Privacy Policy

Last updated: 3 July 2026 Effective date: 31 March 2026

1. Introduction

Bond ("we", "us", "our", "the Service") is a personal guidance application operated by Akshay Dhiman, an individual operating under the laws of India.

This Privacy Policy explains what personal data we collect, why we collect it, how it is used and stored, the safeguards we apply, and the rights you have over your data.

We process personal data as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and, where applicable, in a manner consistent with the General Data Protection Regulation (GDPR) for users in the European Economic Area.

By using Bond you consent to the practices described in this policy.

2. Data Fiduciary / Controller

For any questions or data-rights requests, contact [email protected].

3. Data We Collect

3.1 Account Data (Google Sign-In)

We do not collect or store passwords. Authentication is exclusively via Google OAuth 2.0.

3.2 Birth and Location Data (onboarding)

This data is sensitive personal data used solely to generate your birth chart and personalised guidance.

3.3 Derived Birth-Chart Data

Computed from your birth data and stored alongside your profile:

• Full natal chart (planetary positions, houses, aspects)
• Life-period timeline (major and minor chapters)
• Calendar metadata for your birth location
• Chart strength scores
• Supplemental divisional charts used for deeper readings
• Profile summary (Moon sign, Ascendant, birth star, current life chapter)

3.4 AI Interaction Data

3.5 Relationship Data (Bonds)

When you use Bonds — our relationship compatibility features — we may collect:

If you connect with another Bond user through an invitation, their chart comes from their own profile. You are solely responsible for obtaining consent when you enter someone else's details or invite them. See Section 11.

3.6 Reading Progress

3.7 Usage Analytics

We do not use analytics for advertising, and analytics payloads do not include question text, birth data, email addresses, or other sensitive personal content.

3.8 Session and Technical Data

4. How We Use Your Data

We use your data to:

1. Provide, operate, and maintain the Bond service
2. Generate personalised life-guidance content via AI
3. Submit your birth data to our chart-computation service to generate and store your natal chart
4. Answer your questions by passing your chart summary and current timing context to an AI model
5. Maintain your account, authenticate you, and enforce session security
6. Apply rate limits and prevent abuse
7. Measure product usage through privacy-conscious analytics
8. Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising.

5. Legal Basis for Processing

Under India's DPDP Act, 2023:

• Processing is based on your free, informed, specific, and unambiguous consent given when you create an account and complete onboarding.
• You may withdraw consent at any time by deleting your account (see Section 10).

Under GDPR (for EEA users):

6. AI Processing Disclosure

Bond uses AI language models to generate personalised guidance:

• Your birth-chart summary (not raw birth coordinates) and question text are sent to an AI model to generate personalised responses.
• We use Cloudflare AI Gateway to route requests to AI models. Your summary data may be processed by the underlying AI model provider selected by Cloudflare AI Gateway.
• We do not use your data to train AI models.
• AI-generated content is not a substitute for professional advice — whether medical, psychological, financial, or legal.

7. Third-Party Data Processors

All data stored in Cloudflare infrastructure is encrypted at rest by Cloudflare. Cloudflare's privacy practices are governed by the Cloudflare Privacy Policy.

8. Data Retention

We retain data only as long as necessary to provide the Service or as required by law.

9. Data Security

We implement the following technical and organisational safeguards:

• Encryption at rest — all data in Cloudflare D1 and KV is encrypted at rest by Cloudflare's infrastructure.
• Encryption in transit — all communication with our API occurs over HTTPS/TLS.
• Authentication — sign-in is via Google OAuth 2.0 only; session tokens are signed with a strong server-side secret.
• Secure cookies — session cookies carry the Secure flag in production.
• Origin restriction (CORS) — API access is restricted to authorised origins.
• Rate limiting — AI question requests are rate-limited per user per day.
• Access control — all API endpoints (except public health and legal endpoints) require a valid authenticated session.

No system is entirely secure. If you discover a security vulnerability, please report it to [email protected].

10. Your Rights

Under the DPDP Act, 2023 (and where applicable, the GDPR):

We will action your request within 72 hours of receipt.

11. Bonds Feature — Third-Party Personal Data

Bonds let you explore compatibility with another person. You may do this by inviting someone who already uses Bond, or by entering their birth details yourself. In either case, you represent and warrant that:

1. You have obtained the explicit, informed consent of that person to process their personal data on Bond — including when you invite them by email or enter their birth details on their behalf.
2. That person is 13 years of age or older.
3. You will delete the Bond or cancel the invitation — thereby removing their data from our system — if they withdraw consent.

We cannot independently verify this consent. If you receive a complaint from someone whose data you have entered or whose email you have used without consent, you are solely responsible. You may contact [email protected] and we will remove the data upon verification.

12. Children's Privacy

Bond is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we hold data from a child under 13, contact [email protected] and we will delete it promptly.

13. Cross-Border Data Transfers

Your data is stored and processed on Cloudflare's global infrastructure, which may involve transfer to servers outside India. Such transfers are subject to adequate safeguards as provided by Cloudflare's standard contractual measures.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email to your registered address. Continued use after the updated effective date constitutes acceptance.

15. Grievance Officer

As required by the DPDP Act, 2023, our designated Grievance Officer is:

If your grievance is not resolved satisfactorily, you may lodge a complaint with the Data Protection Board of India once it is established under the DPDP Act.

16. Contact

Email: [email protected] Address: 288, Bank Enclave, Laxmi Nagar, Delhi, India 110031