Privacy Policy

You can read the calendar, panchang, rashifal, sahit, holidays, and converter without signing in or providing any personal data. The categories below apply only to the parts of the service you choose to use.

• Account information — when you sign up with email and password we store your email and a hashed password. When you sign in with Google we receive your Google account email, name, and Google user id; we do not receive your Google password.
• Profile data you choose to provide — name, preferred language, preferred timezone, date of birth, time of birth, place of birth, and rashi. We use these to personalize the calendar, generate your kundali, and target rashifal pushes.
• Personal content you create — custom events, birthday reminders, kundali charts, dashboard customization, and feedback messages you submit.
• Push tokens — when you allow notifications, we register the token your browser or phone gives us so the alerts you opted into can reach you.
• Technical signals from each request — the page requested, IP address, browser user-agent, and your language/timezone preference. We use these for security, abuse prevention, and aggregate analytics.

We use a small number of first-party cookies and browser storage entries. None of them are used for cross-site tracking. Cookies from Google services are described in Section 5.

• Authentication cookies that keep you signed in. They are HttpOnly and Secure, and sent only to our service.
• Preference cookies for your language, theme, and timezone, so pages render correctly on first paint.
• Short-lived browser storage used to remember a dismissed banner, a deep-link target, or your last push token.

We use the data above only for these purposes:

• To run the features you asked for — show your calendar with your own events, generate your kundali, deliver the reminders you scheduled, and sign you back in next time.
• To send the notifications you opted into — rashifal, birthday and event reminders, replies to your feedback, and occasional product announcements.
• To keep aggregate analytics — usage counts, active users, language and timezone splits — so we can improve the product.
• To prevent abuse and protect accounts — rate limiting, login throttling, and removal of invalid push tokens.
• To respond to feedback and support requests.

We rely on a small number of third parties. Their own privacy policies also apply.

• Google Firebase (Cloud Messaging; Crashlytics on the mobile app) — push delivery and, on mobile, crash diagnostics. https://firebase.google.com/support/privacy
• Google Sign-In — when you choose “Continue with Google”. https://policies.google.com/privacy
• Google Analytics — aggregate product analytics. https://policies.google.com/privacy
• Google AdSense — advertising on some pages. https://policies.google.com/technologies/ads

We do not sell your data and we do not pass profile data to advertisers.

Some pages on the website show ads delivered by Google AdSense. Google chooses placement and content; we do not pass your account data into the ad request.

• Google may use cookies and similar technologies to show ads relevant to your interests.
• Where required by law, Google’s consent surfaces will ask you to choose ad preferences.
• You can manage personalized ads at https://adssettings.google.com or with your browser’s privacy controls.

Retention is feature-driven.

• Profile, kundali, custom events, birthday reminders, and dashboard customization — kept until you delete the item, or you delete your account.
• Feedback messages — kept until you delete your account, then anonymized or removed.
• Push tokens — kept while valid; invalid tokens are removed automatically.
• Aggregate analytics — retained without per-user identifiers.

You can act on your own data without contacting us:

• Edit — sign in and use the Profile page to update your name, date of birth, rashi, language, and notification settings. Use the Custom Events, Birthday Reminders, Kundali, and Dashboard pages to manage the content they hold.
• Delete your account — open Profile and use the Delete Account form. We remove your account and the personal content tied to it, and clear your sign-in cookies.
• Export — not currently offered as a self-serve export. Reach out through the Feedback page if you need a copy of your data and we will arrange it.

We cannot promise perfect security, but we do the following:

• HTTPS for every public endpoint.
• Authentication cookies are HttpOnly and Secure and cannot be read by JavaScript.
• Passwords are stored hashed, never in plaintext.
• Public endpoints are rate-limited; login has a per-IP limiter to slow credential stuffing.
• Database and admin access are restricted to operators.