Privacy Policy

Last updated October 4, 2026. This policy explains what DashaHQ collects, why, and how you stay in control of it.

In short

• We collect only what the product needs: your email and your birth data.
• Your birth data is sensitive. It is used to compute your chart and for nothing else.
• We do not sell personal data, ever.
• You can delete everything yourself, at any time, in one step — the deletion is immediate.

What we collect

• Email address — to sign you in with a one-time code and to deliver your daily reflection emails.
• Birth data — your birth date, and optionally your birth time and birth place. This is the raw material of your chart. Birth data is sensitive personal data under India’s DPDP Act and special-category adjacent under the GDPR: it describes you closely, so we treat it with corresponding care.
• Derived data — your computed chart, dasha periods, and the readings generated for you.
• Conversations and memory — if you use the chat: what you send, the replies, and the facts the chat remembers for you. Memory has a switch on the chat page. Turn it off, remove single entries, or clear it all. Turning it off stops anything new being remembered; it does not delete what is already stored. Removing entries or clearing memory deletes the remembered facts and thread notes — the conversation transcript itself stays in your history until you delete that conversation or your account. What you say in chat is never sold or shared.
• One session cookie — dhq_session, HttpOnly, keeps you signed in. There are no advertising cookies.
• An analytics identifier — PostHog uses it to count page views and tell one visit from the next. The identifier is your account id: signed in, your page views are linked to your account. It is linked to nothing else — never your birth data, your email address, or the text of a reading — and clearing your browser storage removes the browser-side copy.
• Server logs — minimal request logs for security and reliability.

How we use it — and what we never do

Your data is used to compute your chart, generate your daily readings, send your daily reflection email, carry on your conversations, and keep the service secure. We do not sell your personal data. We do not share it with advertisers or data brokers, and we do not use your birth data to train models or to profile you beyond your own readings.

Processors we rely on

• Cloudflare — hosting and database (Workers, D1).
• DeepInfra — runs the language model that writes reading prose; your computed chart data is sent there to produce each day’s text.
• Resend — delivers our emails.
• PostHog — product analytics, so we can see which parts of the product people reach for. It records page views, and the steps of signing in and creating a chart. We leave autocapture off, so it never sweeps the page looking for things to track, and session recording off, so it never watches a session. An event carries an account id and nothing else, never your birth data, your email address, or the text of a reading.
• Google — two touchpoints: the web fonts our pages use are served from Google’s font CDN, so your browser fetches them from Google (those requests carry the page address, never your birth data or the text of a reading); and if you sign in with Google, Google shares your Google account’s email address with us so we can find or create your account.

Legal bases (EEA/UK — GDPR)

We process data to perform our contract with you (computing and delivering readings), with your consent (the daily reflection email, which you can withdraw from at any time), and in our legitimate interests (security and abuse prevention).

Your rights (India — DPDP Act, 2023)

You may access, correct, or erase your personal data, withdraw consent, nominate another individual to exercise your rights, and raise grievances with us or with the Data Protection Board of India.

Your rights (EEA/UK — GDPR)

You may request access, rectification, erasure, restriction, portability, and object to processing, and you can complain to your supervisory authority.

Deletion on request

Deletion is self-service and immediate. Signed in, call DELETE /api/account and your whole account is erased on the spot and you are signed out — the exact list is under Retention below. Rather ask us? Email privacy@dashahq.com from your account address and we run the same deletion by hand, promptly.

Retention

Account data is kept while your account is active. Readings are kept so you can revisit them. Conversations and chat memory are kept while your account is active; on the chat page you can clear memory, delete single conversations, or wipe the whole chat history yourself at any time. Deleting your account (above) removes, in one atomic step: your conversations and chat memory, your reading notes, your readings, your charts, your sessions and pending sign-in codes, and your account row — the email address included. Server logs are kept for a short, fixed window.

Security

Data travels over TLS, access is limited to what operations need, and secrets live outside the codebase. No system is perfectly secure, and we treat your birth data as the sensitive information it is.

International transfers

Data is processed in India and in the regions of the processors listed above. Cross-border transfers rely on recognized safeguards such as contractual clauses.

Children

DashaHQ is not for anyone under 18, and we do not knowingly collect data from children. Sign-up enforces this: onboarding rejects a birth date under 18 years.

Contact

DashaHQ is operated by [LEGAL ENTITY NAME — pending counsel]. Privacy questions and deletion requests: privacy@dashahq.com. Anything else: hello@dashahq.com.