Privacy Policy

This notice is given by Yekar Technologies Pvt Ltd, Building number 245, Sector 20 HUDA, Kaithal, Haryana (“Yekar”, “we”), under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025. It covers the yekar.health app for iPhone and this website; when the Android app is released, we will update this policy to describe it before it is available. For the personal data described here we are the data fiduciary: we decide why and how it is used.

Much of what you log in yekar.health is about your health: what you drink and eat, and how much you move. We use it to provide the app to you, and for nothing else.

• Your account. When you sign in with Apple or Google, we receive an identifier for your Apple or Google account and, if they share it, your email address. With Sign in with Apple you can choose to hide your email; we then receive a relay address from Apple. We keep the time zone of your phone, so your day starts and ends at your midnight. We use these to create and secure your account, and to let you sign in with either Apple or Google once you link both.
• What you log. Water, with the amount and time; meals, with their names, items, amounts, calories and, where known, protein, carbs and fat; activities, with their type, time and calories; your daily goals and your reminder settings. We store them so you can see them on any day, in History and in your export.
• Apple Health, if you connect it. With your permission in iOS, the app reads water, dietary energy, workouts and active energy from Apple Health, starting with the last 30 days, and sends us: water and dietary energy entries recorded by other apps (with the name of the app that recorded dietary energy), your workouts (their type, time and calories), and your active energy as one total per day. It leaves out what yekar.health itself saved. Active energy by the hour, shown on the Activity screen, is read on your phone and not sent to us. The app also saves the water and meals you log to Apple Health. Data from Apple Health is never used for advertising or marketing.
• The assistant. When you write to the assistant, your message, with today's date, your time zone, your goals and today's totals, is sent to Yekar.AI, which runs the assistant and keeps the conversation so it can follow it. Your name, email address and Apple or Google identifiers are not sent. When the assistant logs or changes an entry for you, it does so with a key that works only for your account and expires within ten minutes, and we record which action it took and when.
• On your phone. Entries waiting to be sent and your most recent days are kept on your phone, so the app works offline. Your sign-in is kept in the iOS Keychain, on that device only. Water reminders are scheduled on your phone.
• Website visits and messages. This website has no sign-in, sets no cookies and runs no analytics or advertising trackers. The host delivering it may keep technical request logs, such as an IP address, the time and the page requested, to operate and protect it. If you email us or use a WhatsApp link, we receive your contact details and what you send, and use them to answer you.

We do not sell personal data, use it for advertising, or use your health data for anything other than providing the app to you.

We process your account and health data with your consent, which you give when you sign in and start using the app, and, for Apple Health, when you allow access in iOS. You can withdraw it at any time: turn off the app's Apple Health access in the iOS Settings or Health app, stop using the assistant, or delete your account in the app. Withdrawing consent does not affect what was done before it.

• Your account and everything you logged: until you delete your account. An entry you delete disappears from the app and from your export straight away; we keep a deleted copy of it with your account until the account is deleted, so a phone that was offline cannot bring it back.
• When you delete your account in the app, your account and every entry are removed from our database at once. Copies in our backups are removed within [BACKUP RETENTION PERIOD].
• The assistant's conversation is kept by Yekar.AI for [ASSISTANT CONVERSATION RETENTION].
• Messages you send us: for one year after the conversation ends.

The service providers on our Sub-processors page host and run the service for us, under contract. Your data is stored with Railway in Singapore. Apple and Google handle your sign-in under their own terms, and Apple Health data stays on your device and in your iCloud under Apple's terms until the app sends us the parts described above. We disclose personal data to authorities only where the law requires it.

The app talks to our servers over HTTPS. Sign-ins use short-lived keys, renewed with a key that changes on every use; if an old key is used again, every sign-in it belongs to is ended. We store those renewal keys only as hashes. Each request is limited to the signed-in person's own data, and the assistant's access is limited to one account for ten minutes at a time.

As a data principal, you may:

• access your data: Settings → Export my data saves everything you logged as a file, and you may also ask us for a summary of the personal data we hold and who we have shared it with;
• correct or update it: edit or delete any entry in the app, or ask us;
• erase it: Settings → Delete account and data, or ask us;
• withdraw consent as set out above;
• nominate another person to exercise these rights for you if you die or become unable to;
• have a grievance redressed by our Grievance Officer.

Write to [email protected] with any request. We may need to confirm your identity first, and we answer within the time the Digital Personal Data Protection Rules, 2025 allow.

Grievance Officer, Yekar Technologies Pvt Ltd, Building number 245, Sector 20 HUDA, Kaithal, Haryana. Email: [email protected].

If you are not satisfied with our answer, you may complain to the Data Protection Board of India after using our grievance process.

yekar.health is not meant for anyone under 18, and we do not knowingly collect a child's personal data. If you believe a child has an account, write to [email protected] and we will delete it.

When this policy changes, we publish a new version with its effective date at the top of this page. If a change affects how we use your data, we ask for your consent again where the law requires it. See also our Terms of Service and Cookie policy.