Privacy Policy

Our Privacy Commitment

This policy explains exactly what the Aara app handles, the five situations in which anything leaves your device, and the controls you have. It applies to the Aara Android app, package com.aara.app. It matches the Terms of Service and Privacy Policy shown inside the app (version 2.4) word for word in substance — if you ever find a difference between this page and the in-app text, please tell us at support@aarahealth.org and we will correct it.

1. Who We Are

Aara is developed and operated by an independent developer based in Bengaluru, India. Contact: support@aarahealth.org.

2. What Aara Stores — and Where

Aara is built offline-first. Everything you enter is stored in a local database on your phone and is never transmitted to us. We hold no database of users and cannot identify you.

Encryption at rest

Your local database is encrypted with AES-256. The encryption key is held in your phone's secure storage (Android Keystore) and never leaves your device.

Works offline

All tracking, the calendar, the journal, reminders, and cycle predictions work with no internet connection at all.

3. The Only Five Times Data Leaves Your Device

There are exactly five situations in which any data is transmitted off your phone. Each is optional or clearly visible, and none involves your name.

(a) AI chat (Ask Aara)

When you send a question to the AI companion, your question is routed through our secure Cloudflare Worker proxy to Google's Gemini API to generate a reply. The app always sends your current cycle phase and cycle day so answers are relevant.

If you turn ON "Personalised AI answers" in Settings → Health Profile — it is OFF by default and requires your explicit opt-in — the app additionally sends an anonymised health summary: your PCOS status, listed health conditions, and a short summary of recent moods, symptoms, and flow.

Never sent in AI chat: your name, exact age or birthdate, journal notes, medication names, exact temperature readings, pain-map data, period-pain triage answers, or anything that identifies you.

Google may process Gemini API requests in data centres outside India; we do not control where Google processes your AI requests. The AI companion is unavailable to users under 18.

(b) Doctor Prep question generation

When you tap "Generate questions" in Doctor Prep, the app sends an anonymised summary to the same AI service: your age range (not your exact age), BMI category (not your exact weight), health conditions, current cycle phase, your top three to five most frequent symptoms, and your dominant mood. With Personalised AI ON, it also includes cycle day, PCOS status, mood patterns by phase, and the number (never the names) of medications you take. The Doctor Prep PDF itself is generated entirely on your phone.

(c) Anonymous install identifier and IP address (rate limiting)

To prevent abuse of the AI service, the app generates one random UUID on first launch and sends it with AI requests for rate limiting. It is random, stored in your phone's secure storage, contains no personal information, and is not linked to your identity or your health data.

Our proxy server also briefly processes your IP address as a fallback rate-limit signal and abuse-prevention measure. IP-based rate-limit counters expire automatically within one hour (burst) and 24 hours (global) and are never linked to your health data or persisted further.

(d) Advertising (free tier, adults only)

Ads are served by Google AdMob. We request non-personalised ads only. Your health data is never used for ad targeting and is never shared with AdMob.

Who sees no ads at all:

• Every user aged 13–17 (teen mode). Aara is completely ad-free for anyone under 18. No ad is requested and the advertising SDK is never started for these users.
• Everyone during the 7-day free trial — the trial includes full Aara Plus access, which means no ads.
• Aara Plus subscribers.

Everyone else sees non-personalised banner ads on non-sensitive screens only — never in the Journal, AI chat, trying-to-conceive, pregnancy, Doctor Prep, or Settings areas.

The Google Mobile Ads SDK is not started until after you have accepted the Terms of Service and Privacy Policy in the app, and only on a screen that is about to display an ad. Like any ad network, Google may then process basic device information (such as IP address and device identifiers) for ad delivery, frequency capping, and fraud prevention, governed by Google's Privacy Policy. You can also reset or limit your advertising ID in Android Settings → Google → Ads.

(e) Optional encrypted backup and device transfer

Both are off by default and only happen when you start them.

• Google Drive backup. Your data is encrypted on your phone with AES-256-GCM before upload and stored in your own Google Drive account. The encryption key is derived from a passphrase you choose at backup time (never stored or transmitted), so the backup can only be opened by someone who knows that passphrase — this is also what lets you restore on a new phone. If you forget it, the backup cannot be recovered, not even by us. Aara requests only the https://www.googleapis.com/auth/drive.appdata scope — the most restricted Drive scope available, which grants access exclusively to a private app folder that no other app or person can see and cannot read or write any other file. We never receive the backup, the key, or the passphrase, and we cannot read it. You can delete it any time from Settings → Data & Privacy, or revoke Aara's access at myaccount.google.com/permissions.
• QR device transfer. If you move Aara to a new phone using the QR transfer feature, your data moves directly between your two devices over your local Wi-Fi network, encrypted. It never passes through any server, ours or anyone else's.

Not transmitted from any server

Aara uses only local notifications scheduled by your phone. We do not send push notifications, marketing messages, or server-triggered alerts of any kind.

4. Payments

Aara Plus subscriptions are processed entirely by Google Play Billing. We never see or store your card, bank, or UPI details. Google shares only an anonymous purchase token with the app to confirm your subscription is active.

5. Third Parties We Use

We do not sell your data to anyone. We run no analytics or behavioural tracking SDKs — no Firebase Analytics, no Mixpanel, no Amplitude, no attribution SDKs.

6. What We Never Do

• We never sell your data — there is nothing to sell, because we do not hold it.
• We never share health data with advertisers, data brokers, or analytics companies.
• We never use your health data to target advertising, to you or to anyone else.
• We cannot hand your cycle data to anyone — including under legal demand — because it does not exist on any server we control.

7. Your Controls

Export your data

Settings → Export my data gives you a complete copy of everything stored, as JSON.

Delete your data

Settings → Delete all data permanently erases everything on your device, instantly. There is no server copy to chase. Uninstalling the app also deletes all local data.

Personalised AI toggle

Settings → Health Profile controls whether any health context is sent with AI requests. It is OFF by default. Switching it off at any time is your statutory right to withdraw consent under DPDP Act Sec 6(4)–(5), and doing so does not reduce your access to the app.

Ad personalisation

Aara already requests non-personalised ads for everyone. You can additionally reset or delete your advertising ID in Android Settings → Google → Ads.

App lock

Optional fingerprint/biometric lock for the whole app, in Settings.

8. Your Rights Under the DPDP Act, 2023

India's Digital Personal Data Protection Act, 2023 gives you specific rights with respect to any personal data we may process. We honour them as follows:

• Right to access (Sec 11) — Settings → Export my data.
• Right to correction (Sec 12(1)(a)) — you can edit any logged information anywhere in the app.
• Right to erasure (Sec 12(1)(b)) — Settings → Delete all data.
• Right to grievance redressal (Sec 13) — contact our Grievance Officer below. We respond within 7 days.
• Right to nominate (Sec 14) — you may nominate another individual to exercise your rights in case of death or incapacity by writing to us.

These rights are available without charge and without conditions, and exercising them will not reduce your access to the app.

9. Grievance Officer

Nithin Nagaraj Iyer, Founder, Aara · Bengaluru, India · support@aarahealth.org

We aim to respond within 7 days, in accordance with the timelines required under the DPDP Act, 2023 and the Information Technology Act, 2000.

10. Data Breach Notification

If we become aware of a personal data breach affecting your information — for example, a compromise of the proxy server's rate-limit records or an incident with the Gemini API processor — we will notify the Data Protection Board of India and any affected users within the timelines and in the manner required by the DPDP Act, 2023 and any rules made under it.

11. Children and Teens

Aara is not for children under 13. The app blocks use where the entered birthdate indicates an age under 13, and the block cannot be bypassed.

Users aged 13–17 are placed in teen mode, in which the following are disabled: the AI companion (no question is sent to Google Gemini), the trying-to-conceive tracker, the pregnancy tracker, adult health content, and all advertising. Teen mode is ad-free: no ad is requested and the Google Mobile Ads SDK is never started for these users.

India's DPDP Act, 2023 treats anyone under 18 as a child and, at Sec 9(3), prohibits targeted advertising directed at children. Aara goes further and serves no advertising of any kind to under-18 users.

We encourage parents and guardians of teen users to review this policy with them.

12. Data Retention and Security

Your data is retained on your device until you delete it or uninstall the app. AI requests are processed transiently to generate a reply; we do not build profiles from them. Google's handling of Gemini API requests is governed by Google's terms.

All communication with the AI proxy uses HTTPS (TLS 1.2+). We recommend enabling your device lock (PIN, fingerprint) and device encryption. Aara's optional App Lock adds a biometric gate before the app opens; it prevents casual access but is not a substitute for full device encryption.

No method of transmission or storage is perfectly secure, but Aara's design — local-only storage, encryption at rest, no accounts — removes the most common ways health data is exposed.

13. Changes to This Policy

If we change this policy we will update the version number and effective date here, and the app will show you the updated text for acceptance before it applies to you. We will never weaken the core promise — local-only health data — without asking for your explicit consent first.

14. Contact

For any privacy question, concern, or grievance: support@aarahealth.org.