Privacy Policy

Draft date: [[OWNER: EFFECTIVE DATE]] · Last reviewed: [[OWNER: REVIEW DATE]]

This policy describes how [[OWNER: FULL LEGAL ENTITY NAME]] (“BharatOS”, “we”, “us”) handles information when you use BharatOS. Our public contact is bharatos.support@gmail.com · +91 8226036375. Our public website is [[OWNER: PUBLIC_DOMAIN]].

At a glance

• Google account sign-in is separate from connecting Gmail, Calendar or Drive.
• Google service access is optional and uses the permissions shown in Google's consent screen.
• Cloud sync is optional. If enabled, it stores a limited, account-scoped snapshot in Supabase; pausing sync does not delete that snapshot.
• WhatsApp Business and Instagram Professional cloud messaging are not deployed in the documented build. The messaging section below describes intended behavior only, not a live service.

Information we handle

Depending on the features you use, BharatOS may handle account identity, content you create in the app, and information from services you separately connect. The project documents chat and companion-chat content, tasks, memories, artifacts, workflows, reminders, study material, goals and notes as possible content in an opted-in app-data snapshot.

Free-text content can contain anything you type or copy, including sensitive information or information about other people. BharatOS does not promise that all secrets or third-party information are automatically detected or removed from free text.

Google sign-in and Google services

Signing in through Google-backed BharatOS authentication requests basic identity scopes (openid, email and profile). This sign-in does not by itself connect Gmail, Calendar or Drive. Each Google API connection is a separate, optional consent.

When you connect Google services, the current source describes these features and permissions:

The current project notes say Google API calls are made from the client and Google OAuth tokens are stored in the user's encrypted local OS-backed vault, not intentionally sent to the BharatOS Supabase messaging backend. Do not authorize a service unless you are comfortable with the permissions displayed. The owner must validate that the shipped scopes still match this page and should reduce permissions where possible before public review.

Google API data use: The draft approval narrative says Google API data is not sold, used for advertising, or used to train AI models. The owner must verify that this remains true for the exact release and every connected processor before publication: [[OWNER VERIFY: GOOGLE DATA LIMITED-USE STATEMENT]].

Optional app-data sync and Supabase

App-data sync is a separate, optional choice for each account. If you opt in, BharatOS can sync an account-scoped snapshot to Supabase, up to 5 MB. The documented categories can include chats, companion chats, tasks, memories, artifacts, workflows, reminders, study material, goals and notes.

The snapshot is designed to exclude credentials, API keys, connector/session state, browser cookies, PC-control grants and executable approvals. However, text you enter may itself contain sensitive information. Local file paths are not automatically uploaded, and the current project notes say the binary-file selection/list/delete interface is not exposed.

You can pause syncing, but the existing cloud snapshot remains. Deleting that cloud snapshot is a separate action. BharatOS uses Supabase for authentication and the optional cloud snapshot described above. The owner must add the applicable Supabase hosting region, retention/backup details, processor terms and other subprocessors: [[OWNER: SUPABASE REGION, PROCESSORS AND BACKUP RETENTION]].

WhatsApp and Instagram messaging — not live

WhatsApp Business and Instagram Professional onboarding and messaging server code are present in the source, but the messaging migration, functions, secrets, worker schedule and live provider configuration are not deployed, and provider approvals are not complete. These features are not currently available as live BharatOS services. Do not treat the following as a description of current processing until the owner confirms deployment and updates this policy.

If launched as currently designed, a user would separately connect their own eligible business/professional account, then explicitly enable a rule containing literal reply text and an optional keyword filter. Rules start disabled. The server would process verified inbound sender, text and event data to send the configured reply to the same sender within the supported reply window, subject to cooldown and rate limits. Replies would not be AI-generated. The intended design does not include campaigns, marketing messages or template sending. Provider tokens are intended to be encrypted and isolated per user.

The intended retention design redacts message/sender content after seven days and retains event, deduplication and status metadata for thirty days. This retention has not been verified in a live service. Users are intended to be able to pause, disconnect and delete messaging data after launch.

Sharing and disclosure

We use Google when you choose Google sign-in or connect Google APIs, and Supabase for account authentication and the optional app-data snapshot described above. [[OWNER: LIST ALL OTHER SERVICE PROVIDERS / HOSTING / ANALYTICS]]. We do not describe website cookies, hosting logs or analytics here because their production configuration has not been confirmed.

The project status notes say product telemetry and payment processing are disabled. The owner must re-check this for the exact public release and update this policy if it changes. We do not claim that third-party providers are controlled by BharatOS; their own terms and privacy notices apply.

Storage, security and retention

The documented design uses an encrypted local vault for provider tokens and owner-scoped access controls for cloud snapshots. No security measure can guarantee absolute security. [[OWNER: CONFIRM SECURITY PRACTICES, HOSTING LOCATION AND INCIDENT CONTACT]].

Cloud snapshots remain while retained in your account; pausing sync alone does not erase them. Other data retention periods, service logs, backups and request records must be specified by the owner: [[OWNER: RETENTION SCHEDULE AND BACKUP DELETION PERIODS]].

Your choices and deletion

You can choose whether to connect Google APIs and whether to enable app-data sync. You can pause sync or separately delete the cloud snapshot. For deletion instructions and a request route, visit the Data Deletion page. The project notes do not establish a complete BharatOS account-deletion process, so the owner must define and verify one before publication: [[OWNER: ACCOUNT DELETION PROCESS]].

For Google data, you can also review or revoke third-party access in your Google account settings. Confirm the exact in-app disconnect/token-removal behavior for the release before publishing specific instructions.

Children, location and legal rights

Age eligibility, applicable jurisdictions, legal basis, rights-request process and cross-border transfer disclosures have not been supplied. The owner must complete them with qualified advice before publication: [[OWNER: AGE RULES, JURISDICTIONS, LEGAL BASIS AND USER RIGHTS]].

Policy updates and contact

We may update this policy when BharatOS changes. The owner must specify how material changes will be announced and the effective date. Contact: bharatos.support@gmail.com · +91 8226036375. Product/legal entity: [[OWNER: FULL LEGAL ENTITY NAME AND ADDRESS, IF REQUIRED]].

Draft URL target: [[OWNER: FINAL PRIVACY_POLICY_URL ON VERIFIED PUBLIC_DOMAIN]]. Terms · Data deletion · Home