code by email or SMS, and account emails, from the European Union. Text messages are delivered through mobile networks.
• Anthropic — reads the lab reports you choose to upload, to copy out the test values, on servers in the United States.
• Google Analytics — counts which screens are used, on Google’s servers in the United States.
• Apple and Google — deliver notifications and distribute the app; their own policies apply to the download.
• WhatsApp — only if you tap a WhatsApp link on an Explore post. From there, WhatsApp’s terms apply.

Because some of these run outside India, your data may be processed outside India, including in Singapore, the European Union and the United States.

6. How long we keep it

As long as your account exists, unless you delete it sooner. Sign-in records 90 days, chat 7 days.

• Your account and profile — for as long as the account exists.
• Posts, comments, photos and videos — until you delete them, the network is deleted, or your account is deleted.
• Explore posts — expire on their own (giveaways, lost & found, sessions and classifieds have end dates).
• Activity totals — for as long as the account exists, so the leaderboard and the Journey keep working.
• Lab reports — the values until you delete the report or your account. The original file is deleted once the values are saved, unless you chose to keep it; a report that was never read or saved is deleted with its file when you delete it. Nothing from a lab report is kept after you delete it.
• Chat messages — 7 days. Messages attached to a report are kept with the report.
• Stories — 24 hours, or until reports about them are closed.
• Sign-in and usage events — 90 days, or until you delete your account.
• Usage analytics — 14 months, then deleted by Google.
• Blocks — until you unblock the member or delete your account.
• Reports — until the post is removed or the account that made the report is deleted.
• Deleted content and deleted accounts — removed from our systems at once. Nothing is held back for a waiting period.

If a network is deleted by its owner, that network’s content is permanently removed for every member of it.

7. What you control

Birthday and anniversary posts, leaderboards, blood group, notifications: each has its own switch.

• Share birthday / Share anniversary — switch off celebration posts about you.
• Show me on leaderboards — hide yourself from Move rankings.
• Share usage analytics — switch Google Analytics off for this device.
• Blood group — set, show or clear it any time.
• Apple Health / Health Connect — connect or disconnect in You › Connected apps; the phone-level permission is in your phone’s own settings.
• Notifications — most types on or off in You › Notifications; chat alerts are muted per chat. Emergency alerts, blood requests and approval notices are always sent.
• Blocked members — manage in You › Blocked Members.
• Download my data — You › Your Data › Download My Data gives you a copy of what we hold.

8. Deleting your account

You › Your Data › Delete My Account, or email us. Immediate, permanent, everything listed on the delete page.

In the app: Tap your photo or initials at the top left to open You, then Your Data › Delete My Account. If you own a network, you first choose a new owner or delete that network. This permanently removes your profile, every membership, the posts you authored with their photos and videos, your comments, wishes, reactions, praise, activity records, privacy settings, push tokens, and any birthday or anniversary posts about you. Your sign-in credentials go too. Deletion is immediate and cannot be undone.

Without the app: follow the steps at aikyato.com/delete-account.html, or email support@aikyato.com from the address on the account. If you signed up with a mobile number, include that number and we will verify it is yours. We confirm and complete the deletion within 7 days.

To leave a single network instead, tap the network name at the top, then My Networks › Leave. That removes your membership and the birthday, anniversary and welcome posts about you there. What you wrote stays, with your name. It leaves your account and other networks intact.

9. Your rights and the legal basis

Consent and the contract with you, under India's DPDP Act. Access, correct, erase and complain.

We process your data because you asked us to, by creating an account and using the features: that is your consent under India’s Digital Personal Data Protection Act, 2023, and where the GDPR or a similar law applies, the basis is performance of our agreement with you, your consent for health data, and our legitimate interest in keeping the service secure.

You can access and correct your data in the app (Edit profile, Download my data), withdraw consent for any optional feature by switching it off or disconnecting it, erase your data with the delete flow above, nominate someone to exercise these rights for you if you die or cannot act, by emailing us, and raise a grievance with us (section 12). If we do not resolve it, you can complain to the Data Protection Board of India or your local supervisory authority. Withdrawing consent does not affect what was lawfully done before.

10. Security

HTTPS everywhere, encrypted storage, access limited to the staff who need it.

All traffic is encrypted in transit (HTTPS). Data is encrypted at rest by our storage providers. Sign-in uses one-time codes, so there is no password to leak. Your session is a signed token held on your own device. Access to production systems is limited to named AIKYATO administrators with two-factor authentication. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the authorities as the law requires.

11. Children

AIKYATO is for adults. Under-18s cannot hold an account.

AIKYATO is for adults. You must be 18 or older to hold an account, and you confirm this when you sign up. We do not knowingly collect data from anyone under 18; if we learn we have, we delete the account.

12. Grievance officer and contact

Grievance Officer, Aikyato LLP, support@aikyato.com. Privacy requests marked "Privacy".

Under the Digital Personal Data Protection Act and the Information Technology Rules, you can reach our Grievance Officer, Aikyato LLP, Udaipur, Rajasthan, India. For a grievance, a rights request or any question about this policy, email support@aikyato.com. We acknowledge every grievance within 24 hours and resolve it within 15 days. A request to remove content that shows a person’s private body, a sexual act, or an impersonation of them is acted on within 24 hours. If you are not satisfied with our answer, you can appeal to the Grievance Appellate Committee within 30 days.

13. Changes

We tell you in the app or by email before a change that affects you takes effect.

If this policy changes in a way that affects what we collect or who can see it, we will tell you in the app or by email before it takes effect, not only edit this page. The date at the top is the date of the last change.