SaatvaApp Privacy Policy

SaatvaApp Alpha Privacy Policy
Version: alpha-privacy-v2.1
Effective date: 2 November 2026
Operator: Cognivanta Labs Private Limited, India
Contact: contact@saatvaapp.in

This notice describes how the SaatvaApp Alpha application handles account and communication data.

Account. On Android, SaatvaApp uses a Google sign-in token to authenticate you and receives your Google account identifier and Google-verified email. On Windows, SaatvaApp sends a one-time sign-in code to your email through our email delivery provider (SendGrid); the provider receives your email address and the message containing the code. The mobile number you enter is stored as USER_CONFIRMED after your explicit confirmation; no SMS or OTP verification of the number occurs in this version. We also process opaque account and device identifiers, public device keys, consent versions and timestamps, and the information needed to run the service.

Discovery. Your account can be found by mobile number or email only if you turn on "Let people find me"; this setting is stored on our server and applies to all your devices. A lookup returns only whether an account exists and what is needed to start an encrypted conversation. Lookups require sign-in, are rate-limited, and are recorded in security logs with pseudonymous device markers to prevent misuse. SaatvaApp does not read or upload your device address book; only the number or email you type is sent for a lookup.

Messages, files and calls. Human-to-human messages and attached files use the application's end-to-end encryption design. Files are encrypted on your device; our servers store only the encrypted file, and the key travels inside the end-to-end encrypted message. Audio and video calls between SaatvaApp users are set up with end-to-end encrypted messages and carry media between the devices with encrypted transport (DTLS-SRTP); our servers record which accounts and devices joined a call so it can be connected. The service relays encrypted envelopes and processes delivery, routing, security, and operational metadata needed to provide communication. End-to-end encryption does not prevent a recipient from viewing, copying, or sharing content they receive.

Groups and communities. To run groups and communities, our servers keep membership information: group and community names and descriptions, member account identifiers and roles, invitations, join requests, and which groups belong to a community. Message content in groups and communities remains end-to-end encrypted.

Devices and backup. If you use SaatvaApp on more than one device, encrypted history is shared between your own devices. Encrypted backup is optional and off until you turn it on. When on, your chats, contacts and call history are encrypted on your device with a key derived from your recovery code, and only the encrypted backup is stored on our servers. We never receive your recovery code and cannot restore a backup without it.

Notifications. Notifications show no message content. While SaatvaApp is running, they are created on your device. On Android, to tell you about a new message or call while SaatvaApp is closed, SaatvaApp may use Google's Firebase Cloud Messaging to wake the app; the wake-up carries no message content and no information about the sender, conversation or call. For this, Google receives an identifier for the SaatvaApp installation on your device and the time of each wake-up. SaatvaApp on Windows does not use a push notification service.

Model-assisted features. Features that you explicitly invoke with a model service may send selected content for cloud processing; that processing is separate from human-to-human end-to-end encryption. The app must identify such processing when it is offered.

Vaya. Vaya is an AI companion, not a person. When you send a message to Vaya, SaatvaApp's server sends that message, up to the 12 most recent messages of your Vaya conversation, and your Vaya settings (such as its name, personality, style and reply language) to Google's Gemini API to create the reply. It does not send your conversations with people, your contacts, calls, attachments, or your account or device identifiers. SaatvaApp uses Google's paid Gemini API service. Google states that for this service it does not use prompts or responses to improve its products, and that it keeps them for 55 days to detect and prevent misuse, during which authorized Google personnel may review them. Google states that this content may be stored transiently or cached in any country where Google or its agents maintain facilities, so Vaya messages may be processed outside India.

A call transcript is created only after everyone in the call agrees; each device then sends only its own user's voice for transcription, and the transcript stays on your devices unless you choose to save it.

Service providers and location. SaatvaApp uses service providers for functions such as Google authentication and Android notification wake-ups, email delivery of sign-in codes (SendGrid), model and speech processing for features you invoke (for Vaya, Google's Gemini API, as described above), and the India-based application infrastructure. Account and application data handled by SaatvaApp's Alpha backend, including encrypted files and backups, is configured in the Mumbai AWS region. Public website hosting is separate from private application-data processing. Operational logs and encrypted backups may retain information needed for reliability, security, and recovery. Retention and removal depend on the data type, account actions, backup cycles, and applicable obligations; this notice does not promise instant erasure from every backup.

We do not use private conversation content for ad targeting or sell it. You may contact us about your account, data, correction, deletion, or privacy questions at contact@saatvaapp.in. We will handle requests in accordance with applicable requirements and the application's technical capabilities. If this notice changes materially, the application will identify the new version and request renewed acknowledgement where required.