Privacy Policy

Effective 8 September 2026 · Last updated 13 September 2026

If you never sign in

Your habit data never leaves your device. Every habit, logged day, and note you write is stored only in a database on your phone, and no network request carries any of it anywhere. There is no account tied to you and no advertising identifier collected. The only things the app sends are the anonymous crash reports and usage counters described under Diagnostics below.

Android's own system backup may include the app's database if you have device backup enabled. That copy goes to your personal Google account backup quota and, on Android 9 and later, is encrypted with your device lock secret — meaning neither we nor Google can read it. You control this in your device settings, not in Karmanya.

If you choose to sign in

Signing in is entirely optional and exists for one purpose: making your habits follow you across devices.

What we store

• Your email address and account identifier, provided by Google Sign-In, to identify which data is yours.
• Your habit data — habits, their settings, logged days, values, and notes — in storage keyed to your account identifier.

Who can read it

Only you. Access is enforced by server-side security rules that scope every read and write to your own account identifier, so another signed-in user cannot reach your data even if they tried. Those rules are tested automatically as part of our build, not just written and hoped over.

What we never do with it

• We do not sell it, rent it, or share it with third parties for their own purposes.
• We do not use it for advertising, and there is no advertising in the app.
• We do not read your habit names or notes. They are content, not signals.

Diagnostics

The app includes crash reporting and a minimal set of engagement events, so we can find out that something is broken for real people on devices we cannot test by hand. Both are provided by Google as our service provider: Firebase Crashlytics for crash reports and Google Analytics for Firebase for the events. They are sent whether or not you sign in, and are tied to a random app-installation identifier that is not your name, your email, or your Google account, and resets if you reinstall the app.

• Crash reports contain the technical state of the app at the moment it failed — stack traces, device model, Android version. They do not contain your habit names, notes, or logged data.
• Engagement events are counters only: that a habit was created, that a day was logged, that the app was opened. Never which habit, and never any text you wrote.
• Install source: Google Play tells Analytics which store listing or link an install came from, so we know whether anyone finds the app at all.
• No advertising ID. The app does not request or collect the Android advertising identifier, and advertising personalisation signals are switched off.

This website

Separately from the app, this website counts visits so we can tell whether anyone is finding it. It uses Cloudflare Web Analytics, which was chosen specifically because of what it does not do:

• No cookies, no local storage, and no identifier of any kind is written to your browser. That is why you are not being asked to consent to anything.
• No profile. There is no way for us — or Cloudflare — to tell that two visits came from the same person, or to follow you to another site.
• What we actually see is aggregate: how many times a page was viewed, which site linked to it, which country and browser, and how fast the page loaded.
• Honouring your browser's setting. If you have "Do Not Track" enabled, the counter does not load at all.

Fonts, animation libraries and images are all served from this domain, so no other company learns that you read this page. The one exception is the donation page — see below.

If you donate

The support page is the only page on this site that loads anything from another company. It uses Razorpay to take payments, and their checkout only loads on that one page.

• We never see your payment details. Card numbers, UPI IDs and bank credentials go straight to Razorpay. They do not pass through this site and are not stored here.
• We keep no record of the donation. There is no database entry, no receipt stored on our side, and nothing linking a donation to anything else. Razorpay holds the transaction record because they have to.
• Donating changes nothing in the app. No feature unlocks, no account is created, and the app never learns that you did it.
• What Razorpay collects — the amount, your payment method, and a contact detail for the receipt — is covered by their privacy policy.

If you never open the support page, none of this applies and no payment provider is contacted at all.

Your choices

• Use it without an account. The default, and always fully functional.
• Export your data at any time as JSON (a complete backup you can restore) or CSV, from Settings. No account needed.
• Sign out to stop syncing. Your data stays on your device.
• Delete your account and all cloud data from Settings, or from this page if you no longer have the app installed.

Children

Karmanya is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has signed in, contact us and we will delete the account.

Data retention

Cloud data is kept for as long as your account exists. When you delete your account, the habit data stored for it and the account record itself are both removed. Local data on your device is yours to keep or clear — uninstalling the app removes it.

Where your data is processed

Optional cloud sync is hosted on Google Cloud infrastructure (Firebase). Data may be processed in data centres outside your country of residence. Google acts as our data processor for this purpose.

Changes to this policy

If what the app does changes, this page changes in the same release — not later. Material changes will also be noted in the app's release notes. The effective date at the top always reflects the current version.

Contact

Use the address that matches what you are writing about:

• support@karmanya.app — bugs, questions, anything that is not working.
• privacy@karmanya.app — data requests, this policy, a child’s account.
• security@karmanya.app — a vulnerability or a suspected compromise.