In short. We collect what the app needs to work: who you are, your birth details, and what you do in the app. Your date, time and place of birth are the app's core input and we treat them as sensitive. We do not track you, we do not show ads, and we never sell your personal data. We do not use your private consultations to train AI models. You can delete your account and everything in it from inside the app, at Profile → Delete account.
Astro9 is operated by [Full registered company name] Private Limited, a company incorporated in India, CIN [CIN], registered office [registered office address].
We are the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), and the data controller where the EU or UK GDPR applies to you. You are the Data Principal.
This policy covers everyone who uses Astro9 on iOS, Android or the web, and everyone who applies to practise on Astro9 as an astrologer, healer or pandit. Where something applies only to practitioners, it says so.
This table is the complete list. It matches what we declare in Apple's privacy manifest and in the Google Play Data safety form.
| Data | What it is | Why |
|---|---|---|
| Name | The name on your account and on a chart you save | To identify you in the app and to a practitioner you book |
| Email address | Your sign-in address | Sign-in, account recovery, service messages |
| Phone number | Where you sign in by phone, or give one for a booking | Sign-in by one-time code; contact about a booking or delivery |
| Password | Stored only as a bcrypt hash — never as text, and not readable by us | Sign-in |
| Google account identifier | The stable ID and verified email in your Google ID token, if you use "Continue with Google" | To sign you in and match you to your account |
| Date, time and place of birth | Yours, and of anyone whose chart you compute | The input to every chart, reading and matching score — see section 4 |
| Postal address | Delivery addresses for shop orders; the address where an at-home pooja is performed | To deliver an order or send a pandit to the right place |
| Consultation messages | Chat sent during a session with a practitioner | So a session survives a reconnect and you can read it afterwards |
| Questions and AI readings | What you ask the AI and what it answers | To generate the reply and show your history |
| Reviews and ratings | What you write about a practitioner or a product | To show on their profile or the product page |
| Order and booking history | What you booked or bought, and when | To run your bookings and orders and show you your history |
| Reports and blocks | Who you reported or blocked, why, and a copy of the reported content | To act on the report and keep the block enforced — see section 12 |
| Diagnostic data | Error and crash information, and server logs including IP address and approximate time | To fix faults, and to detect abuse and fraud |
| App preferences | Theme, language, and your signed-in session, stored on your device | So the app opens the way you left it |
If you apply to practise on Astro9, we additionally collect, as part of KYC and payout setup:
Your KYC documents are never shown publicly. They are visible only to the small number of reviewers who decide your application. Clients see your profile, not your documents. We show only the last four digits of your PAN in the app.
Your date, time and place of birth are the app's core input. They are also identity-grade information: together they are enough to identify a person, and in India they are commonly used to verify identity.
We therefore treat them as sensitive personal data, and we declare them as sensitive to Apple and Google rather than as ordinary profile data. In practice this means: they are used to compute your charts and nothing else; they are never used for advertising or profiling; they are never sold; they are shared only as described in section 8; and they are deleted with your account.
You may enter birth details for other people — a partner for a matching score, a family member for a chart. If you do, you confirm you are entitled to, and you are responsible for telling that person. We hold those details as part of your account and delete them when you delete the chart or your account.
| Purpose | Legal basis (DPDP Act / GDPR) |
|---|---|
| Creating and running your account; signing you in | Consent / performance of a contract |
| Computing charts, readings, horoscopes, Panchang and matching | Consent / performance of a contract |
| Booking and running consultations and poojas, including chat, voice and video | Consent / performance of a contract |
| Taking orders and delivering products | Consent / performance of a contract |
| Sending one-time codes and service messages about your account or a booking | Consent / performance of a contract |
| Verifying practitioners, including KYC | Legitimate use / legal obligation |
| Keeping people safe: acting on reports, enforcing blocks, suspending accounts | Legitimate use / legitimate interests |
| Detecting and preventing fraud and abuse; keeping the service secure | Legitimate use / legitimate interests |
| Fixing faults and improving the service from aggregated, non-identifying usage | Legitimate use / legitimate interests |
| Meeting our legal, tax and accounting obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time — see section 14. Withdrawing consent does not undo what we did lawfully before, and some features cannot work without the data they need.
We do not track you across other apps or websites, and the app contains no advertising or analytics SDK that does. Apple's privacy manifest for Astro9 declares NSPrivacyTracking as false with no tracking domains, and the Play Data safety form says the same.
We do not sell or rent your personal data, and we do not share it with data brokers.
We do not show you advertising, and we do not profile you for advertising.
We do not use your private consultations, your birth details or your AI conversations to train AI models — ours or anyone else's.
We do not collect your precise location. The app asks where you were born, and where a pooja should happen; it does not read your device's GPS.
We do not record voice or video consultations. Audio and video are relayed live and are not stored by us.
The app asks for a permission only at the moment it needs it, and you can refuse. Refusing a permission disables that feature and nothing else.
| Permission | When it is asked | What it is used for |
|---|---|---|
| Camera | When you start a video consultation, or photograph a KYC document | Your live video during the call; a photograph of your document. Never in the background. |
| Microphone | When you start a voice or video consultation | Your live audio during the call. Never in the background, and never recorded. |
| Photo library | When you attach an identity document, or save a Kundli report | Reading the file you pick; writing the report you export. We do not browse your library. |
| Files | When you attach a document to a practitioner application | Reading the file you pick. |
The Android build declares only CAMERA, RECORD_AUDIO, MODIFY_AUDIO_SETTINGS, INTERNET and ACCESS_NETWORK_STATE. We explicitly block permissions that our libraries would otherwise add but that the app does not need, including external storage, phone state, Bluetooth and system alert window.
When you ask a question of the Kundli AI chat or an AI astrologer persona, we send your question and the computed chart it relates to Anthropic, which runs the model that writes the reply. Your name, email address and phone number are not sent.
Anthropic processes it to generate the reply and, under our agreement, does not use it to train its models. Replies are generated automatically with no human review. AI output is labelled as AI in the app and can be wrong — see the Terms of Service.
If our AI provider is unreachable, the app falls back to an on-device template engine and nothing leaves your device for that reply.
We do not make any decision about you that has a legal or similarly significant effect using automated processing alone.
When you book a consultation, the practitioner sees your name, the chart or birth details relevant to the reading, and what you send them during the session. When you book an at-home pooja, the pandit also sees the address and a contact number. When you place an order, the delivery address goes to whoever delivers it.
Practitioners are bound by their agreement with us not to use your data for anything beyond the consultation, not to contact you outside Astro9, and not to keep your data afterwards. If a practitioner misuses your information, tell us at spilltv11@gmail.com.
A review you write is public on the practitioner's or the product's page, under the name on your account. Do not put anything in a review you would not want published.
Your data is stored in Google Cloud's Mumbai region (asia-south1), in India.
Two of our providers process data outside India: our AI provider processes AI questions in the United States, and our call-relay and hosting providers operate global edge networks. Where personal data leaves India, or leaves the EEA or UK for users to whom the GDPR applies, we rely on the provider's Standard Contractual Clauses and on contractual commitments that it be protected to the standard described in this policy.
| Data | Kept for |
|---|---|
| Your account, profile, birth details and saved charts | Until you delete your account |
| Consultation messages | Until you delete your account |
| AI questions and readings | Until you delete your account |
| Bookings, orders and invoices | Deleted with your account, except records we must keep for tax and accounting — normally 8 years under Indian law |
| One-time sign-in codes | Minutes — stored hashed, and invalidated once used or expired |
| Server and diagnostic logs | [e.g. 90 days] |
| Practitioner KYC documents | While the practitioner is active, and for [e.g. 5 years] afterwards where regulation requires |
| Reports of content, and the copy of the reported content | [e.g. 2 years] after the report is resolved, so that repeated abuse can be recognised |
| Record that an account was deleted | Indefinitely, as a one-way SHA-256 fingerprint of the email address and the date — see below |
Reports survive the reporter. If you report someone and then delete your account, the report stays but is detached from you — your identity is removed from it. Otherwise deleting an account would be a way to erase the evidence against someone, and reports of harassment would vanish along with the person who made them.
A deletion leaves a fingerprint. When an account is deleted we keep one row containing a SHA-256 hash of the lower-cased email address and the date. It holds no name, no email address and no phone number, and the hash cannot be turned back into an address. It exists so that we can answer "was this account deleted, and when" if you later ask us to confirm it.
You can delete your account from inside the app at Profile → Delete account. We confirm it is you — with your password, an SMS code, or a fresh Google sign-in — and the deletion is immediate and permanent.
Everything holding your personal data goes with the account: your profile, your birth details and charts, your bookings, your consultation messages and session records, your pooja bookings, your reviews, your addresses, your order history, and — for practitioners — your provider profile and its KYC documents. What remains is described in section 12.
You can also ask us to delete your account by writing to spilltv11@gmail.com from your registered address. We will verify who you are and complete it within 30 days.
Deleting the app from your phone does not delete your account.
As a Data Principal under the DPDP Act, you have the right to:
If the GDPR applies to you, you additionally have the rights to restrict or object to processing, to data portability, and to lodge a complaint with your supervisory authority.
To exercise any right, write to spilltv11@gmail.com. We will verify who you are and respond within 30 days. There is no charge, unless a request is manifestly excessive or repetitive.
You may also complain to the Data Protection Board of India if you are not satisfied with how we have handled your grievance.
Your duties under the DPDP Act: give us accurate information, do not impersonate anyone, and do not file a false or frivolous grievance.
No service can promise perfect security, and we do not. But we take these measures seriously and review them as the service grows.
If a personal data breach occurs, we will notify the Data Protection Board of India and every affected Data Principal without delay, as the DPDP Act requires, and — where the GDPR applies — the relevant supervisory authority within 72 hours. We will tell you what happened, what data was involved, and what you should do.
Astro9 is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18 and the app is not directed at children. If we learn that we hold a child's data we will delete it and close the account. If you believe we hold data about a child, write to spilltv11@gmail.com.
Under the DPDP Act, 2023 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021:
Name: [Grievance Officer name]
Designation: Grievance Officer & Data Protection Contact
Email: spilltv11@gmail.com
Address: [registered office address]
We acknowledge a grievance within 24 hours and resolve it within 15 days.
We may update this policy. The version and date at the top of the page tell you which version is in force. Where a change materially affects you — a new category of data, a new purpose, a new recipient — we will notify you in the app or by email before it takes effect, and will ask for fresh consent where the law requires it.
Astro9 — [Full registered company name] Private Limited
[registered office address]
Privacy and data requests: spilltv11@gmail.com
Safety and content reports: spilltv11@gmail.com
General support: spilltv11@gmail.com