Bhasha Privacy Policy: web edition

This policy covers Bhasha on the web, the version of Bhasha you use in a browser. The iPhone app has its own policy at https://eldrenlabs.com/bhasha/privacy; most of what it says about our servers is the same here, and this page explains what is different on the web.

You can use Bhasha on the web without an account. Then your lessons, progress and settings stay in this browser and are not sent to us. If you sign in, we keep your learning progress on our servers so it follows you to other browsers and devices. We measure how the site is used (which screens you open and what you tap, never recordings of your screen), and you can turn that off in Settings (section 2, Usage data). Technical connection data still reaches our hosting providers when you visit. We don't sell your data, we don't show ads, we don't use advertising cookies, and we don't track you across other websites.

Questions about your privacy? Email support@eldrenlabs.com.

Bhasha is made by Eldren Holdings LLC ("Eldren Labs", "we", "us"), 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. We are the controller of the personal data described here. Bhasha is for people aged 13 and over.

If you don't sign in

• Your progress, saved phrases, practice history, setup answers, reminder choices, privacy choices and settings are saved in this browser's storage (section 3). They are not sent to us.
• A profile photo you pick is shrunk and saved in this browser only. It is never uploaded.
• Lessons and audio you download for offline use are saved in this browser's cache.
• Ask Bhasha, Ask Bhasha Voice, the Community, Adda and hand-off lessons need an account.

Your account (optional)

You can sign in with Apple, with Google, or with a sign-in link or code sent to your email.

• Sign in with Apple: an identifier from Apple, and your name and email if you choose to share them. If you sign in the same way on iPhone, you get the same Bhasha account.
• Sign in with Google: an identifier from Google, your email address, your name and the address of your Google profile picture, as Google shares them.
• Email: your email address. We send you a sign-in link or code; we never ask for a password.
• Our sign-in provider (Supabase) keeps a log of sign-ins, including the time and your IP address, to keep accounts secure.
• When you sign in, we keep a record that you accepted our Terms: the version, the date and time, where you accepted (signing in or buying) and that it happened on the web. We keep it as evidence of our agreement with you.

Your learning data, when you are signed in

So your learning follows you, these are stored on our servers, private to your account: your plan and course, which lessons you finished and your scores, your practice history and review schedule, daily study counts, saved and archived items, badges and streak counters, the text of your hand-off lessons (never a recording), your Ask Bhasha conversations, your reminder choices, your energy balance and your settings and setup answers. Your browser keeps only the recent part of your practice history, for speed; the copy kept with your account is not trimmed and is deleted when you delete your account.

Some things stay only in this browser even when you are signed in: your privacy choices, your profile photo, and your notification subscription details (unless you turn on notifications while signed in; see below). Your age range (for example "16 to 17" or "adult", never your birth date) is kept with your account when you are signed in, so you are asked your age only once.

These records are restricted to your account in the app. Authorised staff and providers may process them as needed to operate the service, answer support requests, protect users or comply with law. We do not use your private learning content to train our own AI models.

Ask Bhasha, hand-off lessons, messages and the Community

These work as they do on iPhone (sections 03, 09 and 11 of the iPhone policy): the text you send to Ask Bhasha (and any photo you attach) and the text of a hand-off lesson go to our servers so they can be answered or made, and are kept, private to your account, so you can see them again. Messages you send to the developer, and their photos, are stored so we can reply. Lessons you choose to share to the Community are shown to other learners with your display name, text only.

Bhasha on the web does not record your voice for hand-off lessons. Recording happens in the iPhone app.

You can react to Community lessons (a heart, clap, fire or shabash). We store which lesson you reacted to and with what, linked to your account. Others see how many reactions a lesson has, never who reacted. A lesson that gets enough reactions may be shown in Adda as a Community pick.

Short surveys (optional)

If you are signed in, Bhasha may ask a few optional questions: how you found Bhasha and what made you try it, and later how your learning is going. Your answers, any short text you choose to add (up to 200 characters) and when you answered or skipped are stored with your account, so we know what helps and do not ask again too soon. You can skip any question. Answers you gave in the iPhone app are kept with the same account.

• The last check-in question asks if you would talk to us about Bhasha. Only if you say yes and give an email address do we store it, to invite you to a short conversation. You can withdraw at any time, and the email is then deleted.
• Survey answers are separate from usage data: they are what you chose to tell us, and they are never in usage data.

Adda (your public profile, optional)

Adda is the social page of the Community tab. It is off until you choose to join. Adda is for adults: joining needs an account and your confirmation that you are 18 or older, and it is not offered if you told us you are under 18. When you join, we store a public profile: the display name you choose, the avatar you make (a drawing built from preset parts, not a photo), the time you confirmed your age, and whether you turned on automatic posting. Everyone signed in to Bhasha, on the web or the iPhone app, can see your display name, your avatar, the number of people who follow you and you follow, and the milestones you post: badges, levels, Nouka streaks, finished courses and lessons you shared to the Community (with that lesson's phrase while it stays in the Community). Milestones are posted only when you turn on automatic posting, and a shared lesson only when you also shared it under your name, once the Bhasha team approves it. Others see reaction and follower counts, not who reacted or who follows whom. Your email address, your learning history and your plan are never shown.

If you ever tell us you are under 18, on the web or in the iPhone app, our server keeps a private record of the age range you gave and when it first saw it, and Adda stays closed until you would be 18 by the end of that range. It never holds your birth date. If you correct a mistake within a few minutes (Settings, Privacy, Your age), the record is removed. Otherwise you can ask us to check from the closed Adda card: we store your request and any message you add, with your support messages, and we show our decision on the Adda card and send a notification if you allowed them. The record is deleted when we approve your request or you delete your account.

We also store who you follow, the reactions you give (clap, heart, fire, Shabash), and the people you block. Blocking hides each of you from the other in Adda. If you report a profile or post, we store the report, its reason and who sent it so the Bhasha team can review it; reports are not shown to the person reported. A moderator can hide a profile or a post that breaks the Terms, and a hidden profile stays hidden if it is made again.

You can edit your profile at any time. "Turn off" deletes your profile, your posts, your follows and the reactions you gave straight away. We keep your blocks, the reports you sent or received, and a record of when you posted (used for daily limits) while your account exists, so turning Adda off and on again does not undo a block or a moderation decision. Deleting your account removes all of it.

Ask Bhasha Voice

When you start a voice conversation, your browser asks to use your microphone. While you talk, your microphone audio streams from your browser to our AI voice partner (ElevenLabs), with the lesson context the conversation needs, so it can reply. We use ElevenLabs to process the audio and produce replies. We do not save live microphone audio in your synced learning records. Provider retention depends on the voice service configuration and contractual safeguards described below. We count the minutes you use so we can apply your plan's voice allowance. You can take back microphone access at any time in your browser's site settings.

Purchases on the web

• You can buy a plan on the web only while signed in. Checkout is run by RevenueCat and the payment is processed by Stripe. Eldren Holdings LLC is the seller.
• You give your card details and email address to Stripe in the checkout form. Stripe and RevenueCat may also ask for your billing country or postal code to work out tax. We never see or store your card number.
• When you start a checkout, our web host tells the app which country your connection comes from, so checkout opens only where web plans are on sale. We use it for that check and do not store it, except that the country is saved with a purchase you complete. If you live where the law gives a right to cancel an online purchase and you agree at checkout that your plan starts at once, that agreement and its time are saved with the purchase too.
• We give RevenueCat your Bhasha account identifier and your account email, so you don't have to type it at checkout and your receipts reach you. RevenueCat and Stripe link your purchase to that identifier, so the plan unlocks on every device you sign in on, including the iPhone app.
• Our server receives from RevenueCat, and keeps: which plan or add-on you bought, whether it is monthly, yearly or a one-time purchase, when it renews or ends, whether it will renew, whether there is a billing problem, whether it was a test purchase, and for a one-time purchase its transaction reference.
• RevenueCat and Stripe send you receipts and keep records of the purchase that the law and accounting require.
• We also keep the allowance counters and daily counts of AI features used, as on iPhone. These are counts only, never content.

Notifications (optional)

• Reminders on the web arrive as browser notifications. Your browser asks your permission first, and you can turn them off in Bhasha or in your browser at any time. On iPhone and iPad, this needs Bhasha added to the Home Screen.
• When you turn them on, your browser creates a subscription with its push service (for example Google for Chrome, Mozilla for Firefox or Apple for Safari). It is an address for this browser, not your name or email.
• If you are signed in, we store that subscription with your time zone and the information needed to time your reminders (for example the reminder time you chose, whether you studied today and your streak), so our server can send them. The message is encrypted so the push service can deliver it but not read it.
• If you are signed in and allow notifications, we also use that subscription, linked to your account, to tell you about replies in the developer chat, decisions on requests you send us (such as an Adda age check), and when a new version of Bhasha is ready. It is deleted when you turn notifications off, sign out or delete your account.
• If you are not signed in, the subscription stays in this browser.

Usage data

We measure how Bhasha on the web is used, to find problems, see what helps people learn and improve the site and our plans.

• Usage data: the pages and screens you visit, what you tap or click, lessons and practice you start and finish, features you use (for example Ask Bhasha, voice, hand-off lessons, the Community, the paywall and checkout), purchases started, finished or cancelled, sign-in, settings and notification choices, errors and how fast pages load. Each record carries your browser and system type, screen size, language, time zone and the address of the page that sent you to Bhasha (for example a search engine).
• No screen recordings. We do not record or replay your screen, and usage data never contains what you type (such as chat, notes, search or your email), payment details or your microphone.
• Your browser gets a random identifier for this. When you sign in, it is linked to your Bhasha account, so your use across browsers and devices counts as one person.
• Our analytics provider, PostHog, processes this for us and stores it in the United States. We never use it for advertising, it does not track you on other websites, and we turn off its lookup of your location from your IP address. Chat, notes, your email address and the checkout are left out of what it collects.
• Our own measurement. Bhasha also sends a short summary of your use to our own servers (Supabase), the same way the iPhone app does: a random identifier for this browser (linked to your account the first time you use Bhasha signed in), when each visit starts and ends and how long it lasts, the screens you open in order, how you arrived (typed or bookmarked, a link, a campaign link or a notification), lessons and practice you start and finish, the paywall, plan and purchase steps, sign-in and sign-out, errors, your plan, the app version, light or dark theme, your browser and system type, whether you are on a phone, tablet or computer, the language, region and time zone your browser is set to, and whether you allowed notifications. It never includes your IP address in these records, what you type, or your microphone.
• Page speed. With the same switch, Bhasha measures how fast each visit's first page loads and responds (time to first byte, first and largest content drawn, layout shift and the slowest response to a tap or click) and sends those numbers with the summary above. We use them only to find slow pages.
• Your choices: usage data starts when you agree to the Terms and this policy at setup, for adults. "Usage measurement" in Settings, Privacy turns it off at any time, and Bhasha works the same with it off (section 5). It is always off for anyone under 18 and when your age is unknown (section 6).
• Your study history is not usage data. Bhasha uses your lessons, answers and study times to run your plan, pick what to practise and time your reminders. That is how the service works, so it has no separate switch (section 4).

Technical data

• Our web host (Vercel) and our backend (Supabase) see your IP address and basic browser details (such as the browser and system it runs on) when your browser connects. They use them to deliver the site, keep it secure and find errors, and retain logs for the operational and security purposes described in section 9.
• The app reads your browser's time zone. It is used on your device to time reminders and to tell whether the privacy rules of the EEA, Switzerland or the UK apply (section 5).
• To show service notices and settings we can change without a new release, the app downloads them from our servers. That request carries no account information unless you are signed in.

Bhasha on the web saves information in your browser's local storage and cache. It sets no advertising cookies. Our analytics provider, PostHog, uses this browser's local storage (not cookies) for the identifier described in section 2, and only while "Usage measurement" is on; turning it off deletes what it stored. Here is what is kept and why:

Stripe at checkout. When you open checkout, Stripe's payment form may set cookies of its own that Stripe needs to process the payment and prevent fraud. See Stripe's privacy policy at https://stripe.com/privacy.

You can clear all of this by clearing this site's data in your browser. If you are not signed in, that deletes your progress, and we cannot bring it back.

Where the GDPR or UK GDPR applies, these are our legal bases. Elsewhere, this section is our notice of what we do and why.

• Contract (to provide the service you asked for): your account and sign-in; keeping your learning data in sync; using your study history to personalise your plan, practice and reminder times; Ask Bhasha, hand-off lessons and voice; the Community, Community reactions, Adda and developer messages; your notification subscription, for replies, request decisions and update notices; selling you a plan, unlocking it and keeping its record; allowances and fair-use limits; reminders you turn on; saving your choices in your browser.
• Legitimate interests: keeping accounts and the service secure (sign-in logs, server logs); preventing abuse of the AI features; reviewing Adda reports and keeping blocks and moderation decisions, to protect other users; keeping Adda for adults (the private record of an under-18 age range and age-check requests); optional surveys, to learn how people find Bhasha and what helps them keep learning (answering is your choice, and you can skip); keeping the Terms acceptance record to show what we agreed; measuring how Bhasha is used to fix problems and improve it, and testing which purchase-button design is clearer (usage data, first-party only, never for advertising, with an off switch). You can object or switch it off (section 5).
• Consent: browser notifications, through your browser's permission prompt; and your interview email, if you give one in a survey, which you can withdraw at any time.
• Legal obligation: keeping purchase and tax records, and disclosing data where the law requires it.

• Sign in or not. The core of Bhasha works without an account.
• Notifications. Turn them on or off in Bhasha's Reminders page, or block them in your browser's site settings.
• Microphone. Allow or block it in your browser's site settings.
• Usage measurement. "Usage measurement" in Settings, Privacy turns usage data off at once and clears the analytics identifiers in this browser. Bhasha works the same with it off. Turning it off does not erase data already sent; you can request deletion by email.
• If you chose "Continue with essentials" before. That choice is kept: usage data stays off until you turn Usage measurement on.
• Objecting. Email support@eldrenlabs.com to object to processing based on legitimate interests on grounds relating to your situation.

Bhasha is for ages 13 and over. We use your birth month and year to work out an age range, discard the birth details, and keep only the age range: in this browser, and with your account once you sign in, so you are not asked again. Signing in at the start of setup is for existing accounts; someone new answers the age question before making an account. If you are under 13, setup stops, and an account made during that setup is signed out and deleted. If we learn that a user is under 13, we delete any data we hold about them. For teens aged 13–17, usage data is off in every country and cannot be turned on. Unknown ages do not enable it. Adda, the public profile, is for adults only: joining asks you to confirm you are 18 or older, and it is not offered when you told us you are under 18. If you told us you are under 18, our server keeps the private record described in section 2 (Adda). If your age range is wrong, change it in Settings, Privacy, Your age. Where local law requires parental permission for a feature or processing, that requirement still applies.

We share data with the providers below for the stated purposes. Providers acting as our processors must follow our instructions and data processing agreements. Payment and identity providers may also act independently for their own legal, security and account obligations under their privacy policies. We use contractual and account settings to restrict AI providers from using private learning content to train models.

• Vercel: hosts the Bhasha website and delivers its pages.
• Supabase hosts our backend, database, sign-in and server functions in the United States, including synced learning data.
• Resend delivers sign-in emails with your code, and processes your email address and delivery information for that purpose.
• Google (Gemini): makes and checks lesson text, answers Ask Bhasha questions (including photos you attach) and helps moderate Community submissions.
• ElevenLabs: spoken audio and live voice conversations.
• RevenueCat: runs web checkout and keeps the record of your purchases and subscription status, linked to your Bhasha account identifier.
• Stripe: processes card payments, prevents fraud and calculates tax. Stripe is also responsible for some payment data under its own privacy policy.
• Apple and Google, for sign-in: only if you choose to sign in with them, under their own privacy policies.
• PostHog: usage data (section 2), stored in the United States, for us only.
• Your browser's push service (for example Google, Mozilla or Apple): delivers reminders you turn on. It cannot read them.

We may also disclose data if the law requires it, or to protect our users or our rights. If Eldren Labs is sold or merged, data would move with the business under this policy.

International transfers. We operate in the United States. Our providers may process data there and in other countries with different privacy laws. For transfers from the EEA, Switzerland or the UK, we use an applicable adequacy decision or appropriate safeguards, such as the European Commission's standard contractual clauses and the UK addendum or transfer agreement. Email support@eldrenlabs.com for details or a copy of the safeguards, with confidential information removed where needed.

No ads, no advertising cookies and no advertising pixels. No tracking across other companies' websites or apps. We do not sell or share personal information for cross-context behavioural advertising. We never see your card number. We do not ask for your location.

We keep AI usage counters while needed to apply allowances and prevent abuse, and remove account-linked counters on account deletion. AI providers may keep limited processing or abuse-prevention records under their service settings and contracts. We retain deletion-job records and limited evidence needed to complete deletion, prevent fraud, meet legal duties or resolve claims. Backups expire on their rotation schedule and are not used for ordinary service after deletion. We choose retention periods based on the purpose, sensitivity, legal requirements and whether the data is still needed. We delete or anonymise data when those reasons no longer apply.

• Signed out: in Settings, "Delete account & all data" removes all your lessons and progress from this browser. Clearing the site's data in your browser does the same.
• Signed in: "Delete account & all data" removes your server account and its active app records, including: your synced learning data, Ask Bhasha and hand-off history, messages, Community lessons, your Adda profile, posts, follows, reactions, blocks and reports, Community reactions, survey answers and any interview email, the private under-18 age record and age-check requests, notification subscriptions, web purchase status on our server, and usage data linked to your account. It then clears this browser. The retention exceptions in section 9 apply. RevenueCat and Stripe keep records needed for payment, tax, fraud prevention and legal duties. Copies already shared or downloaded by other people cannot always be recalled. If cleanup fails, the app asks you to retry; contact us if it does not finish. Anonymous analytics that cannot be linked to your account may remain until their retention period ends. Clear site data on other browsers you used to remove local copies there.
• Deleting your account does not cancel a web subscription. Cancel it first through Profile > Manage billing. Account deletion itself does not stop renewal charges. Contact support if you cannot access billing; this does not remove any legal deletion right.
• A copy of your data: email support@eldrenlabs.com from the address on your account, and we will send you a copy of the data we hold about you.

Use the tools in the app or email support@eldrenlabs.com. We will never treat you differently for using these rights, and you can decline to sign in and still use the core app.

• In the EEA, Switzerland and the UK: you can ask to access, correct, delete or receive a copy of your data, to restrict how we use it, and to object (section 5). We reply within one month, or tell you within that month if we need longer for a complex request and why. You can also complain to your data protection authority (in the UK, the Information Commissioner's Office).
• California: where the CCPA, as amended by the CPRA, applies, you can request the categories and specific pieces of personal information collected, their sources, purposes and recipients; access a portable copy; correct inaccuracies; and request deletion, subject to legal exceptions. You may opt out of sale or sharing and limit uses of sensitive personal information where those rights apply. We do not sell or share personal information for cross-context behavioural advertising. We use sensitive information only as needed to provide requested services and for permitted security and legal purposes. We do not use it to infer characteristics about you. You will not face unlawful discrimination for exercising your rights.
• Making a request: email support@eldrenlabs.com. An authorised agent may submit a request for you. We may reasonably verify your identity and the agent's authority, using only information needed for that purpose. We respond within the applicable legal deadline and explain any permitted extension or refusal. Where your state gives an appeal right, reply to our decision asking for an appeal.
• In the United States and everywhere else: you can ask to see or delete the data we hold about you. If the privacy law where you live gives you more rights or a shorter deadline, we follow it.

The categories in section 2 include identifiers, purchase records, internet activity, learning content and audio supplied to voice features. We obtain them from you, your browser, sign-in providers and payment providers. Sections 4 and 7 explain their purposes and recipients; section 9 explains retention. This also describes our collection and disclosures during the preceding 12 months to the extent the web service operated. We have not sold or shared that information for cross-context behavioural advertising during that period.

We'll post changes on this page and update the date at the top. If a change materially affects how we use your data, we'll tell you in the app, and by email if we have your address, before it applies to you.

Eldren Holdings LLC, 7901 4th St N, Ste 300, St. Petersburg, FL 33702, United States. Email support@eldrenlabs.com.