Bodhara is in development and is not on Google Play yet. This describes how the app is designed and how this website works today. We will update it, and the date above, before public release.
Effective 27 October 2026 · Version 2026-10-27
- Summary
- What we process
- Health data
- Health Connect
- Connected providers
- AI
- Sharing
- Retention
- Your rights
- Security
- Contact
1. Who we are
Bodhara is a local-first health companion for Android, published by an independent developer trading as Tidemark Labs (in this policy “Tidemark Labs”, “we” and “us” all mean that developer). I am the controller of personal data processed through the Bodhara app, its server and this website (for UK and EU law) and the “data fiduciary” (for India’s Digital Personal Data Protection Act). Privacy and grievance contact: sj@passthebot.dev. Identity and postal address details are available on request to data protection authorities, app stores and platform partners that are entitled to them.
2. The short version
- Your health records, journal, experiments, meals, cycle and body logs, and your scores stay on your phone. Our server has no way to receive them.
- If you make an account we hold your sign-in identity, a profile, a few preferences, your consent record and your plan status.
- We never sell personal data, never share it for advertising, never use health data to show ads or build advertising profiles, and never use your data to train AI models.
- Connected providers, AI, community and Pro are optional, and each is described below.
3. What stays on your phone
| Data | Where it lives | Leaves the phone? |
|---|---|---|
| Health records read from Health Connect (steps, sleep, heart rate, HRV and similar) | The app’s private storage | No. Excluded from Android backup and device transfer |
| Scores, trends, training load and estimates we calculate from those records | Calculated on the phone | No. The server never receives scores |
| Journal entries, experiments, meals, cycle and body logs | The app’s private storage | No |
| Sync state and onboarding choices | The app’s private storage | No |
Bodhara only reads from Health Connect, never writes to it, and requests only the read permissions it needs. Health Connect and your source apps keep their own copies under their own policies.
4. What we process, why and on what basis
| Data | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Account identity: email address, account id, sign-in method (Firebase Authentication) | Create and secure your account, verify email, sign you in | Contract |
| Profile and preferences: units, step goal, sleep goal | Start a new phone with your settings | Contract |
| Consent record: your choices, the wording version you saw, when | Prove and respect your choices | Legal obligation and legitimate interests |
| Plan status (Free, trial, Pro), trial record, AI usage counter | Deliver and limit paid features, prevent trial abuse | Contract and legitimate interests |
| Community name, hide-position switch, weekly counts you share, invite codes (only if you join) | Run boards and invites | Consent |
| Provider connection status and encrypted tokens (when providers launch) | Keep the connection you asked for | Consent |
| Early-access list: email, answers, billing preference, consent version, time | Email you about launch; judge demand for plans | Consent |
| Technical request data (IP address, browser, request path, status) | Deliver, secure and debug the site and server | Legitimate interests |
| Calculated facts for an AI summary (section 9) | Write the summary you ask for | Consent |
5. Health data and your consent
Health information is sensitive. Bodhara reads it only after you grant permission in Android’s Health Connect screen and accept the in-app notice, and it uses it only to show you your own data, scores and insights on your phone. You can withdraw consent at any time by revoking permissions in Android settings, turning a feature off in the app, or deleting your data or account. Withdrawal does not affect what we did before, and history already on your phone stays until you delete it. Bodhara is not a medical device and does not diagnose.
6. Health Connect and Google user data
Bodhara’s use and transfer of information received from Health Connect and other Google APIs will adhere to the Health Connect permissions and data policy and the Google Play User Data policy, including the Limited Use requirements. In particular, we use Health Connect data only to provide and improve the user-facing features you see in the app. We do not sell it, use or transfer it for advertising (including retargeting or interest-based ads), or let humans read it unless you ask us to, it is needed for security or to comply with law, or it is aggregated and anonymised. We do not transfer it to third parties except as described in section 12.
7. Your account and our server
If you create an account, Firebase Authentication (Google) processes your email, account identifier and sign-in method (email and password, or Google). We reject unverified email-and-password accounts. Our server, which only we can reach, stores the profile, preferences, consent record, plan status and optional community data above in Google Firestore (Mumbai region). The database denies all direct access from apps, so only our server can read it, and only after checking your sign-in. The app also sends a Firebase App Check token so the server can tell genuine app traffic from abuse. Server logs record the request method, path, status and a request id. They do not hold emails, tokens, request bodies or health values.
8. Connected providers (Garmin, Polar and others)
Direct connections to other wearable and health providers are planned, and none is live today. These commitments apply to every provider connection we launch:
- We connect only after you approve on the provider’s own authorization page. We never see or store your provider password.
- We request only the data types and permissions needed for the feature you chose, and use the data only to show it to you in Bodhara.
- Our server stores connection status and encrypted access tokens. It does not store your provider health records. Provider data is used on your phone.
- We never sell provider data, use it for advertising or profiling, or use it to train AI models, and we follow each provider’s developer terms. Where a provider’s terms prohibit AI use, its data is never sent to AI (for example Oura and Strava).
- Disconnecting in the app, revoking access at the provider, or deleting your account deletes the stored tokens and ends our access. We also honour deletion and de-registration notices the provider sends us.
- Providers have their own privacy practices. Data they hold is governed by their policy and your account with them.
9. Optional AI summary
An AI summary is written only if you turn AI on and tap to request it, and it is a Pro feature. The request contains calculated facts behind your top insight: a metric label, dates, a few numbers (value, usual range, days recorded) and source identifiers. It does not contain your records, journal text, name, email or user id.
- It is sent through OpenRouter to a model provider. We require zero data retention and no use for training, and we refuse to fall back to providers that do not offer it. If none is available you get a plain, non-AI summary.
- Sensitive classes (meals, cycle, blood pressure, glucose, ECG and health records) are included only if you have separately agreed to that class.
- Data from sources whose terms do not allow AI use is never sent.
- Answers are checked before you see them. Anything invented, uncited, diagnostic or containing links is rejected. No decision with legal or similarly significant effect is made by automated means.
10. Optional community
If you join a board, our server stores a display name you chose, a hide-position switch, one whole-number count per weekly challenge that you tap to share (a small number, not a measurement) and invite codes with a redemption count. It cannot accept steps, heart rate or timestamps. A counts-only board still says something about your habits, so share only what you are comfortable with. Leaving deletes your name and counts. Deleting your account also deletes invites and redemptions.
11. Pro, trial and payments
Our server decides your plan and the 14-day trial (one per account) using its own clock. When paid plans open they will be sold through Google Play, so Google handles your card details and billing. We receive your subscription status and a purchase token to verify it, not your card number. Deleting your Bodhara account does not cancel a Google Play subscription: cancel it in Google Play so you are not charged again.
12. Who we share data with
We do not sell personal data and do not share it for cross-context behavioural advertising. We use these service providers (processors) only to run Bodhara, under their standard data-processing terms:
| Provider | Role | Data |
|---|---|---|
| Google (Firebase Authentication, Firestore, App Check) | Sign-in, server database, abuse protection | Account identity, profile, preferences, consent record, plan status, community data |
| Cloudflare | Website hosting, delivery, security, early-access list storage | Technical request data; early-access list records |
| OpenRouter and its model providers | Writing the optional AI summary | Calculated facts only (section 9) |
| Google Play | Distribution and billing (when available) | Subscription status and purchase token |
| Connected providers you authorise | Source of your health data | Authorization codes and tokens (when providers launch) |
We may also disclose data if the law or a valid legal process requires it, to protect rights, safety or security, or in a merger or sale of the business (with notice to you and the same protections).
13. International transfers
Our providers may process data in several countries, including India, the United States and the EU. Where personal data of people in the UK or EEA is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as standard contractual clauses.
14. This website
This site has no analytics, advertising pixels, tracking cookies or third-party fonts, and we do not respond differently to “Do Not Track” because we do not track. Our host, Cloudflare, processes technical request data such as IP address and browser details to deliver and protect the site.
15. The early-access list
If you join the early-access list on this site we store your email address, whether you are most interested in Free or Pro, your answer to “would you pay for Pro?”, the currency and billing period (monthly or annual) shown to you, the consent version and the time. We use it to email you about Bodhara’s launch and early access and to judge demand for a paid plan. It is stored in Cloudflare’s key-value storage, is not sold or shared for advertising, and contains no payment details because none is collected. Every email we send tells you how to opt out, or write to sj@passthebot.dev from that address.
16. How long we keep data
| Data | Kept |
|---|---|
| Data on your phone | Until you delete it or uninstall |
| Account, profile, preferences, consent record, plan status, community data | While your account exists. Deleted when you delete your account (community data also when you leave) |
| Provider connection tokens | Until you disconnect, revoke or delete your account |
| Early-access list record | Until you ask us to delete it, or 12 months after you joined, whichever is first |
| Server and hosting logs (method, path, status, request id; technical request data) | A short rolling period, then deleted |
| Records we must keep by law (for example consent or billing evidence) | As long as the law requires |
17. Security
I take security seriously and describe it here as it actually is, including its limits. See also the security page.
- On your phone: health data sits in the app’s private storage inside Android’s app sandbox. Android backup and device transfer are switched off for the app’s data. The local database is not separately encrypted by Bodhara, so it relies on Android’s sandbox and your device’s own encryption and screen lock. Use a screen lock.
- In transit: the app and this website use encrypted connections (HTTPS).
- On the server: every data request needs a verified sign-in, the same error is returned for every authentication failure, request sizes and rates are bounded, and the database refuses all direct access from apps. Users can reach only their own records.
- Provider tokens: when providers launch, access tokens are encrypted, bound to their owner, stored server-side only and deleted on disconnect or account deletion. One-time sign-in codes and states are never written to logs.
- Logs: only method, path, status code and a request id. No emails, tokens, request bodies or health values.
- Abuse protection: Firebase App Check and limits on request size, frequency and AI use.
- Access: only the developer can administer the server and database.
I do not hold any security certification (such as ISO 27001 or SOC 2) and do not claim to. No system is perfectly secure. If you find a vulnerability please report it under the vulnerability disclosure policy.
If something goes wrong: if a personal data breach is likely to put your rights at risk, I will notify you and the relevant authority without undue delay and in any case within the periods the law requires, and say what happened, what data was involved and what you can do.
18. Notice for US state privacy laws
In the last 12 months the categories of personal information I handle are: identifiers (email address, account id); internet or app activity (technical request data); account and plan information; and, only if you choose to join, community information. I do not sell personal information, do not “share” it for cross-context behavioural advertising, do not use or disclose sensitive personal information (including health data) for purposes beyond providing the app you asked for, and do not knowingly collect data from children under 13. Health data stays on your device. If a US state consumer health privacy law applies to you (for example Washington or Nevada), this policy is also my consumer health data privacy policy, and you have the right to access, delete and withdraw consent as described below. I will not discriminate against you for exercising your rights.
19. Your rights and choices
- Everyone: revoke Health Connect permissions, delete local data, export your records from the app, turn AI and other consents off, leave the community, disconnect providers, unsubscribe, or delete your account. See data deletion.
- UK and EEA: you may ask to access, correct, delete, restrict or port your data, object to processing, and withdraw consent. You may complain to your data protection authority.
- California and other US states: you may ask to know, access, correct and delete personal information, and to opt out of sale or sharing. We do neither. We do not discriminate against you for using these rights.
- India: you may ask for access, correction, erasure and grievance redress, and nominate someone to exercise rights for you. Write to the contact below. If we have not resolved a complaint you may approach the Data Protection Board of India.
Email sj@passthebot.dev from your account email. We may need to verify it is you, and we aim to reply within 30 days. Because most health data never reaches me, requests about it are best handled in the app. If you disagree with my decision you may appeal by replying to me, and you may also complain to your regulator.
20. Children
Bodhara is not directed at children. Do not use it if you are under 13, or under the age of digital consent where you live. Tell us if you believe a child has an account and we will delete it.
21. Changes
We post changes here with a new effective date and version. If a change affects what we collect or how we use health data, we will tell you in the app and ask for consent again where the law requires it.
22. Contact
One address for privacy requests, grievances, legal notices and help: sj@passthebot.dev. Please put “Bodhara privacy”, “Bodhara legal” or “Bodhara support” in the subject.