Privacy Policy

We are based in Ghatshila, Jharkhand, India. This Policy is written to comply with India’s Digital Personal Data Protection Act, 2023 (“DPDPA”).

1. Who we are, and who to contact

Under the DPDPA, we are the Data Fiduciary — we determine why and how your personal data is processed. You are the Data Principal.

RokaMaybe is built and run by one person. When you write to us, you are writing to her.

2. About data you add concerning other people

RokaMaybe lets you record details about prospective matches (“Prospects”) — names, photos, phone numbers, birth details, biodata, and your own notes, flags, and ratings.

This is the most important section in this Policy, so it is written plainly.

What you are responsible for

You decide who to add, what to record, and why. You confirm you have a lawful basis or the person’s consent to store their information here.

In the arranged marriage process a biodata is created and circulated precisely so that prospective matches and their families can consider it. That is the document’s purpose. But your private notes, flags, and ratings are different — that is information you create, and the Prospect has never seen or agreed to it. Please hold that responsibly.

What we are responsible for

We provide the system that stores and processes this data, so we do not pretend to be a neutral pipe. We are responsible for keeping it secure, for making sure only you can see it, for not using it for our own purposes, and for honouring deletion requests — including requests from Prospects themselves.

Use it for what it’s for

Prospect data may be recorded only for your own genuine, personal purpose of considering a match. It may not be used to harass, surveil, profile, share, publish, or build a record on any person.

Prospects must be adults

You may not add a Prospect who is under 18. The Service enforces this: if a Prospect’s age is under 18 — whether you type it in, edit it, or our AI reads it from an uploaded biodata — the Service will block it. If we discover a child’s data here despite that, we will delete it.

If you are a Prospect reading this

If you believe your information may be held in RokaMaybe by someone considering a match with you, write to namaste@rokamaybe.com.

We will act on your request. If we are reasonably satisfied the request is genuine, we will delete your information — without needing the account holder’s permission. You do not need to be a user of RokaMaybe to ask this of us. We will not ignore you.

3. Information we collect

a) Account information

• Your name and email address, via email/password or Google sign-in.
• Authentication identifiers managed by Google Firebase.

b) Your profile and preferences

• Age, city, education, profession, income range, diet, family preferences, and dealbreakers.
• Astrology-related details you choose to provide: date, time and place of birth; rashi; nakshatra; gotra; manglik status.
• A profile photo, if you upload one.

c) Prospect data you enter

• Names, ages, cities, professions, photos, phone numbers, family details and biodata of prospective matches.
• Notes, conversation logs, ratings, flags, family scorecards and meeting feedback you record.
• Documents or images you upload for AI biodata extraction.

d) Cookies and technical data

• Strictly necessary cookies and local storage, to keep you signed in and to remember your cookie choice.
• Analytics, only if you consent — see Section 9.

We do not collect: location tracking, your contact list, advertising identifiers, or behavioural profiles. We run no advertising and no session-recording tools.

4. How we use your information

• To provide the Service — store your prospects, compute compatibility and kundli (guna milan) scores, show your pipeline.
• To run AI biodata extraction on documents and images you upload.
• To secure the Service and diagnose problems.
• To email you about your account. We do not send marketing or newsletter emails.
• To understand, in aggregate, which features are used — only with your consent (Section 9).

We do not sell your data, share it with advertisers, use it to train AI models, or use it to introduce you to anyone. RokaMaybe is a private tool, not a matchmaking platform. Nobody is matched with you by us. Nobody browses your prospects.

5. Our basis for processing (DPDPA §§ 6 and 7)

We process your personal data on the basis of your consent, given when you create an account and provide information, having been told what it will be used for.

Where you voluntarily provide data for a purpose and have not indicated that you object, we may also rely on the “certain legitimate uses” provision at Section 7 of the DPDPA.

We do not rely on “legitimate interests” — that concept does not exist under Indian law.

Withdrawing consent

You may withdraw consent at any time, as easily as you gave it:

• In the app: Profile → Danger Zone → “Delete my account & data”
• By email: namaste@rokamaybe.com

On withdrawal we stop processing your data and ensure our processors erase it, unless a law requires us to keep it. Withdrawing consent does not make our earlier processing unlawful. The consequence of withdrawal is that you can no longer use the Service.

6. Sharing and processors

We do not sell your personal data. We share it only with the service providers who make the Service work:

Each is engaged under a contract as required by DPDPA §8(2). We remain responsible to you for their compliance.

Where your data actually lives. Your account, your prospects, your notes, and your photos are stored in India, in Google’s Mumbai region. That is deliberate.

On AI processing. When you use biodata extraction, the document is sent to Anthropic’s API in the United States solely to return the extracted fields. It is not used to train AI models. We do not retain it beyond producing your result. This is a transient transfer, but it is a real one, and you should know about it.

On analytics. PostHog is hosted in the European Union. It only runs if you accept analytics cookies. It identifies you only by an internal account identifier — never your name, email, or phone number.

We may also disclose data where required by law, court order, or a lawful government request.

7. Transfers outside India

Your core data is stored in India. However, as set out above, some processing happens outside India — AI extraction in the United States, and analytics in the European Union.

Under DPDPA §16, transfers outside India are permitted except to countries or territories that the Central Government notifies as restricted. Neither the United States nor the European Union is currently subject to such a restriction. If a restriction is notified in future that affects our processors, we will comply with it.

We do not use “standard contractual clauses” — that is a European mechanism, not an Indian one. We rely on §16 and on our contracts with each processor.

8. How long we keep your data

While your account is active, we keep your data so the Service works.

Deleting things yourself. You can delete individual prospects, notes, conversations, flags, and photos at any time inside the app. Deletion is immediate.

Deleting everything. Profile → Danger Zone → “Delete my account & data”. This permanently removes your profile and every prospect, note, conversation, flag, rating, photo, meeting record, and activity log entry. It is immediate and irreversible. You may also email namaste@rokamaybe.com and we will do it for you.

If you stop using RokaMaybe. Many people find a match and simply stop logging in — leaving behind information about other people who never consented to it sitting here indefinitely. That should not happen.

If your account is inactive for 24 months, we will delete it and all its data. We will email you twice before we do — at 22 months and at 23 months — so nothing disappears without warning.

After deletion, your data is removed from our live systems immediately and completely.

9. Cookies and analytics

Strictly necessary cookies keep you signed in and remember your cookie choice. These always run. No consent is required for them and you cannot turn them off while using the Service.

Analytics cookies only run if you accept them on our cookie banner. If you decline, they never load at all — this is enforced in our code, not just promised.

Our analytics setup is deliberately restrained:

• Vercel Analytics — cookieless, collects no personal data.
• PostHog — EU-hosted. Automatic event capture is off. Session recording is off. It identifies you only by an internal account identifier, never by your name, email, or phone number.

We use no advertising cookies, no tracking pixels, and no session-replay tools. We never will on this product — recording your screen would mean recording other people’s biodatas and your private notes about them.

10. Security (DPDPA § 8(5))

• Your data is readable and writable only by your authenticated account. This is enforced by database security rules at the infrastructure level, not merely by the app.
• All data is encrypted in transit (HTTPS) and encrypted at rest by our infrastructure provider.
• API keys and credentials are held server-side and never exposed to your browser.
• Access to our systems is restricted.

No system is perfectly secure, but we take reasonable technical and organisational measures to protect your information, and we keep working on them.

11. If there is a data breach (DPDPA § 8(6))

If a personal data breach occurs, we will:

1. Notify the Data Protection Board of India in the form and within the time the law requires.
2. Notify every affected person directly and without delay — telling you what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

We will not stay quiet about a breach to protect ourselves.

12. Your rights (DPDPA §§ 11–14)

Subject to law, you have the right to:

• Access — a summary of the personal data we hold about you, how it is processed, and who it has been shared with.
• Correction, completion, updating and erasure — correct what’s wrong, complete what’s missing, delete what you want gone.
• Grievance redressal — complain to us and have it addressed.
• Nominate — nominate another person to exercise your rights if you die or become incapacitated. Email us their name and contact details and we will record it.
• Withdraw consent — at any time, as in Section 5.

How to exercise them: email namaste@rokamaybe.com.

Our timeline: we will acknowledge within 72 hours and resolve within 30 days. If something needs longer, we will tell you why rather than go silent.

If we let you down, you may complain to the Data Protection Board of India. We would rather you came to us first — but this is your right, not a favour we grant.

13. Your duties (DPDPA § 15)

The Act places duties on Data Principals too. In short: don’t impersonate anyone when providing data, don’t suppress material information, and don’t file false or frivolous complaints. The Act provides penalties for breaching these duties.

14. Children (DPDPA § 9)

The Service is for adults aged 18 or over. We do not knowingly collect the personal data of anyone under 18 — whether as an account holder or as a Prospect.

As a user: you confirm you are 18 or over when you sign up. If we learn an account belongs to someone under 18, we will delete it and its data.

As a Prospect: the Service blocks any Prospect whose age is under 18, on every path — adding, editing, and AI extraction from an uploaded biodata. See Section 2.

We do not track, behaviourally monitor, or target advertising at children. We don’t do those things to anyone.

If you believe a child’s data is held here, email namaste@rokamaybe.com and we will act promptly.

15. Changes to this Policy

We may update this Policy. We will revise the “Last updated” date above, and for material changes we will notify you by email or in the app before they take effect.

16. Contact

Grievance Officer: Komal Singhania
Email: namaste@rokamaybe.com
Address: Ghatshila, Jharkhand, India — full postal address available on request

Data Protection Board of India — for complaints you feel we have not resolved.