Privacy Policy

This is the version you accept when you sign up for the app.

What changed in this version (2026-10-25): While you set up a journey, including before you have an account, the coach may search the web about the goal you name, and a plan written from a search lists its sources, which are kept with the journey. Practice videos are no longer looked for on the web.

This Privacy Policy explains how we collect, use, disclose, and otherwise process personal data in connection with the Astonik mobile app, the website at astonik.com, and related services (together, the "Services"). Please read it together with our Terms & Conditions.

Key points

• Astonik is a habit and skill-practice coaching service. It is not a medical, mental-health, therapeutic, crisis, legal, or financial service, and it does not provide professional advice.
• Coaching in the Services is generated by artificial intelligence and may be inaccurate or incomplete.
• Messages you send to the AI coach are processed by a third-party AI provider to produce replies. Please do not include information you would not want processed in this way.
• If you report a coach reply, we keep a copy of that reply together with your reason and any note, so that we can review it.
• Journal entries and certain notes are stored on your device rather than on our servers. We cannot recover them if they are lost from your device.
• We collect error reports to keep the Services working. Only if you turn them on, we also collect usage statistics to understand whether the Services work and to improve them.
• The Services are for adults aged 18 or older.
• You can export, correct, and delete your data from inside the app, as described in section 8.

Which of this applies to you

Astonik is two separate things, and they do not collect the same data or use the same providers. This table is the short answer; the sections that follow say which one they describe.

You do not need an account to use the website, and nothing you do there is connected to an app account if you have one. TypeSafe AI is used only on the website. Amazon Web Services, Groq and DeepInfra are used only in the app.

1. Who we are and how to contact us

Astonik
Tumkur, Karnataka, India
Contact: hello@astonik.com

Astonik is the trading name of Sandeep Bharadwaj K ("we", "us"), who is responsible for the personal data processed under this policy. We are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the controller for the purposes of data protection laws in the European Union, the United Kingdom, and Switzerland.

Grievance Officer

Sandeep Bharadwaj K · hello@astonik.com

We have designated a Grievance Officer to receive and respond, on our behalf, to questions, requests, and complaints about this policy or our handling of personal data, from any country, including for the purposes of Canadian privacy law.

Astonik is run by one person. We aim to acknowledge a grievance as soon as we reasonably can, and to resolve it within 30 days. Some requests take longer — if yours will, we will tell you and say why. If you have not heard from us within a few days, please send a reminder; it is more likely that a message went astray than that it was ignored.

Where the Services are offered

The Services are not currently offered in the European Union, the European Economic Area, or the United Kingdom. If we begin to offer them there, we will appoint representatives where the law requires it and update this policy.

2. Personal data we collect

Sections 2.1 to 2.9 describe the app. The website at astonik.com collects much less and uses a service provider the app does not use at all; it has its own section at 2.10.

2.1 Information you provide

We intend to keep your email address separate from your practice data. Our main database generally identifies you by a randomly generated account identifier rather than by your email address.

Plans you paste in. You can paste a plan copied from another app or AI chat to start a journey. The app reads your clipboard only when you tap Paste, and it reads the pasted text on your device: it removes links and email addresses, and it may refuse a plan outside what Astonik supports. Only the days and steps you then choose to create are saved, like any other journey. The rest of the pasted text is not sent to us or to any AI provider, and it is discarded when you leave that screen. Please paste only text you are allowed to use, and leave out other people's personal information.

2.2 Conversations with the AI coach

What the coach uses. When you talk to the AI coach, we process what you send, the replies it generates, and the parts of your account a reply needs, such as your journeys and their recent check-ins, the days you practise and any time away you plan, and tonight's step.

Before you have an account. When you set up your first journey, you can use the coach before you create an account. Before you start, the app asks your date of birth and whether you agree to our Terms and this policy, and says what will be sent; until you agree, you cannot go on to talk or type. Once you agree, the app signs in with a temporary identifier the first time it needs the coach; the identifier is not linked to your email address or to any account. If you talk it through, the app sends what you say (as text) to our AI providers, to check it for safety and to write the coach's questions, and the coach's words to our voice provider to be read aloud (section 5). If you type it instead, the app asks its own questions on your device and sends the coach only your journey's name and, if you write it, what you say about where you are with it, so the coach can map the stages of that skill and find yours; these are checked for safety in the same way. Either way, the coach may also search the web about the goal you name (see Web searches below). Nothing else you type is sent until you create an account. We keep the temporary identifier, a record of your agreement (the versions you accepted, and that you said you are 18 or over), and counts of how much you used, to apply usage limits; we do not store what you say or what the coach replies. These are generally deleted within about 7 days, and the app forgets the identifier when you sign in or create an account. Technical and log information (section 2.3) is collected as for any use of the app. Because the temporary identifier is not linked to you, we may not be able to find its records from an email request; they are deleted within the period above in any case.

Web searches. When a question needs facts the coach may not have, it may search the web. It may also search while you set up a journey, for facts about the goal you name (for example an exam's current format), when it asks its questions, maps the stages of a skill, or writes your plan; this can happen before you have an account too. The search is a short query about the topic, written by the coach; it is not your message, and we aim to keep contact details and other personal details out of it. A reply that uses a search lists its sources, and they are kept with the conversation. A plan written with a search lists its sources with the plan, and they are kept with the journey.

Your conversations. We keep your conversations so the coach can pick up where you left off. You can delete a conversation at any time from the coach's list of conversations; that removes it from our servers and from your device. Conversations you do not delete are generally deleted after about 180 days (section 7). A journey's conversations are deleted when the journey is permanently deleted.

Notes the coach keeps about you. So that it does not start from nothing each time, the coach writes short notes for itself:

• a note about you across all your journeys, such as your goals, your preferences, and when you like to practise;
• for each journey, a note from when it began, and short notes on what you find hard, what works for you, and anything you have said you will do;
• a short note after each check-in; and
• a summary of your own answers about whether you felt ready to move on.

These notes are meant to be about your practice — what you are working on, what helps, when and where you practise, and why the goal matters to you. They are not meant to record how you feel, your health or body, your money, your beliefs, or contact details, and the app is designed to leave such things out of them. If a note ever includes something like that, you can delete it. How many days you kept and how often you said you were ready are counted from your check-ins each time they are needed, and are not stored as a note.

You can see all of these in the app under Your data → What your coach remembers, and delete any of them there. To protect them from someone else using your phone, the app may first send a code to your account's email address; if you cannot receive it, email us (section 1) and we will delete them for you. The notes cannot be edited; to correct one, delete it. A journey's notes are deleted when the journey is permanently deleted.

What deleting a note does, and does not do. Deleting a note removes it. It does not switch note-taking off: as you keep using the coach, it writes new notes, and it can note the same things again from conversations you have not deleted. To remove something completely, delete the note and the conversations it came from, or delete your account.

Please leave out sensitive information. Messages are free text, so you can type anything. The coach does not need, and we ask you not to share, sensitive information such as details of your health, religion, or sex life (section 2.9). If you share it anyway, it is handled as this policy describes, and you can delete it by deleting the conversation.

Reminders the coach writes. If a journey has a reminder, the coach may write its wording and choose a time near the hour you set. When Let the coach choose the time is on for a journey (it starts on for a new journey, and you can turn it off), it may instead choose any time between 7 am and 9 pm, from the times you recently checked in on that journey, the times you first opened that journey on recent days, how you responded to its recent reminders (whether you tapped one or answered Did it or Not today, and how soon), and your device's time zone; the hour you set is then the backup. The app keeps those times and answers on your device (section 2.7) and sends the coach a summary of them, as times and fixed answer types. For these journey reminders the coach uses the journey's aim, tonight's step, its notes on that journey, and counts and times of your recent check-ins, opens and reminder answers — not your journal or your conversations. By default a reminder is written so that it does not repeat your own words or recount your history. If you turn on Personal reminders (Profile → Practice, or a journey's reminder settings), a reminder may include one detail of your practice in your own words, such as where you stopped. You can also ask the coach, in a conversation, to remind you of something: it then writes that reminder from what you said there, shows it to you, and sets nothing until you tap Set it. These are marked as a unique personalised reminder, and you can change or switch them off under Reminders in AI Coach. Reminders appear on your lock screen, where other people may see them; they are designed never to include feelings, health, money, or contact details. Personal reminders are off unless you turn them on, and you can turn them off at any time. The wording is kept on your device (section 2.7).

2.3 Information collected automatically

We do not currently use third-party analytics, advertising, or session-recording tools in the app. The website is covered by section 2.10.

Security and access logs. To keep the Services secure, to investigate incidents, and to meet legal duties to keep logs, we may keep a copy of the records our hosting provider makes when the app communicates with our servers: the time, the network address your device connected from, your account identifier, and what was requested — never the content of what you write. We keep this copy encrypted and separate from your other data, and use it only for security, incident response, and legal compliance. Section 7 says how long.

2.4 Safety records

The Services use automated checks intended to identify messages that may involve a risk of harm or misuse, and may show support resources in response. When a check flags a message, we aim to record the category and the time, rather than the content of the message. We use these records to operate and evaluate our safety features. We do not use them for marketing, and they are not intended to be used to make assessments about your health.

Because these records help us demonstrate that safety features work, they cannot be deleted individually. They are deleted when you delete your account, or after the period in section 7.

2.5 Reports you send

If you report a coach reply, we keep a copy of the reply you saw, the reason you select, any note you add, and the time. The copied reply may include personal information from your conversation, so please review it before sending. We use reports to investigate replies and to improve our safety and moderation. We do not intend to send report content to our AI providers or to use it to train AI models.

2.6 Information from third parties

We receive information from Google when you choose Google sign-in (section 2.1), and from service providers that help us operate the Services (section 5).

2.7 Information stored on your device

Journal entries, notes after a focus session, and optional notes on new check-ins are designed to be stored in encrypted form on your device rather than on our servers. The date, response, and journey of a check-in are stored on our servers so that your history works. Notes created before this storage method was introduced may remain in earlier server records, and are covered by your export and deletion rights.

Please note:

• This content is not end-to-end encrypted. When it is needed to produce a coach reply, or a weekly journal review you request, the relevant content is sent to our AI providers for that purpose. The app asks before sending journal entries for a weekly review for the first time.
• We cannot protect this content from someone who has access to your unlocked device.
• Uninstalling the app, resetting your device, or losing it may permanently delete this content, and we are not able to restore it. It is not automatically transferred between devices. You can keep a copy using Export my data.

The app also stores on your device: your settings and choices (such as Personal reminders, time away you plan, and your answers at milestones), the reminder lines your coach writes for your journeys, for a journey whose coach chooses the reminder time the times you opened it and answered its reminders over about the last three weeks, copies of your conversations with the coach, a copy of your journeys and check-ins so that the app works quickly and when you are offline, and changes you make while offline, such as a check-in, until they reach our servers. Conversations, the offline copy, and unsent changes are designed to be kept in the same encrypted store as your journal. Export my data includes this information, and deleting your account removes what belongs to your account from the device you delete it on.

2.8 Device permissions and files

The app may ask for permission to send notifications, to schedule reminders for the exact time you set or the coach chose, to restore scheduled reminders after your device restarts, and to use the microphone for voice features. We do not ask for access to your contacts or your location. When you attach a file, the app saves the file name to your list; the file itself remains on your device.

2.9 Sensitive information

We do not ask for information about your health, religion, sexual life, or other sensitive matters, and we ask that you do not include it in messages or notes. If you choose to include it, it is processed as described in this policy.

2.10 The website, separately

This section is the whole of what astonik.com collects. It is listed apart from the app because the two are not the same: the website uses a service provider the app does not use, and the app collects things the website never sees. You can read the website without giving us anything.

TypeSafe AI is used on the website only. Nothing in the Astonik app sends anything to TypeSafe AI. What it returns is a classification — a label and a score — not written text: the words you read on that page were written by us in advance and chosen from. Section 5 describes it as a recipient.

A goal that reads as a crisis is never sent anywhere. That check runs in your browser, and when it matches, no request leaves your device at all.

The website sets no cookies, loads nothing from other companies, and has no analytics. It is not part of your account, and you do not need one to use it.

3. How we use personal data

We use personal data to:

• Provide the Services, including creating and managing your account, generating and adapting your plans, turning a plan you paste in into a journey, producing coach replies, daily facts and tips, and the wording of your reminders, sending reminders, searching the web for facts when needed, recommending videos, reading the coach's words aloud and supporting other voice features, and producing a weekly journal review when you request one.
• Personalise the Services, including providing continuity between coaching sessions and adapting plans to your check-ins.
• Keep the Services safe and secure, including identifying messages that may involve a risk of harm and showing support resources, preventing fraud and abuse, applying usage limits, enforcing our Terms, and protecting our users and systems.
• Analyse and improve the Services, including understanding how the Services are used, measuring performance, diagnosing and fixing problems, and researching and developing new products and features.
• Market the Services, including planning, measuring, and improving our marketing, and sending you news and offers about Astonik where the law allows. You can opt out at any time, either by using the unsubscribe link we include in every marketing message or by emailing us at the address in section 1. We act on an unsubscribe request within ten business days at the latest. We do not use the content of your journal entries or your conversations with the coach for marketing.
• Communicate with you, including service messages, responses to your requests, and updates to our terms and policies.
• Comply with law and protect our rights, including responding to lawful requests, keeping records we are required to keep, establishing or defending legal claims, and handling requests to exercise your rights.
• For any other purpose we describe to you when we collect the information, or with your consent.

Aggregated and de-identified data. We may create aggregated or de-identified information that does not reasonably identify you, and use and disclose it for any lawful purpose, including analytics, research, and marketing. We will not attempt to re-identify it, except as permitted by law.

AI training. We do not currently use your content to train AI models, and our agreements with our AI providers restrict them from using data we send to train or fine-tune models. If this changes, we will update this policy and, where required, ask for your consent.

4. Legal bases for processing

India. We process personal data on the basis of your consent, given when you create an account or as otherwise requested in the Services, and for the legitimate uses permitted by section 7 of the DPDP Act, such as complying with law. You may withdraw consent at any time as described in section 8; withdrawal does not affect processing that took place before it.

European Union, United Kingdom, and Switzerland. We rely on the following legal bases:

Providing an email address is required to create an account. Other information is optional, but some features may not work without it.

5. How we disclose personal data

We disclose personal data to the following categories of recipients:

• Service providers that process personal data on our behalf, currently including:
• Supabase, for hosting, database, and authentication. This includes most of the data we hold on our servers, including the encrypted copy of security logs (section 2.3), but not content stored on your device (section 2.7).
• Amazon Web Services (Amazon Bedrock), in the United States, for generating AI coach replies, plans, reminder wording, daily facts and tips, and weekly journal reviews, and for checking messages for safety before a reply is shown. It receives the messages and context needed for each reply. AWS states that Amazon Bedrock does not store these messages and replies by default, does not share them with the companies that make the AI models, and does not use them to train models. AWS also runs web searches for the coach (Amazon Bedrock AgentCore), when a question, or setting up a journey, needs facts the coach may not have. It receives a short search query about the topic, written by the coach — not your messages or account details. AWS states that these searches are served within AWS and not sent to a third-party search engine.
• Groq, for the same purposes, until our move to Amazon Web Services is complete. Groq receives the messages and context needed for each reply. Groq may retain inputs and outputs for up to 30 days, for system reliability and compliance.
• DeepInfra, for reading the coach's words aloud when you choose an Astonik voice. It receives the text being spoken (a coach reply, or the app's own words) and returns audio. DeepInfra states that it keeps this text in memory only while creating the audio, does not log its content, and does not train on it. It processes it in the United States.
• TypeSafe AI, for the fit check on our website only. It receives the goal you type there, and returns a classification rather than written text: it selects among answers we have written in advance. It is not used anywhere in the app. TypeSafe states that it does not train its models on what we send, and processes it in the United States. It does not publish a fixed retention period for request logs, and keeps them for as long as it considers reasonably necessary.
• Google, for Google sign-in if you use it, and for the YouTube Data API, which receives search terms used to find practice videos. We do not intend to send your name, email address, or account identifier to YouTube. The app uses YouTube API Services: information Google receives through them is handled under the Google Privacy Policy, and their use is subject to the YouTube Terms of Service.
• Our website host, for the website and waitlist.
• Providers you interact with directly. When the app shows a YouTube thumbnail or video, your device connects to Google, which receives your IP address and may set cookies under Google's own privacy policy. If you use voice features, your device's speech recognition processes your voice, and if you choose this phone's voice, its text-to-speech service processes the reply text, under their own terms. Depending on your device, this processing may take place in the cloud, for example through Google's speech services. We do not intend to receive or store recordings of your voice.
• Professional advisers, such as lawyers, accountants, and auditors.
• Authorities and others, where required or necessary to comply with law or legal process, to protect the rights, safety, or property of our users, us, or others, or to detect and prevent fraud, security, or safety issues.
• Parties to a business transaction, such as a merger, acquisition, financing, reorganisation, or sale of all or part of our business or assets, including during negotiations.
• Other parties, with your consent or at your direction, for example when you choose to share content from the app.

We do not sell personal data, and the app does not currently display third-party advertising.

6. International data transfers

We and our service providers may process personal data in countries other than the one where you live, including the United States (our database is hosted in Northern Virginia). These countries may have different data protection laws.

For transfers from India, we rely on the DPDP Act, which permits transfers except to countries restricted by the Central Government. For transfers from the EU, the UK, or Switzerland to countries without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses with the UK Addendum and the Swiss adaptations, included in our service providers' data processing agreements. You may request a copy by contacting us.

7. How long we keep personal data

We keep personal data for as long as necessary for the purposes described in this policy, including to provide the Services, analyse and improve them, maintain security, comply with legal obligations, resolve disputes, and enforce our agreements. When we no longer need personal data, we delete it or de-identify it.

We have set up automatic deletion for some kinds of data. The periods below describe our usual practice. Deletion can occasionally take longer than stated, for example because of a technical fault or a failed scheduled task; when we become aware of this, we take reasonable steps to complete it.

When you delete your account, we intend to delete your account data from our active systems promptly, except security and access logs, which we keep for the period in the table above. Our current hosting plan does not keep automatic database backups, so there is normally no backup copy left to remove. If we move to a plan that does, copies may remain in backups for a short period before they are overwritten. We may keep information where the law requires it.

8. Your rights and choices

8.1 Controls in the app

• Export my data provides a copy of your personal data, including content stored on your device, in a machine-readable file.
• You can edit your journeys, steps, display name, and reminder settings, delete any conversation with the coach, and see and delete the notes the coach keeps about you (Your data → What your coach remembers). Before deleting those notes, the app may ask for a code sent to your email; if you cannot receive it, email us and we will delete them for you.
• Personal reminders are off unless you turn them on, and you can turn them on or off at any time (Profile → Practice, or a journey's reminder settings).
• Usage statistics are off unless you turn them on, at sign-up or in Your data → Usage statistics. You can turn them off at any time; this deletes the usage statistics we hold.
• Let the coach choose the time starts on for a journey you create (you can turn it off on the reminder step) and is otherwise off unless you turn it on. You can turn it off at any time in that journey's reminder settings; the app then removes the times it kept on your device for that journey.
• News by email is off unless you tick the box at sign-up or turn it on; you can turn it on or off at any time (Your data → News by email).
• Delete my account deletes your account and associated data as described in section 7. Deletion is intended to be permanent and cannot be undone.
• You can turn notifications off in the app or in your device settings, and opt out of marketing messages using the link in the message, in the app, or by contacting us.

For requests you cannot complete in the app, such as correcting a record without an edit control, contact the Grievance Officer (section 1).

8.2 India

Under the DPDP Act, you have the right to access information about your personal data, to correction, completion, updating, and erasure, to grievance redressal, and to nominate another person to exercise your rights in the event of death or incapacity.

We do not currently have a way to record a nominee. There is no nomination setting in the app and we keep no register of nominees, so we cannot act on a nomination we hold no record of. If you have nominated someone, or if you are acting for someone who has died or become incapacitated, please contact us: we will do what we reasonably can where the request and the relationship can be verified. If we add a way to record a nominee, we will say so here.

You may withdraw consent by deleting your account or by contacting us. If you are not satisfied with our response to a grievance, you may complain to the Data Protection Board of India.

8.3 European Union, United Kingdom, and Switzerland

You have the right to access, rectify, or erase your personal data, to restrict or object to its processing, and to data portability. You may object at any time to processing for direct marketing. Where we rely on consent, you may withdraw it at any time. You also have the right to lodge a complaint with a supervisory authority, including in the EU the authority where you live or work, in the UK the Information Commissioner's Office, and in Switzerland the Federal Data Protection and Information Commissioner. We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

8.4 Canada

You have the right to access and request correction of your personal data and to withdraw consent, subject to legal and contractual restrictions. You may complain to the Office of the Privacy Commissioner of Canada or, in Québec, to the Commission d'accès à l'information.

8.5 United States

Depending on your state of residence, you may have rights to access, correct, or delete personal data, to obtain a copy of it, and to appeal our decision on a request. We do not sell personal data. If we begin to share personal data for targeted advertising, we will update this policy and provide any opt-out required by law.

8.6 Other locations and how to make a request

You may have similar rights under the laws of other countries. To make a request, use the controls in the app or contact us using the details in section 1. We may need to verify your identity before acting on a request, and we respond within the time required by applicable law.

If we refuse a request, we will tell you why. To appeal, reply to that message, or write to us at the address in section 1 with "appeal" in the subject. We will look at the decision again, reply in writing, and tell you how to complain to your regulator if you are still not satisfied.

9. Security

We use reasonable technical and organisational measures intended to protect personal data, such as encryption in transit, encryption at rest provided by our hosting provider, encrypted storage on your device for your journal and other content (section 2.7), access controls including database row-level security, keeping secret service keys on our servers rather than in the app, keeping security logs encrypted and separate from other data, and asking for a code sent to your email before the coach's notes are deleted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs, we will notify the relevant authorities and affected individuals where required by law.

10. Children

The Services are intended only for people aged 18 or older. We ask for your date of birth at sign-up, and before you talk with the coach without an account. Accounts, and the coach, are not available to anyone who indicates they are under 18. We do not knowingly collect personal data from children.

We do not review conversation content to determine a user's age. If you believe an account belongs to someone under 18, please contact the Grievance Officer (section 1) with enough information for us to identify the account. After reviewing the request, we will take reasonable steps to delete the account and its data.

11. Cookies, tracking, and third-party services

Our website does not currently use cookies. The app may display content from third parties, such as YouTube videos and links you save, which are governed by those third parties' own terms and privacy policies — for YouTube, the YouTube Terms of Service and the
Google Privacy Policy. Those third parties, such as Google when a YouTube thumbnail or video is shown, may collect information about you over time and across different websites and services. We do not currently respond to browser "Do Not Track" signals.

12. About the descriptions in this policy

This policy describes our intended practices in general terms. It is not a technical description of every system we use, and our service providers and technical arrangements may change over time. We work to keep our practices consistent with this policy. If we become aware that a practice does not match it, we will take reasonable steps to correct the practice or update this policy.

13. Changes to this policy

We may update this policy from time to time. The version and effective date at the top show when it last changed. If we make material changes, we will notify you in the app or by other appropriate means and, where required by law, ask you to accept the updated policy. We keep a record of the version you accepted and when.

14. Contact

Questions and requests: hello@astonik.com Grievances and privacy requests: hello@astonik.com (section 1)

Astonik is a general wellness and skill-coaching service. It is not medical, mental-health, legal, or financial advice, and it is not a substitute for a qualified professional. Coaching is generated by AI and may be inaccurate; please verify anything important, and do not rely on it for medical, safety, or crisis decisions. If you may be in danger or crisis, contact your local emergency services or a crisis helpline immediately. findahelpline.com lists crisis lines for your country.