Privacy Policy

• Your full name and email address.
• Your password. Passwords are securely stored in encrypted form and are never stored in plain text.
• Your billing or profile address: address line 1 and 2, city, state, ZIP/postal code, and country. The country you choose determines which payment provider processes your donation and which entity issues your tax receipt (India → Razorpay, INR, 80G receipt; elsewhere → Stripe, USD, 501(c)(3) receipt).
• If you are donating from India, your PAN (Permanent Account Number). See section 4.
• Your donation and purchase history, and your subscription/entitlement status.
• Tax receipts. We generate a PDF receipt, email it to you, and keep a copy on file.

You do not need an account to donate on our public website. When you donate as a guest, we collect:

• Your name and email address.
• Your phone number (optional).
• Your full postal address.
• The country you select for the donation.
• The donation amount.
• If the donation is from India, your PAN — see section 4.

This information is stored on the donation record so we can process the donation and issue your receipt. While you are still filling in the form, it is held temporarily on a pending “donation intent.” If you start a donation and do not finish it, the personal information on that abandoned intent is scrubbed when the intent expires. We may keep non-identifying fraud-prevention signals from it.

Everything in this policy about your rights, retention, and deletion applies to donors without accounts as well as to account holders.

• Sign-in token. When you sign in to the mobile app, your authentication token is stored in encrypted device storage — the iOS Keychain or the Android Keystore — not in plain files.
• Push notifications. If push notifications are enabled and you allow them, we process a device push token through Expo Notifications and Apple APNs or Google FCM to send you notifications. You can turn notifications off in your device settings.
• Standard technical and usage data. Device and app information, IP address, and server logs. We use these to keep the service running and to detect fraud and abuse. On the public donation page this includes the donor’s IP address and the result of the Cloudflare Turnstile bot check.

• No analytics. The app contains no analytics or crash-reporting software development kits, and we do not track your in-app activity for analytics purposes. Baseline platform telemetry generated by Expo and by the Apple App Store and Google Play is outside the foundation’s control and is governed by those companies’ own policies.
• No advertising. The app contains no third-party advertising SDKs. We do not build advertising profiles and we do not track you across other apps or websites.
• No microphone access and no audio recording. The app plays audio; it does not record it and does not use any recording API.
• No location data. The app does not use any location API and does not collect your location.
• No payment storage. Card and bank information is entered into and handled by our payment processors (Stripe or Razorpay). It never reaches our systems and we cannot see it.

Our website and web app use essential cookies, local storage, and similar technologies needed for sign-in, security, fraud prevention, and service operation. The public donation page also uses Cloudflare Turnstile to help detect automated abuse. We do not use advertising or cross-site tracking cookies. If we introduce non-essential cookies or similar technologies, we will provide any notice or consent required by applicable law, including in the EEA and UK.

You can delete your account from your account settings in our web app. You may also request deletion by emailing support@bhagavadgitafoundation.org.

When you request deletion, we immediately suspend access to your account and entitlements and cancel any recurring-donation mandate associated with the account. You may restore the account by signing in within 12 days. After that 12-day grace period, we permanently purge the account record. You will no longer be able to sign in, and your account credentials and profile information are deleted.

• Account data: kept while your account is active; after a deletion request, access is suspended immediately and the account is purged after the 12-day restoration period unless restored.
• Donation and charitable tax-receipt records: retained for as long as necessary to satisfy applicable legal, accounting, tax, audit, charitable, and regulatory obligations, which may in practice require permanent retention for certain records. This applies to both US 501(c)(3) and India 80G donation records.
• Subscription and gift-purchase receipts: retained for 7 years for bookkeeping, tax, audit, compliance, and dispute-resolution purposes.
• Abandoned guest donations: if you start a donation on the public site and do not complete it, the personal information on that pending donation intent is scrubbed when it expires. Non-identifying fraud signals may be retained.
• Server and security logs: retained only as long as needed for security, fraud prevention, and normal system operations. They are routinely cleared during system maintenance and redeployments.

Wherever you live, you may ask us to:

• Access the personal information we hold about you.
• Correct information that is wrong or out of date.
• Delete your account and personal information, subject to the record-keeping obligations described in section 7.
• Request a copy of eligible personal information where applicable law requires us to provide one.
• Opt out of non-transactional email and of push notifications. Transactional messages such as donation receipts cannot be opted out of while you are donating, because we are required to send them.

To exercise any of these, email support@bhagavadgitafoundation.org. We may need to verify your identity before acting — usually by confirming control of the email address on the account or donation. We will respond within the time required by applicable law. We will not discriminate against you for exercising these rights.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we collect, use, and disclose; the right to request deletion; the right to correct inaccurate information; the right to a portable copy; and the right to opt out of the sale or sharing of your personal information.

We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit. You may exercise your rights using the contact details above, and you may designate an authorized agent to act for you. We will not discriminate against you for exercising your rights.

Residents of other US states with comprehensive privacy laws have comparable rights and may use the same contact details.

If you are in India, the DPDP Act, 2023 applies to your personal data and we act as the Data Fiduciary. You have the right to:

• Obtain a summary of the personal data we process about you and the processing activities we carry out.
• Know which Data Processors and other entities we have shared your data with.
• Have your personal data corrected, completed, updated, or erased — subject to the retention we are legally required to carry out for 80G receipts and FCRA compliance.
• Nominate another person to exercise your rights in the event of your death or incapacity.
• Have your grievance addressed by us before escalating.

We process your data primarily on the basis of your consent, given when you create an account or make a donation, and for certain legitimate uses permitted by the Act, including compliance with Indian law. You may withdraw your consent at any time, which will end future processing but does not affect processing already carried out or records we must keep by law.

For India privacy grievances, contact the Bhagavadgita Foundation support team at support@bhagavadgitafoundation.org. If your grievance is not resolved, you may complain to the Data Protection Board of India.