Updesh Privacy Policy

Effective date: 13 October 2026
Last updated: 13 October 2026

This policy explains what personal data Updesh handles when you use the Updesh app for iPhone and iPad, the Updesh app for Android, and the website at updesh.app (together, "Updesh"). It also explains why we handle it, who else receives it, how long it is kept, and the choices and rights you have.

The short version

• You do not need an account. Updesh shows no advertising and does not track you across other companies’ apps or websites.
• Your journal entries, notes, bookmarks, searches and reading progress are stored on your device or in your browser. We never receive their contents.
• Usage analytics are off unless you turn them on. If you turn them on, we receive app-usage events linked to a random installation ID. We never receive the text of what you write or search.
• Payments are handled by Apple or Google. We never see your card details.
• Audio is downloaded from our servers. Like any website, those servers see your IP address.
• No Updesh feature sends your personal content to an artificial-intelligence (AI) service.

1. Who we are

Updesh is provided by Hitesh Pankaj Nambiar, a sole trader (enskild näringsidkare) registered in Sweden ("we", "us"). "Updesh" is the name of the app and service. Hitesh Pankaj Nambiar is the controller of the personal data described here, and the "Data Fiduciary" under India’s Digital Personal Data Protection Act 2023.

• Contact for all privacy questions and requests: [email protected]
• Postal address: Marklandsgatan 49 lgh 1602, 414 77 Göteborg, Sweden
• Grievance contact for users in India (DPDP Act ss. 8(9)-(10) and 13; Consumer Protection (E-Commerce) Rules 2020): Hitesh Pankaj Nambiar, Grievance Officer, [email protected].

We have not appointed a UK representative under Article 27 UK GDPR, relying on the exemption for occasional processing that is unlikely to result in a risk to individuals. An EU representative is not needed because we are established in Sweden.

2. Data we handle, why, and on what basis

Overview

Our legitimate interests are running a secure, working service and answering people who contact us. You can object to processing based on legitimate interests (section 6).

You are never required to give us personal data. Without analytics, nothing changes for you. Without purchase verification, Premium cannot be unlocked on Android. Without request data, content cannot be delivered.

2.1 Content you create: stays on your device

iPhone and iPad. Display preferences and reminder settings may be synced to your other Apple devices through your private iCloud account (Apple’s iCloud Key-Value Store). Updesh does not sync your journal, bookmarks or reading progress through iCloud. Your journal, bookmarks and progress are, however, included in your device backups (iCloud Backup or a computer backup) if you use them. Downloaded audio is excluded from those backups. Apple holds these backups under your Apple Account, and we cannot access them.

Android. Only display and reminder preferences may be backed up by the backup service you have configured on your device. Journal entries, bookmarks, reading progress, your analytics choice and downloaded audio are excluded from Android backup and device-to-device transfer.

Website. The web reader saves bookmarks, private notes, reading progress, recent verses, language and display preferences in your browser’s local storage. This data is not sent to us and does not sync with the apps. To delete it, clear this site’s data in your browser.

If you delete the app or clear its data, content stored only on your device is lost. We cannot recover it.

2.2 Optional usage analytics (apps only)

Analytics are off until you choose to share usage information. You can switch them on or off at any time in Settings. Your choice applies to that installation only.

When analytics are on, the app sends events to our analytics provider. The events may include:

• that the app was opened or closed;
• screens opened;
• verse references viewed or listened to, and an estimate of reading engagement. A "read" event is recorded after about ten seconds on a verse screen, so it measures time on screen, not whether you read or understood the verse;
• bookmarks added or removed;
• verses shared or copied;
• whether a journal entry was opened, saved, edited or deleted (never its text);
• the number of search results (never the search words);
• audio, download and playback controls;
• language and settings choices;
• voice-sample plays;
• Premium purchase started or completed, and restore requested;
• general error categories.

Each event carries:

• a randomly generated installation ID;
• a session ID;
• timestamps;
• the app version, operating-system name and version, and analytics library version.

The Android app sends a smaller set of events than the iOS app.

Never sent:

• the text of journal entries, notes or searches;
• clipboard contents;
• your name, email or phone number;
• your contacts;
• precise location;
• advertising identifiers;
• purchase tokens, transaction IDs or payment details;
• screen recordings or session replays.

We switch off automatic capture, location (GeoIP) enrichment and user profiles.

Why: to understand which features are used and returned to, so we can improve Updesh.

Legal basis: your consent (GDPR Art. 6(1)(a); DPDP Act s. 6). Because Updesh is a religious and philosophical text, usage data could be read as showing an interest in that text. We therefore rely on your explicit, opt-in consent for analytics (GDPR Art. 9(2)(a)). We do not use this data to infer or profile your beliefs.

Withdrawing consent: turning analytics off stops new collection and deletes events still waiting on your device, together with the installation ID. It cannot recall events already sent. To have those deleted, see section 6.

Age: by turning analytics on, you confirm that you are 13 or older. If you are under 18, a parent or guardian should supervise this choice.

2.3 Premium purchases

Apple (App Store) or Google (Google Play) process every payment. We never receive your card or bank details, name, or email address from them.

iPhone and iPad: the app checks your verified App Store purchase on your device, using Apple’s StoreKit, to unlock and restore Premium. We receive no purchase data on our servers.

Android: when you buy or restore Premium, the app sends two things to our purchase-verification server: the Google Play purchase token and the app’s random installation ID. The server checks the token with Google, confirms the purchase with Google, and returns a signed confirmation that unlocks Premium on that installation. The server:

• stores purchase tokens in an encrypted record;
• periodically re-checks them with Google so that refunds and cancellations are reflected.

It does not receive your Google account name or email address. The server is hosted in Germany.

Why: to provide what you bought, to restore it, to handle refunds, and to prevent fraud.

Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)); for fraud prevention, our legitimate interests (Art. 6(1)(f)); under the DPDP Act, the purpose you provide the data for (s. 7(a)).

2.4 Audio downloads and website requests

When the apps download recordings from audio.updesh.app, or when you visit updesh.app, our content-delivery network and our server receive standard request information:

• your IP address;
• the date and time;
• the file or page requested;
• your browser or app’s user-agent;
• the referring page.

We use this information to deliver content, keep the service secure, block abusive traffic, and fix faults. We do not use it to identify you or to build profiles.

Legal basis: legitimate interests in operating and securing the service (GDPR Art. 6(1)(f)); under the DPDP Act, a legitimate use for providing the service you request.

2.5 Emails you send us

If you email [email protected], we receive your email address, your message, and anything you attach. We use them to reply, to provide support (for example, purchase restoration), and to keep a record of the request.

Legal basis: our legitimate interest in answering you, or steps you ask for under our contract (GDPR Art. 6(1)(f) or (b)). Our email is hosted by Apple (iCloud Mail).

2.6 Device features that stay on your device

• Reminders. Daily reminders are scheduled on your device and need notification permission. We do not send push notifications from a server.
• Widgets. Widgets read verse and progress information stored on your device.
• Phone voice. "Phone voice" reading uses your device’s built-in speech service. On some Android devices, the speech engine you have chosen may use a network connection under its provider’s own terms.
• Sharing. If you share a verse, the system share sheet sends the selected text or image to the app you choose, under that app’s terms.

3. What we do not do

• We do not sell or rent personal data.
• We do not share personal data for targeted or cross-context behavioural advertising.
• We do not use advertising identifiers.
• We do not use automated decision-making that has legal or similarly significant effects on you.
• No Updesh feature sends your journal, notes, searches or other personal content to an AI service. Updesh’s study text and narration were prepared before release using AI tools. That production did not use any user’s personal data.

4. Who receives data (service providers)

We use the following service providers, which process data on our behalf and under our instructions. They are not free to use your data for their own purposes, except as their own terms say for running their services.

We may also disclose information if the law requires it, to protect rights and safety, or as part of a transfer of the Updesh business. In a business transfer, the new owner would remain bound by this policy for data already collected.

5. How long we keep data

6. Your rights and choices

Everyone. You can:

• turn analytics off at any time;
• delete local content in the app;
• clear website data in your browser;
• email us to ask what data we hold about you, or to have it corrected or deleted.

Because we do not ask who you are, we may need your installation ID to find analytics data or an Android purchase record. The apps do not currently show the installation ID. If you contact us, we will explain what we can find without it. Turning analytics off deletes the ID from your device. Where we cannot link data to you, we may be unable to act on a request. We will tell you if so.

Your rights under the GDPR (everyone). Because we are established in Sweden, we apply the EU General Data Protection Regulation (GDPR) to all users. You have the right to:

• access your personal data and receive a copy (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17);
• restriction of processing (Art. 18);
• data portability for data you gave us on the basis of consent or contract (Art. 20);
• object at any time to processing based on our legitimate interests (Art. 21);
• withdraw consent at any time, without affecting processing that took place before (Art. 7(3)). For analytics, simply turn the setting off.

We answer within one month. In complex cases we may extend this by up to two further months and will tell you why (Art. 12(3)). Requests are free unless they are manifestly unfounded or excessive.

Complaints. You may complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se, which is our lead supervisory authority. You may also complain to the authority where you live or work. We would appreciate the chance to resolve your concern first at [email protected].

United Kingdom (UK GDPR). You have the same rights as listed above. You may complain to the Information Commissioner’s Office (ico.org.uk).

India (DPDP Act 2023). The Act applies to our processing because we offer Updesh to people in India. You have rights to:

• a summary of your personal data and how it is processed;
• correction, completion, updating and erasure;
• withdraw consent as easily as you gave it;
• grievance redressal;
• nominate another person to exercise your rights in the event of your death or incapacity.

Contact our grievance contact (section 1). We acknowledge grievances within 48 hours and resolve them within one month. If you are not satisfied, you may complain to the Data Protection Board of India once you have used our grievance process.

United States. We do not sell or "share" personal information (as California law defines these terms), and we do not use it for targeted advertising or profiling. US-state privacy laws with revenue or volume thresholds may not apply to us, but you may still make the requests described above, and we will honour them.

We will not treat you differently for exercising your rights.

7. International transfers

Our own servers are in Germany, inside the EU. App analytics are sent to PostHog’s EU endpoint (eu.i.posthog.com). PostHog Inc. is a US company, and its staff or sub-processors outside the EU may be able to access the data. Cloudflare, Inc. is a US company with a global network. Emails you send us are stored by Apple (iCloud Mail), which may process them in the United States.

Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses (with the UK Extension or the UK Addendum for UK data).

Our PostHog project is hosted in PostHog’s EU region. You can ask us for information on these safeguards at [email protected].

Apple and Google process data under their own terms, as independent controllers.

Indian users’ data is processed outside India. The DPDP Act allows this, except to countries the Government of India restricts by notification.

8. Security

Network traffic to our servers and providers is encrypted (HTTPS). Android purchase records are stored encrypted. Our servers keep only the data described here. Journal content never leaves your device, except within your own Apple or Google backups as described in section 2.1. No system is perfectly secure. If a personal-data breach affects you, we will notify you and the authorities where the law requires.

9. Children

Updesh is a general-audience study app and is not directed at children under 13. We do not ask for age, name or contact details. Analytics are off by default and are intended for adults (section 2.2). Under the GDPR, the age at which a child can consent on their own varies by country between 13 and 16 (13 in Sweden). If you are a parent or guardian and believe your child has turned analytics on, or has sent us personal data, contact us and we will delete what we can link to them. In India, processing a child’s personal data (a child is anyone under 18) requires a parent’s verifiable consent. Turning analytics on and buying Premium are intended for users aged 13 or older, under the supervision of a parent or guardian if under 18 (section 2.2).

10. Third-party links and services

Store pages, share destinations, external links and your device’s speech engine are run by others under their own privacy policies.

11. Changes to this policy

We will update this policy when our practices change and revise the "Last updated" date. If a change materially affects how we use data you have already provided, we will give notice in the app or on the website before it applies and, where the law requires, ask for your consent again. Earlier versions of this policy are available on request at [email protected].

12. Contact

Hitesh Pankaj Nambiar (Updesh), Marklandsgatan 49 lgh 1602, 414 77 Göteborg, Sweden, [email protected].