Privacy Policy

Ayunara is a meal-planning and nutrition app. We collect what we need to build your plan and track your progress, and nothing else. We do not sell your data, we do not share it with advertisers, we run no third-party analytics or advertising trackers, and we never use your health information to target you with anything.

Ayunara is operated by Nexflow AI Labs, the sole proprietorship of Nishit Sharma, at 3rd Floor, No. 401, SJR Redwoods Maple Block, Harlur Road, Off Sarjapur Road, Bengaluru, Karnataka 560102, India (GSTIN 29EZBPS5537N1ZI). We are the data fiduciary (controller) for the information described here.

For any privacy question, or to exercise the rights below, contact hello@nexflowailabs.com. Under India’s Digital Personal Data Protection Act, 2023, our Grievance Officer is Nishit Sharma, reachable at nishit@nexflowailabs.com. We respond to privacy requests within 30 days.

You can sign in to Ayunara with Google or with an email address and password. If you choose Google, Google asks for your permission and then sends us a limited set of information from your Google profile. We request only these scopes:

• openid and your Google account identifier — used solely to recognise you as the same person on your next sign-in.
• email — your email address, used as your account identity, to send you service messages such as a payment receipt, and to let you contact support from the address we know.
• profile — your name and profile picture, used only to show you your own name and avatar inside the app.

That is the entire list. Ayunara does not request access to your Gmail, Google Drive, Google Calendar, Contacts, Photos, or any other Google service, and it cannot read, create or modify anything in your Google Account.

Limited Use. Ayunara’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except the service providers listed below who process it on our behalf to run the app, and we do not allow humans to read it except where you explicitly ask us to for support, where it is necessary for security or to comply with the law, or where the data has been aggregated and de-identified.

You can withdraw Ayunara’s access to your Google Account at any time at myaccount.google.com/permissions. Doing so stops future sign-ins; to also erase the data we hold, delete your account from your Ayunara profile as described under “Deleting your data”.

Account. If you sign up with an email address instead of Google, we store that address and a cryptographic hash of your password. We never store the password itself and cannot read it. We send you a link to confirm the address before the account becomes usable, and a link to set a new password if you ask for one.

Profile and goals. Age, sex, height, weight, activity level, dietary preference, cuisines you like, foods you dislike, allergies, your country, and the goal you set. We use these to calculate your calorie and macronutrient targets and to choose meals you can actually eat.

Activity you log. Meals (including any photo you take of a meal), water, workouts, steps you choose to record, weight entries, and the streak and progress figures derived from them.

Health documents. Only if you choose to upload them. See the next section, which you should read before uploading anything.

Payment records. If you subscribe, we store your subscription status, the plan, the amount, and the identifiers our payment provider gives us. We never receive or store your card number, UPI PIN, CVV or bank credentials.

Technical and usage. Standard server request logs, the device type and browser you used, your timezone, and the referring source if you arrived from a link or campaign. These are recorded in our own database to understand how people find and use Ayunara. We do not run Google Analytics, advertising pixels, or any third-party tracker.

Crash reports. If the app errors, we record the error and the screen it happened on so we can fix it. These reports are scrubbed of names, email addresses and document content before they leave your device.

Ayunara uses Google’s Gemini models to generate meal plans, recipes, coaching replies, menu analysis and meal-photo estimates. The relevant parts of your profile and your request are sent to Google for processing and the result is returned to you.

If you upload a lab result or health report, the document is sent to Google Vertex AI to extract biomarker values and produce dietary guidance. We ask for your explicit consent before the first upload and record that consent. Under Google Cloud’s terms, data you send to Vertex AI is not used to train Google’s models.

The findings we derive — for example “LDL cholesterol — high” and the resulting list of foods to limit — are then included in later requests when you use the coach, the meal scanner, menu analysis, recipes or your daily summary, so that the advice accounts for them.

We do not sell this data and we do not use it for advertising. You can withdraw consent and delete every uploaded document and derived finding at any time from your profile.

Ayunara is not a medical service. Nothing it produces is a diagnosis or a treatment plan. Always talk to a qualified clinician about your results.

We do not sell personal data to anyone. We share it only with the service providers below, each of which processes it on our instructions under a data processing agreement, and only to the extent needed to run the service:

• Supabase — database, authentication, file storage and server functions. Your account data, logs, photos and documents are stored here, in the Mumbai (ap-south-1) region in India.
• Vercel — application hosting and content delivery. Serves the app and records standard request logs.
• Google — sign-in, and the AI features described above (the Gemini API, and Vertex AI for health-report analysis).
• Razorpay — payment processing for subscriptions. Razorpay collects your payment details directly and we never see them; it returns only a payment and subscription identifier and the status.
• Resend — delivery of account emails such as the address confirmation and password reset. It receives your email address and the contents of that message, and nothing else.
• Sentry — error and crash monitoring, receiving the scrubbed reports described above.

We may also disclose data if required by law, to enforce our terms, or to protect the rights and safety of our users. If Ayunara is ever acquired, we will tell you before your data moves to a new controller.

Your account data is stored in India. Some providers above process data outside India, including in the United States and the European Union. Where that happens, the transfer is covered by the provider’s standard contractual clauses or an equivalent safeguard in our agreement with them.

We do not use advertising or tracking cookies. Ayunara stores a small amount of data in your browser to work at all: your sign-in session, so you are not asked to log in on every page; and a few preferences such as your shopping-list ticks and dismissed prompts. If the app is installed to your home screen, a service worker caches the interface so it loads offline. Clearing your browser storage signs you out and clears these.

We keep your account data for as long as your account is open. Payment and invoice records are kept for eight years after the transaction, to meet Indian tax and accounting obligations. Aggregated, non-identifying usage counters are retained for billing reconciliation and are not linked to you.

You can delete your account at any time from the You tab in the app, using “Delete your account”. Deleting removes your profile, meals and meal photos, water, workouts, steps, weight and progress history, uploaded health documents and every derived finding, and cancels any active subscription.

Deletion takes effect immediately in our live systems. Encrypted backups are overwritten on a rolling schedule and any remaining copy is purged within 30 days. If you would rather we did it for you, email hello@nexflowailabs.com from your account address and we will delete it and confirm.

Traffic is encrypted in transit with TLS, and data is encrypted at rest by our database and storage providers. Every table carries row-level security so one account cannot read another’s data, and health documents are served through short-lived signed links rather than public URLs. Access to production systems is limited to the operator named above. No system is perfectly secure, and if a breach ever affects your personal data we will notify you and the Data Protection Board of India as the law requires.

You can access, correct, export or delete your data at any time from your profile, or by emailing hello@nexflowailabs.com. Under India’s Digital Personal Data Protection Act you may also nominate another person to exercise these rights on your behalf, and you may complain to the Data Protection Board of India.

If you are in the United Kingdom or the European Economic Area, you additionally have the right to object to or restrict processing, the right to data portability, the right to withdraw consent at any time without affecting processing already carried out, and the right to complain to your local supervisory authority.

Ayunara is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us data, contact hello@nexflowailabs.com and we will delete it.

If we make a material change we will tell you in the app before it takes effect. The date at the top of this page always reflects the current version.