We built it so we
couldn’t read it.

We do not sell personal data, and never have. We do not trade it, rent it, or share it for advertising. A small number of processors are necessary to run the service, and each is bound by contract to process only on our instructions:

• Hosting and databaseSupabase, for authentication and account records.
• PaymentsA payment processor, for subscriptions once Personal launches. We never receive full card details.
• Email deliveryFor verification, password resets and service notices.

Beyond those, we disclose personal data only where valid legal process compels us, where it is necessary to prevent fraud or an imminent security threat, or where you have asked us to in writing. If we are ever compelled to hand over backup data, what we can hand over is ciphertext: we hold no key, so we cannot decrypt it for anyone, including a court.

Under Section 16 of India's DPDP Act, personal data may be processed outside India except in a country the Government restricts by notification; none of ours goes to such a country. We are an Indian business serving users worldwide, and our cloud infrastructure is hosted in Singapore. That was a deliberate choice: our users are global rather than only Indian, and Singapore gives the whole of that user base reliable latency. Data may therefore be processed outside your country. Singapore is not covered by an EU adequacy decision, so where personal data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses together with the safeguards our processors publish. Our handling is also aligned with Singapore's Personal Data Protection Act. Encrypted backup content is unaffected by where it sits: it is unreadable in every jurisdiction, which is rather the point.

Rashnova is not intended for children, and we do not knowingly create accounts for anyone under 18. Under the DPDP Act 2023, processing a child's personal data requires verifiable consent from a parent or lawful guardian, and behavioural tracking and targeted advertising directed at children are prohibited outright: we do neither, for anyone, at any age. If you believe a child has created an account, write to us and we will delete it.

Encryption is the primary control, because architecture beats promises. Beyond it:

• In transitTLS on every connection.
• At restBackup content is encrypted on your device before upload, with standard, well established cryptography.
• AccessLeast privilege internally; row-level security on every account record.
• IntegrityEvery entry is sealed to the one before it, so alteration of a log is detectable.

If a personal data breach happens, we will tell affected users without delay, in plain language: what happened, when, what it means for you, what we are doing about it, and what you can do to protect yourself. We will inform the Data Protection Board of India without delay and send it a full report within 72 hours, as the DPDP Rules require; report the incident to CERT-In within 6 hours of noticing it, as its directions require; and meet the 72 hour deadline where GDPR applies. We will say all of this even when the honest answer is that the exposed material was unreadable.

The website uses only strictly necessary cookies: they keep you signed in and protect the sign in flow, and cannot be switched off without breaking it. There are no analytics, advertising or tracking cookies on this site, so there is nothing to accept or decline. If that ever changes, they will stay off until you choose to turn them on. The Rashnova application itself uses no cookies and no advertising identifiers of any kind.

We may update this policy. The version and effective date sit at the top of this page, and material changes will be announced by email to account holders and by a notice on the site before they take effect. We will not make a change that retroactively reduces the protection applied to data already collected.