# Privacy Policy — KrishIndria
**Last updated:** 8 June 2026
**Effective from:** 8 June 2026
KrishIndria ("we", "our", "the app") is operated by Manoj V ("the Operator") and provides an AI-powered soil-analysis and farming-advisory service to Indian farmers. This policy explains what personal information we collect, why we collect it, how we use it, where it's stored, and the rights you have over your data. It is designed to comply with India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") and Google Play's Data Safety requirements.
By creating a KrishIndria account, you consent to the practices described here.
---
## 1. Who we are
- **Operator:** Manoj V
- **App name:** KrishIndria
- **Contact:** [email protected]
- **Country of operation:** India
For the purposes of the DPDP Act, the Operator is the **Data Fiduciary** for personal data processed via this app.
---
## 2. What information we collect
### 2.1 Information you give us directly
| Category | Examples | When collected |
|---|---|---|
| **Identity** | Full name, mobile number, optional email address | At registration |
| **One-time passwords (OTP)** | 6-digit SMS verification codes (stored only as a bcrypt hash, expires in 5 minutes) | At registration / login |
| **Farm profile** | Farm name, land size band, irrigation type, crop category, farming-experience band, previous crop, current growth stage | During onboarding and edits |
| **Soil-test inputs** | pH, moisture, electrical conductivity, soil temperature, N/P/K levels, organic carbon, target crop | Each time you run a soil test |
| **Practice flags** | Whether you use chemical pesticides, biocontrols, or organic farming | During soil test or onboarding |
| **Chat content** | Questions you send to the KrishiBot assistant and the AI's replies | Each KrishiBot session |
| **Language preference** | One of English / Hindi / Telugu / Kannada | When you change language |
### 2.2 Information collected automatically
| Category | Examples | Purpose |
|---|---|---|
| **Approximate location** | Latitude/longitude when you grant the permission, reverse-geocoded to district and state | Pull local weather, suggest region-appropriate crops, district-level analytics |
| **Device & app info** | App version, build number, Android version, anonymous device model | Crash diagnostics and analytics |
| **Diagnostic data** | Stack traces from app crashes (sent via Sentry), API error rates | Fixing bugs |
| **IP address & request metadata** | Captured at our backend per request | Abuse prevention, rate limiting |
### 2.3 Information we DO NOT collect
- Photos, microphone audio, contacts, calendar, SMS content, call logs, or any biometric data
- Financial information (we never ask for bank details, UPI IDs, credit card numbers, or Aadhaar numbers)
- Real-time GPS tracking — location is fetched only when needed to power a feature
---
## 3. How we use your information
We use your information to:
1. **Authenticate you** via OTP, and keep you signed in via short-lived JWT access tokens (30 minutes) and refresh tokens (7 days).
2. **Provide the core service** — running soil-stress analysis, AI crop recommendations, and KrishiBot conversations.
3. **Personalise the experience** — adjusting recommendations to your farm size, crops, growth stage, and region.
4. **Improve the app** — by aggregating anonymised soil-test and stress-index data to refine our recommendation models. Aggregations are never published with information that could identify an individual farmer.
5. **Maintain reliability** — using Sentry crash reports and Render server logs to detect, diagnose, and fix bugs.
6. **Comply with law** — when required by Indian government authorities under a lawful order.
We do **not** use your information to show third-party advertising. KrishIndria contains no ads.
---
## 4. Where your data is stored
- **Primary database:** MongoDB Atlas, hosted in the AWS Mumbai (`ap-south-1`) region.
- **Application backend:** Render Cloud, Singapore region (the closest free-tier region to India).
- **Crash diagnostics:** Sentry (servers in the European Union).
- **AI conversation processing:** Groq (servers in the United States) — your KrishiBot message is sent to Groq's Llama model to generate a reply. Messages are not retained by Groq for training per their API terms.
- **SMS delivery:** Twilio (servers in the United States) — used to send the 6-digit OTP. Twilio retains delivery logs for a limited period per their policy.
We rely on industry-standard encryption: TLS 1.2+ for all data in transit, and MongoDB Atlas's encryption-at-rest for stored data. Passwords and OTP codes are stored only as bcrypt hashes; we never have access to the plaintext.
---
## 5. Sharing your information
We share your information only in these narrow situations:
- **Service providers** named above (MongoDB Atlas, Render, Sentry, Groq, Twilio) — each acts as a Data Processor under our instructions and is bound by their own published privacy commitments.
- **Aggregate research with public-sector agricultural bodies** (e.g., Krishi Vigyan Kendras, ICAR institutes) — only as district-level or state-level aggregates with no individual identifiers.
- **Legal compliance** — when compelled by a lawful order from an Indian authority.
We do **not** sell your personal data. We do not share it with advertisers, data brokers, or any commercial third party not listed here.
---
## 6. How long we keep your data
| Data type | Retention period |
|---|---|
| Account profile (name, phone, farm details) | Until you delete your account, or 24 months of inactivity, whichever is first |
| Soil-test history | Same as above |
| KrishiBot conversation logs | Last 6 messages per session, kept for one year |
| OTP records | Auto-deleted from the database 5 minutes after issue |
| Refresh tokens | Auto-deleted on logout or after 7 days |
| Server logs (IP, request metadata) | 30 days |
| Sentry crash diagnostics | 90 days |
Once the retention period ends, the data is permanently deleted from primary storage. Backup copies may persist for up to 30 additional days before scheduled destruction.
---
## 7. Your rights
Under the DPDP Act, you have the right to:
- **Access** the personal data we hold about you
- **Correct or update** inaccurate information (most fields are editable inside the app)
- **Erase** your data — by contacting us at the email below; we will complete deletion within 30 days
- **Withdraw consent** to the processing of your data at any time, which will result in account deletion
- **Nominate a representative** to exercise these rights on your behalf in the event of your death or incapacity
- **Make a complaint** to the Data Protection Board of India if you believe we have mishandled your data
To exercise any of these rights, email **[email protected]** with the subject "DPDP Request" from the email associated with your account, or include your registered mobile number for verification.
---
## 8. Children
KrishIndria is not directed at children under 18 years of age and we do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, please contact us so we can delete it.
---
## 9. Security
We protect your data with:
- TLS 1.2+ encryption for all network traffic between the app, our backend, and our service providers
- bcrypt hashing for passwords and OTPs
- Short-lived JWT access tokens (30 minutes) with refresh-token rotation
- Rate limiting on OTP requests (max 5 per identifier per hour)
- Server-side input validation on every endpoint
- Daily encrypted backups of MongoDB Atlas
No system is perfectly secure. If we become aware of a personal-data breach affecting you, we will notify you and the Data Protection Board of India within the timeframes prescribed by the DPDP Act.
---
## 10. AI advisory disclaimer
KrishIndria provides AI-generated soil and crop advisory. These recommendations are **informational only** and are **not** a substitute for professional agronomy advice from a qualified Krishi Vigyan Kendra (KVK), agricultural extension officer, or independent expert. Conditions vary across farms; outcomes may differ. **The Operator is not liable for crop loss, financial loss, or any other damages arising from decisions made on the basis of the app's recommendations.** Always cross-check critical decisions with a local expert before acting on them.
---
## 11. Permissions the app requests
| Permission | When asked | Required? | If denied |
|---|---|---|---|
| `ACCESS_FINE_LOCATION` / `ACCESS_COARSE_LOCATION` | First time you tap a feature that needs your district (weather, region-specific crop advice) | Optional | You can use the app, but region-specific features are limited |
| `INTERNET` | At install | Required | The app cannot function offline |
| `RECEIVE_SMS` / `READ_SMS` | **NOT requested** — we do not auto-read OTPs from your inbox; you enter them manually | n/a | n/a |
---
## 12. Changes to this policy
We may update this policy from time to time. Material changes will be announced inside the app and via the contact channel below at least 30 days before they take effect. Continued use of the app after the effective date constitutes acceptance.
The "Last updated" date at the top of this page always reflects the latest revision.
---
## 13. Contact
For any privacy-related question, complaint, or rights request:
- **Email:** [email protected]
- **Subject line:** "DPDP Request" or "Privacy Inquiry"
We aim to respond within 7 working days and complete data-rights requests within 30 days.