Effective date: 21 September 2026 · Last updated: 21 September 2026 · Version 1.4

Privacy Policy

A birth chart is intimate. This policy explains what Mishtro collects, why, who sees it, how long we keep it, and how to get it corrected, exported or deleted. It covers the Mishtro mobile app for iOS and Android, the Mishtro website and the API that serves them. It is written to meet the Privacy Act 1988 and Australian Privacy Principles (Australia), the Digital Personal Data Protection Act 2023 and the Information Technology Rules (India), the California Consumer Privacy Act, and the policies of the Apple App Store and Google Play.

In one paragraph: we collect the birth details you enter, your email, your chats and reflections, and enough about your device to count the free charts per phone and confirm a Mishtro Pro subscription. We use AI providers to write readings and configure them not to train on your data. We do not sell or share personal data for advertising, we run no usage analytics or tracking (the app sends only anonymous crash and performance reports), and you can delete everything from inside the app in two taps.

1. Who is responsible

Mishra Agritech Pty Ltd (ACN 697 029 119, ABN 90 697 029 119), 11 Hassall St, Parramatta NSW 2150, Australia, is the entity responsible for your personal data. Under the GDPR we are the controller; under the Indian DPDP Act we are the data fiduciary; under the Australian Privacy Act we are an APP entity. Contact us at support@mishraagritech.com. Our Grievance Officer for India is listed in section 13.

2. What we collect, where it comes from, and why

What we do not collect: precise or background location, contacts, photos, the advertising identifier, browsing history, or usage analytics. The app contains no advertising SDK and no product-analytics SDK. It does contain a crash and performance reporter (Sentry) that sends technical reports of crashes and slowness, as described in the table above, without your identity. Motion-sensor access is used only for a decorative tilt effect on chart screens and no sensor data is stored or sent anywhere.

The microphone is used only during a voice conversation with Guruji that you start yourself, and only while the screen shows it listening. Your speech is turned into text by your phone's own speech recognition (Apple's or Google's, under their privacy policies, which may send the audio to their servers to do it). We receive the text alone, never the audio, and it is then handled exactly like a typed question (section 5).

Charts computed while signed out are calculated on our server, returned to your device and not stored. Server request logs, which contain the IP address and the request path but not the birth details, are kept for up to 30 days.

3. Legal bases

• Performing our contract with you (GDPR art. 6(1)(b)): computing charts, running chats, keeping saved data, delivering the subscription.
• Your consent (art. 6(1)(a) and 9(2)(a); DPDP s. 6): the sensitive information described in section 4, companion memories, notifications, the newsletter. You can withdraw consent at any time by deleting the relevant data or your account.
• Our legitimate interests (art. 6(1)(f)): keeping the free limits and the free trial to their terms, securing the Service, rate limiting, defending legal claims. We have balanced these against your interests and use the least data that works.
• Legal obligations (art. 6(1)(c)): tax and accounting records for paid subscriptions, responding to lawful requests, handling your rights requests.

4. Sensitive information

By its nature, an astrology service touches beliefs. Your birth details, gender, the mood you record, and what you tell Guruji may reveal religious or philosophical beliefs, health, sexual orientation or relationship circumstances. Australian law calls this sensitive information; the GDPR calls it special-category data. We collect it only because you enter it and only to provide the reading or conversation you asked for. We never use it for marketing, profiling for other purposes, or automated decisions with legal effect. If you would rather not, leave the optional fields blank and avoid sharing such details in chat.

We ask for this separately, and we do not treat accepting the Terms as your answer. Before the app saves the first set of birth details it shows a notice naming what is collected and what it may reveal, with an unticked box you have to tick yourself. Nothing is computed or saved until you do. We record which notice you were shown, its version and its exact wording, so that later we can both tell what you agreed to.

Two further consents are asked for on their own, and both start switched off:

• Companion memory. Guruji does not keep notes about your life unless you turn this on, in the account menu. Turning it off stops new memories being made and leaves the existing ones for you to read or delete.
• Someone else’s birth details. Adding a person other than yourself asks you to confirm, each time, that you have their permission or another lawful authority to enter their details.

You can withdraw any of these at any time by switching it off or deleting the data it covers; withdrawing does not undo what was done while it was on. Withdrawing your consent to the sensitive information in the first paragraph means the Service can no longer compute a chart for you, so it is done by deleting your account.

5. How readings and chats are generated

Chart mathematics runs on our servers and, for some tabs, on your phone. It is deterministic and involves no AI.

Narrated readings and every Guruji reply are generated on our servers, never on your phone. The relevant chart summary and the conversation text are sent to an AI inference provider for the duration of the request and returned as text. As at the date of this policy the provider serving production is DeepInfra, with NVIDIA (NVIDIA API Catalog) and the Vercel AI Gateway as fallbacks when it is unavailable. We may change providers, and we will update this list when we do.

We configure these providers not to use your content to train their general models. They may retain limited technical, abuse-prevention or security logs for the period their own service terms allow. We do not send them your email address, your account identifier or your device identifier.

Voice conversations. In a voice conversation your spoken question reaches us as text, as described in section 2. Guruji's spoken reply is produced by sending the text of the reply to a text-to-speech model at the same AI inference provider (DeepInfra as at the date of this policy) and playing the audio it returns. The audio is played once, is not stored by us, and a reply is never replayed from a recording.

Companion memories are produced by sending the recent part of a conversation to a server model with an instruction to note facts you shared. They are only made if you have switched companion memory on; it starts off. You can see every memory in the app and delete any of them, and deleting one also removes it from future prompts.

No decision with legal or similarly significant effect on you is made by these models. Their output is astrological commentary, not fact.

6. Who we share data with

We share personal data only with providers who process it for us under contract:

• Supabase: database, sign-in emails, storage of everything saved to your account.
• Vercel: hosting of the website and API; server logs; CDN caching of place lookups.
• RevenueCat: subscription management; receives our user ID and store receipt data.
• Sentry (Functional Software, Inc., United States): crash and performance reports from the app, without your email, account identifier, IP address or any chart or chat content. Sentry keeps a report for 90 days.
• Apple and Google: app distribution, payment and subscription billing, and, in a voice conversation, the speech recognition built into your phone. They act under their own privacy policies for the purchase and for the recognition.
• AI inference providers (section 5) — currently DeepInfra, with NVIDIA and the Vercel AI Gateway as fallbacks: chart summaries and conversation text, transiently; DeepInfra alone also receives the text of a Guruji reply to synthesise its voice.
• OpenStreetMap Nominatim and Photon (komoot): the place text you type, sent from our server under our identity, not yours.
• Expo (EAS Update): the app checks for updated code bundles; the request carries the app and runtime version, not your account.
• Email provider used by Supabase to deliver sign-in codes.

We do not sell personal data, do not share it for cross-context behavioural advertising, and do not provide it to data brokers. We disclose data to authorities only when a valid legal demand requires it, and we tell you when the law allows.

7. Where data is stored and international transfers

At the date of this policy our servers and providers are located in the United States (Vercel, for the website and API; Sentry, for crash reports) and South Korea (Supabase, Seoul, for the database and sign-in). We may host, back up or replicate data in other regions in the Asia-Pacific, the United States or the European Union where our providers operate, and our AI inference and subscription providers process requests in the United States. Because we operate from Australia and serve users in India and elsewhere, your data crosses borders. For users in the EU and UK we rely on adequacy decisions where they exist and otherwise on Standard Contractual Clauses (and the UK Addendum) with each provider. For users in Australia this is a disclosure under APP 8; we take reasonable steps to ensure recipients handle the data consistently with the APPs. For users in India, transfers are made only to countries not restricted by the Central Government under the DPDP Act. If we move the primary database to another region we will update the list above; the safeguards do not change.

8. How long we keep it

Deletion happens in stages, and it is worth being precise about them because they run on different clocks:

• Signed-out charts: not stored at all.
• Everything saved to your account (profiles, charts, readings, chats, memories, reflections, streaks, consent records, device and usage records): until you delete the item or the account. Deleting the account removes all of it from our live systems at once.
• Backups: a deleted row can still exist in a database backup. Backups roll off within 30 days, after which it is gone from those too.
• Server logs: up to 30 days. They hold IP addresses and request paths, not birth details.
• Crash and performance reports: 90 days at Sentry, then deleted. They are not tied to your account, so deleting the account neither needs to nor can reach them.
• Subscription and payment records: retained for 7 years where Australian tax and accounting law requires it, even after you delete your account. What is kept is the transaction: plan, amount, dates, store and our own user identifier. It contains no chart data, no birth details, no chat content, no reflections and no companion memories.
• Records held by Apple, Google and RevenueCat about the purchase itself are kept under their own policies and retention obligations. Deleting your Mishtro account does not reach them.
• Emails you send us: as long as needed to handle the request, then up to 2 years for legal record-keeping.

9. Security

All traffic is encrypted in transit (TLS). Every table is protected by row-level security so that a user can only ever read their own rows. API routes require a signed session token. Administrative keys exist only on the server. Sign-in uses one-time codes so there is no password to leak. No security is perfect: if we become aware of a breach likely to cause serious harm we will notify affected users and the relevant authority (the OAIC in Australia under the Notifiable Data Breaches scheme, the Data Protection Board of India, or the relevant EU or UK authority within 72 hours) as the law requires.

10. Your rights and how to use them

Wherever you live, you can:

• Access what we hold about you and get a copy in a portable format.
• Correct anything inaccurate. Birth details can be edited in the app under Profiles.
• Delete individual items (profiles, charts, conversations, memories, reflections) in the app, or the whole account.
• Withdraw consent for anything based on consent, without affecting what was done before.
• Object to processing based on legitimate interests, and ask us to restrict processing while we consider it.
• Complain to us and to your privacy regulator (listed by region below).

Email support@mishraagritech.com from the address on your account. We acknowledge within 2 business days and act within 7 days for deletion and export, and in any case within the time your local law allows (30 days under the Australian Privacy Act and the GDPR). There is no charge. We will not treat you differently for exercising a right.

11. Deleting your account and all data

In the mobile app: sign in, tap the account badge in the top-right corner, choose Delete account, and confirm. There is no undo.

This permanently deletes your account, saved profiles, birth details, charts, readings, conversations, companion memories, reflections, streaks, consent records and device and usage records, subject only to the limited information we are required to keep to meet legal, tax, accounting, fraud-prevention, dispute-resolution or security obligations.

In practice that exception is one thing: where you have paid for a subscription, we keep the transaction record for up to seven years because Australian tax and accounting law requires it. As set out in section 8, that record holds no chart data, chat content, reflections or companion memories. Everything else is gone from our live systems immediately and from backups within 30 days.

If you cannot get into the app, use the account deletion request page, or email support@mishraagritech.com from the account’s email address with the subject “Delete my account”. We will do it within 7 days and confirm by reply.

Deleting the account does not cancel a store subscription. Cancel it in your App Store or Google Play subscription settings. Data held by Apple, Google or RevenueCat about the purchase itself is governed by their policies.

12. Australia

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. We collect sensitive information only with your consent (section 4). We do not use or disclose your information for direct marketing without your consent, and we do not adopt government identifiers. You may ask for access to, or correction of, your information at any time; we will respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

13. India

For users in India we act as a data fiduciary under the Digital Personal Data Protection Act 2023. We process your personal data for the purposes you consented to when you entered it, and you may withdraw consent as easily as you gave it, by deleting the data or your account. You have the right to access a summary of your data, to correction and erasure, to nominate a person to exercise your rights if you are unable to, and to grievance redressal.

We do not knowingly process the personal data of anyone under 18 as an account holder. A parent or lawful guardian may enter a child’s birth details to compute a chart; this is done under the parent’s consent and we do no tracking, behavioural monitoring or targeted advertising directed at children.

Grievance Officer (under the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021):

Apoorve Mishra, Grievance Officer
Mishra Agritech Pty Ltd, 11 Hassall St, Parramatta NSW 2150, Australia
support@mishraagritech.com

We acknowledge grievances within 24 hours and resolve them within 15 days. If you are not satisfied, you may approach the Data Protection Board of India.

14. European Union, EEA and United Kingdom

Mishtro is offered in Australia, India and other markets outside the European Economic Area and the United Kingdom. We do not market or direct the Service to people in the EEA or the UK, we do not price it in euro or pounds for those markets, and we have not appointed a representative under Article 27 of the GDPR or the UK GDPR.

If we begin offering the Service in those markets we will say so here first, appoint the representatives that requires, and ask for consent again where the law requires a different basis than the one we relied on before.

This is about where we offer the Service, not about how we treat people. The legal bases in section 3 and the rights in section 10 are extended to every user wherever they live, including access, correction, deletion, portability and withdrawal of consent. If you are in the EEA or UK and have used the Service, you may still contact us at support@mishraagritech.com and complain to your national supervisory authority (listed at edpb.europa.eu) or, in the UK, to the Information Commissioner’s Office at ico.org.uk.

15. United States

For residents of California and other states with comprehensive privacy laws: in the past 12 months we have collected the categories of personal information in section 2 (identifiers, personal characteristics including gender, commercial information about subscriptions, internet activity limited to app requests, and inferences in the form of astrological readings, plus sensitive personal information as described in section 4). We use them for the purposes in section 2 and disclose them only to the service providers in section 6. We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past 12 months. We do not use or disclose sensitive personal information for purposes other than providing the Service. You have the right to know, delete, correct, and to limit use of sensitive information, without discrimination; exercise them as in section 10. Authorised agents may submit requests with proof of authority. We honour Global Privacy Control signals on the website as an opt-out, though there is nothing to opt out of.

16. Other regions

• Brazil (LGPD): the legal bases and rights above apply, including confirmation of processing and anonymisation; complaints go to the ANPD.
• Canada (PIPEDA): we collect with consent for stated purposes and you may withdraw it; complaints go to the Office of the Privacy Commissioner.
• Singapore (PDPA): you may access and correct your data and withdraw consent; complaints go to the PDPC.
• Japan (APPI): we disclose purposes of use above and obtain consent for transfers abroad; requests for disclosure or deletion follow section 10.
• Everywhere else: we extend the rights in section 10 to every user regardless of location.

17. Children

The Service is for adults aged 18 and over. We do not knowingly allow anyone under 18 to hold an account, and the app is not directed at children. Adults may enter birth details of family members, including children, for whom they are responsible. If you believe a person under 18 has created an account, tell us at support@mishraagritech.com and we will delete it.

18. Cookies, local storage and the phone

The website sets no cookies. It has no sign-in, no analytics and no advertising or measurement scripts, so there is no consent banner because there is nothing to consent to. See the Cookie Policy for the detail.

The mobile app stores, in app storage on the phone: your language, the chart this phone follows, recent charts, remembered couples, journey progress, your acceptance of the terms and the separate consents in section 4, and a random install identifier. Uninstalling the app removes all of it. On Android the Android ID persists by design of the operating system, and on iOS the identifier for vendor resets once every app from us is removed.

The consents in section 4 are also written to your account once you are signed in, so that a record of what you agreed to survives reinstalling the app. They are deleted with the account.

19. Changes to this policy

We will update this policy when the Service changes. The effective date and version number at the top identify the text you are reading, and we keep the superseded versions so we can both tell what applied when. For changes that expand what we collect or how we use it, the app asks you to accept the new version before the change applies to you, and records which version you accepted.

20. Contact

Mishra Agritech Pty Ltd (ACN 697 029 119, ABN 90 697 029 119)
11 Hassall St, Parramatta NSW 2150, Australia
Privacy, support and the Grievance Officer (India): support@mishraagritech.com