Kept for reference. This is the privacy policy for a version of the app without ads. The current policy is at /privacy.
Draft. Under legal review before the app launches.
Effective date: 1 November 2026
Last updated: 1 November 2026
Shloka Scroll ("the app", "we", "us") is published on the Apple App Store (iPhone) and Google Play (Android) by Banupriya Sankarasubbu, an individual developer based in Singapore. This policy explains what happens to information when you use the app. It is written to meet India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (together, the "DPDP Act"), as well as Singapore's Personal Data Protection Act 2012.
1. The short version
- There are no accounts, no sign-up, no ads, no in-app purchases, no analytics, no tracking and no third-party SDKs that collect data.
- To protect our translations from bulk copying, our content server (on Cloudflare) keeps a pseudonymous device ID, daily download counters (35 days) and abuse records with hashed IP addresses (180 days). No names, emails or raw IP addresses (§3).
- Your bookmarks, reading position, streak and settings are saved only on your device. We cannot see them.
- If you email us, we receive only what you choose to send, and we use it only to reply.
2. Information stored on your device
The app saves the following locally on your phone so it can work:
| What | Why |
|---|---|
| Verses you bookmark | So you can find them again |
| The last verse you read | So the app opens where you left off |
| Your streak (days you opened the app) | To show your reading streak |
| Your settings (meaning language, Sanskrit script, display mode) | To remember your preferences |
None of this leaves your device. It is never sent to our server. It is not personal data that we process, because we never have access to it. Deleting the app deletes all of it. If your phone backs up to iCloud, Google or your computer, this data may be included in that backup, which Apple's, Google's or your own backup terms govern, not ours.
3. Our content server and copy protection
The verses, translations and word meanings are downloaded from our server, api.shlokascroll.com, rather than shipped inside the app (a few sample verses are built in). The server runs on Cloudflare. To stop our translations being copied in bulk, the server only answers genuine copies of the app on genuine devices, and it limits how much each device can download per day. This means the following information is processed:
| What | Details | Kept for |
|---|---|---|
| A pseudonymous device ID | A random identifier for the app's installation on your device (on iPhone, derived from the App Attest key; on Android, from a random install ID the app creates). It is not your name, email, phone number or advertising ID. We store a one-way hash of it, together with the platform (iPhone or Android), the security key and counter Apple's App Attest uses (iPhone only), when it first and last connected, how many sessions it has started, and its status (normal, flagged for review, or blocked). | 12 months after the device last contacts our server, then deleted automatically (a blocked device that keeps trying counts as contact). Ask us and we will delete it sooner. |
| Daily usage counters | For each device and day: which chapters were downloaded, and how many chapter and verse downloads were made. | 35 days, then deleted automatically |
| Abuse records | When a device or connection goes over our limits or fails the genuine-app check: the device ID, the time, what happened, and a keyed one-way hash (HMAC) of the IP address. We don't store raw IP addresses. | 180 days, then deleted automatically |
| Invisible marks in the text | The translations sent to each device contain invisible characters unique to that device. If our text is copied and published, we can tell which device it came from and block that device. | Nothing extra is stored: the marks are recalculated from the device ID. Once the device record is deleted, a copy can no longer be linked to that device. |
| Short technical logs | Server events such as errors, blocked requests and (on iPhone) promotional-offer signings: the device ID, the type of event and, for security events, the hashed IP address. Used to fix problems and spot abuse. | Up to 7 days, then deleted automatically by Cloudflare |
| Your IP address | Used at the moment of each request to apply rate limits, and handled by Cloudflare to deliver and protect the service (for example against attacks). Our own logs never contain raw IP addresses. | Not stored by us, except as the hash above. Cloudflare keeps short-term service logs under its own policy. |
Genuine-app checks. On iPhone, Apple's App Attest confirms that requests come from an unmodified copy of the app on a real Apple device. On Android, Google Play Integrity does the same: our server sends Google a token from the app and receives Google's verdict. Apple and Google process the information needed for these checks under their own privacy policies (https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy).
Why. Only to deliver the content you ask for, to prevent abuse, scraping, automated access and bulk copying of our translations, and to trace and stop leaks. We don't use any of this for ads, analytics or profiling, we don't link it to your name, email or advertising identifier, and we don't sell it.
Who. Cloudflare, Inc. stores and processes this data for us as our data processor (https://www.cloudflare.com/privacypolicy/). We have no accounts, so the device ID isn't linked to your name, email or phone number.
Legal basis. This processing is necessary to provide the content you choose to download. We rely on DPDP Act s.7(a) (information you provide voluntarily for a specified purpose).
4. Information we receive only if you contact us or suggest a correction
If you email us (for example, the address on our support page, or the email fallback of "Suggest a correction"), we receive your email address, your message and anything you attach. We use it only to reply to you and, for translation reports, to fix the text. We do not add you to any mailing list. We delete support emails within 12 months of the conversation ending, unless the law requires us to keep them longer.
For this limited purpose we act as the "Data Fiduciary" under the DPDP Act. Your email is held by our email provider, Google (Gmail), under Google's terms.
Suggesting a correction in the app. If you use Suggest a correction on a verse and tap Send, our server receives:
- what you're commenting on: the verse, which part (translation, word meaning or Sanskrit), the meaning language and script, and the word you tapped, if any;
- your suggestion (up to 1,000 characters);
- the app and content versions;
- your device's pseudonymous ID (see the content-server section), so we can link related suggestions, reply in a future update if needed, and stop abuse.
There are no name or email fields. Please don't include personal details in your suggestion. We use suggestions only to review and correct the text. We keep each suggestion with the device ID for 12 months after we've dealt with it, then delete the device ID; the text of a suggestion we act on may be kept without it as part of our record of corrections. If sending fails, the app offers to open an email to support@shlokascroll.com instead; then the email paragraph above applies.
5. Sharing a verse
When you share a verse, the app creates the image on your device and passes it to your phone's standard share menu. Whatever happens next (Messages, WhatsApp, Instagram and so on) is between you and that service. We do not receive the image or know who you shared it with.
6. Apple and Google
Apple (App Store) and Google (Google Play) distribute the app and may collect information under their own privacy policies (https://www.apple.com/legal/privacy/ and https://policies.google.com/privacy), for example download statistics and, if you have opted in on your phone, crash reports and usage data that they share with developers in aggregated or anonymised form. We do not control this collection, and we cannot use it to identify you.
7. Children
The app is suitable for readers of all ages. Under the DPDP Act, anyone under 18 is a child. The content server's device ID, download counters and abuse records (§3) apply to every installation, whatever the reader's age. They are used only for security and copy protection, never for tracking, profiling or ads, and they aren't linked to anyone's identity. We don't knowingly collect any other personal data from children.
If a child emails us, we will use the message only to reply, and we may ask that a parent or guardian contact us instead.
8. Your rights
Under the DPDP Act (if you are in India), Singapore's PDPA, and similar laws elsewhere, you have the right to:
- ask what personal data of yours we hold. In practice, your support emails and your device's records on our content server. Because there are no accounts, we can find those records only from the device identifier shown in the app under Settings → Credits; include it in your request. If you reinstalled the app, each installation has its own identifier and only the current one is shown. We can't find an earlier installation's records without its identifier, but they're deleted automatically 12 months after that installation last connected. If the app shows "None", our server holds no records for this installation.
- ask us to correct or erase it.
- withdraw any consent you gave. For email, simply ask us to delete the conversation.
- nominate another person to exercise these rights for you if you die or become incapacitated (DPDP Act, s.14).
- have a grievance addressed (see §9). If you are in India and not satisfied with our response, you may complain to the Data Protection Board of India.
To use any of these rights, email us at the address below. We will respond within the time the law requires, and in any case within 30 days.
9. Contact and grievance officer
Grievance Officer / Contact: Banupriya Sankarasubbu
Email: support@shlokascroll.com
Postal: on request.
We acknowledge grievances within 48 hours and aim to resolve them within 30 days.
10. Security
We hold no accounts, names or contact details on our server. The content server stores only the pseudonymous records in §3, with IP addresses kept only as keyed hashes; access is limited to us, and our email and Cloudflare accounts are protected by two-factor authentication. Data sent to our server is encrypted in transit (TLS). If a personal-data breach affecting you ever occurs, we will notify you and the relevant authorities as the law requires.
11. Where data is processed
Your bookmarks and settings stay on your device. Content-server data is processed by Cloudflare, which runs a worldwide network; we ask Cloudflare to keep our server's database in the Asia-Pacific region, but Cloudflare doesn't guarantee a particular country. Support emails are stored by Google. Both may process data in countries outside India or Singapore, including the United States. The DPDP Act allows this, apart from any countries the Government of India restricts.
12. Changes to this policy
If the app's handling of information changes (for example, if we add optional accounts or cloud sync, or change what the content server keeps), we will update this policy before that version is released, change the "Last updated" date, and, where the law requires it, ask for your consent in the app first.
Our website
This policy also covers our website, shlokascroll.com. It has no cookies, no analytics, no ads and no forms. It is hosted by Cloudflare, which processes visitors' IP addresses and basic request data to deliver the pages and protect them from attacks, under Cloudflare's privacy policy (https://www.cloudflare.com/privacypolicy/). Email sent to support@shlokascroll.com is forwarded by Cloudflare Email Routing to our mailbox.
13. Governing law
This policy is governed by the laws of Singapore. This does not remove any rights you have under the mandatory data-protection or consumer laws of the country where you live, including India's DPDP Act.