Privacy Policy

Version 2026-10-v4 · Last updated 24 October 2026

This policy explains what personal data Ilayra uses, why, and the choices and rights you have. It is our notice under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and our privacy policy under the Information Technology Act, 2000 and its rules. It is available in English and in all 22 languages of the Eighth Schedule.

The Data Fiduciary is [company name to be published], [registered office to be published], India ("Ilayra", "we", "us").

The short version

• Your health logs — periods, pregnancy, symptoms, mood, sleep — are stored only on your phone, encrypted. We cannot see them.
• To use Ilayra you create an account with your name, age, email and a password. We keep these encrypted, in India, only to run your account.
• Anything else leaves your phone only for a purpose you switch on, and you can switch it off at any time, as easily as you switched it on.
• We never sell your data, never show ads, never use your data to train AI, and never share it for marketing.
• Safety features are always free.

1. Data we collect for your account

• First name, middle name (optional) and surname — to address you and to identify your account if you contact us.
• Age — because the law gives extra protection to people under 18.
• Email address — to sign you in, verify it is yours, and send password-reset codes.
• Password — we never store it. We keep only a one-way hash (Argon2id) that cannot be turned back into your password.
• One-time email codes — kept as a one-way hash, usable once, for 15 minutes.

How it is protected: names and email are encrypted on our servers; your email is looked up only through a one-way code; our servers are in Bangalore, India. We keep account data until you delete your account. Registrations that are never verified are deleted after 7 days.

Emails from us say only "Ilayra code" or "Ilayra sign-in" — never anything about your health.

2. Data that stays on your phone

Cycle and symptom logs, pregnancy details, kick and contraction records, mood and sleep, mood check-in answers, haemoglobin results and iron-tablet records, diet and fitness plans and workouts, intimacy notes and Bandhan special days, weekly check-ins and quiz results (adults who choose that section), whether you want pregnancy, contraception and Bandhan content (and, only if you choose to say so, that you are married), fasting days, check-up dates, doctor-visit questions and medicines, evidence-locker entries and photos, children's vaccination records, trusted contacts, silent-SOS settings (including your code word), app-lock settings and AI coach conversations stay on your phone, encrypted with a key held by your phone's secure hardware. Nothing in this list is sent to us unless you choose to share it (for example, sharing your doctor visit card or exporting your evidence record), and then it goes only where you send it.

If more than one person uses the same phone, each account has its own encrypted space with its own key; one person cannot see another's data.

3. Data that leaves your phone only if you allow it

Each purpose has its own switch in You › Privacy Centre. All are off until you turn them on.

• SOS through our server — your first name, your trusted contacts' phone numbers and your location, so we can text your contacts and share your live location for 60 minutes. Your location is encrypted so that only your contacts can read it; we cannot. Shared with: our SMS provider (to deliver the text). Kept: location as unreadable ciphertext for 30 days; contact numbers are not stored. Without this switch, SOS still works through your phone's own SMS app.
• SOS contacts who use Ilayra (part of SOS through our server) — instead of a phone number, you can invite someone who uses Ilayra with a one-time code; they agree by entering it in their own app. We store only the link between your two accounts. When you send SOS (or miss a Safe Walk check-in), each of them gets an alert in their Ilayra app with your first name, the time, your live-location link and your last known place, and can reply ("I'm coming"). If you choose, they also see your mobile number so they can call you. Alerts are encrypted on our server and deleted after 24 hours; either of you can end the link at any time. Your health information is never part of it.
• Safe Walk server timer — your first name, your contacts' numbers (encrypted) and your expected arrival time, so your contacts (by text, and in their Ilayra app if they use it) are alerted even if your phone is switched off. Deleted as soon as you check in or the alert is sent.
• AI coach — your question, with names, phone numbers, email and ID numbers removed, plus your life stage, language and age band. Shared with: our AI provider, which processes it only to write the reply, does not keep it and does not train on it. We keep only a count of messages per day, for 90 days. If you report a coach answer ("Report"), we receive that answer, the reason and any note you add — never your question — linked to no account, and keep it for one year to make the coach safer.
• Encrypted backup — a file locked with a passphrase only you know. We cannot open it. Kept until you delete it.
• Apple Health / Health Connect — read on your phone only, never uploaded.
• Help improve the app (never for under-18s) — anonymous counts of screens used and crash reports, never health data. Kept 14 months.
• Offers and news (never for under-18s) — occasional messages. Until you switch off.
• Research (never for under-18s) — de-identified, combined statistics for approved research partners, shown to you before any study.

We also keep a record of your consent choices and a content-free activity log (for example, "SOS started at 21:04") for one year, because the law asks us to be able to show how we handled data.

• Period help — if you turn it on: the mobile numbers of up to 3 helpers you choose (stored encrypted) and, when you ask for help, your message and first name, delivered to those helpers in their Ilayra app and by text message. Messages are deleted after 7 days. A helper can see only what you send them, and either of you can end the link at any time.
• Partner offers (Plus, adults only) — if you turn it on: which coupons you take or which lucky draws you enter, linked to your account, so the outlet can check your code and we can be fair (one per member, monthly limits). We use your age and how long you have been a member to decide which offers you can see; your life stage and state are matched on your phone and never sent. Outlets never receive your name, email, phone number or any health information — at the counter they see only the coupon and its code, and in reports only totals of 10 or more. Coupon records are deleted 90 days after the coupon is used or expires. When you first join Plus we also record, linked to your account, the welcome gift you received (a coupon, extra days or gift packs), so it is given only once; it is deleted with your account.
• Signed declaration — if you choose to see pregnancy, contraception and Bandhan content, you first sign a short declaration by typing your name. We keep your typed name (encrypted), the version of the declaration and the time, as proof that you gave it — nothing about your health or what you log. Choosing "Don't show it" withdraws it and deletes this record; it is also deleted with your account.

4. Who we share data with

We use these service providers (data processors) under contracts that bind them to our instructions and to keep your data secure:

• DigitalOcean — servers in Bangalore, India.
• Cloudflare — secure network connection to our servers. It sees only encrypted data.
• Our AI provider (Anthropic) — AI coach replies, under a zero-data-retention agreement. Located outside India; receives only de-identified text.
• Our email provider (Brevo) — sending verification and reset codes.
• Our SMS provider — delivering SOS and Safe Walk texts.
• RevenueCat, Apple App Store and Google Play — subscriptions. They receive an anonymous ID, never health data.
• Meta (WhatsApp Business) — only if you subscribe to WhatsApp updates: your WhatsApp number receives our messages. We never send health information on WhatsApp, and you can stop at any time by replying STOP or in the app.
• Razorpay — direct payments, if you buy a pass outside the app stores. You enter your payment details on Razorpay's own secure page; we receive only the payment ID, amount and status, linked to your account. We keep payment records for as long as tax law requires (currently 6 years for GST) — if you delete your account, they are kept without your name or email.

We disclose data to authorities only when Indian law requires it, and we will tell you unless the law forbids it. We never sell or rent personal data.

5. Children and teenagers

Users must be at least 12. If you are under 18, you can use the trackers and safety tools without anyone's permission, because that data stays on your phone. Before any of your data leaves your phone, a parent or legal guardian must agree, and we verify that. We never track, profile, or show targeted content or advertising to anyone under 18.

6. Your rights

Under the DPDP Act you can, in the app:

• Access — see every time data left your phone ("Privacy receipts") and download everything the app holds, and what our server holds about your account — your plan and payments, signed-in devices, coupons, and who is in your SOS circle and period-help group (Privacy Centre › Download my data).
• Correct and update — edit your profile and account details at any time (My profile).
• Erase — delete your health data (Privacy Centre), or your whole account (My profile › Delete account), on your phone and on our servers.
• Withdraw consent — turn any switch off; "Turn all off" withdraws everything in one step. Our server then stops using what it holds for that purpose: turning off partner offers removes your lucky-draw entries and unlinks your coupons from your account; turning off SOS through our server removes the mobile number you shared with your SOS circle. Withdrawal does not affect processing done before it.
• Nominate — name someone to exercise these rights for you if you die or become unable to.
• Grievance — complain to our Grievance Officer in the app or at [email protected]. We acknowledge at once and reply within 90 days, usually within 7.
• Data Protection Board — if you are not satisfied with our reply, you may complain to the Data Protection Board of India.

7. Deleting your account

My profile › Delete account. You confirm with your password. We delete your account and everything linked to it on our servers immediately, and destroy the key to your data on your phone. If you tell us why you are leaving, we keep only that reason — with no link to you — for one year, to improve Ilayra.

8. Security

Your data is encrypted on your phone and in transit (TLS 1.3 plus an extra layer of encryption for every request). Our servers are in India with strict access control. See Data security for details. If a personal data breach affects you, we will tell you without delay, along with the Data Protection Board and CERT-In, as the law requires.

9. Where your data is processed

Our servers are in India. The AI provider processes de-identified questions outside India. No data is transferred to any country restricted by the Government of India.

10. Cookies and tracking

The Ilayra app does not use advertising identifiers, cookies or third-party trackers. The live-location page we send to your contacts uses no cookies and no tracking.

11. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app and ask for your consent again before using your data for anything new. The version and date are shown at the top.

12. Contact

Grievance Officer: [name to be published], [company name to be published], [registered office to be published], [email protected].

Ilayra gives general health information. It does not diagnose or treat and is not an emergency service. In an emergency, call 112.