PRIVACY POLICY | Mero Nepal

Last Updated: 2026-10-27

1. INTRODUCTION

Mero Nepal (“we,” “our,” or “us”) operates the Mero Nepal mobile application (the “App”), published on Google Play as com.meronepal.app.

The developer legally responsible for the App is Mero Nepal.

This Privacy Policy explains, specifically and honestly, what the App collects, why, where it is kept, who else can see it, and what control you have. By using the App you agree to this policy.

2. THE SHORT VERSION

Most of what you create — your Money Manager ledger, your Women’s Health records, your photos — is written to a database on your own phone first.
Some of it is also copied to our secure cloud servers so you can restore it on a new device. This is described precisely in Section 4.
Transaction photos are the exception: they are never uploaded to our servers. They stay on your phone and, only if you switch it on, in your own private Google Drive folder.
We do not sell, rent, or trade your personal data to anyone. We do not use advertising networks and the App contains no ads.
Some categories we handle are sensitive — reproductive health and financial records. Section 3 marks them clearly.

3. INFORMATION WE COLLECT

3.1 Account and identity

When you sign in with Google or Apple we receive your email address, display name, and profile photo URL. Sign-in is required to use the App. At sign-in we request only basic email and profile access — nothing more.

3.2 Device and app information

After sign-in the App records a detailed description of your device. On Android this includes: build id, brand, manufacturer, model, product, hardware, device, board, bootloader, display, build fingerprint, host, tags, type, Android SDK level and release, codename, incremental and security-patch level, base OS, whether the device is physical, the list of system features, and supported CPU ABIs. On iOS it includes: identifierForVendor, device name, model, localized model, system name and version, and the kernel utsname values.

Please note honestly: taken together these values are a fairly distinctive fingerprint of your device, and the iOS identifierForVendor persists across app updates. This information is stored under your account and is used for support, diagnostics, and understanding which devices we must keep working.

We also record your app version and build number.

Alongside the device description, your account record also holds:

a session identifier generated fresh every time you sign in, used to tell one signed-in device from another. To be exact, it is written to our real-time cloud database, not to your account record in our main cloud database;
your time-zone name and UTC offset, which the daily-reset and notification schedules need;
a last-active timestamp and an active/inactive flag for each device you have signed in on.

We do not collect your IMEI, and the App’s own code never reads your Advertising ID. Your account record does contain a phone-number field, but the App never asks you for a phone number and never reads one from the device — the field is copied from your Google or Apple sign-in, which does not provide one, so in practice it stays empty.

3.3 Location

For calendar, Panchanga, Kaal timings and Kundali calculations, the App uses a city that you pick yourself from a built-in list. Your chosen city name, latitude, longitude, elevation and time zone are saved on your device and are used to run the astronomical calculations locally. When you change your city, only the city name is sent to analytics — the coordinates are deliberately not sent; the “📅 शुभ मिति” AI option sends panchanga times computed for that city (Section 3.9).

Some features do ask the operating system for your actual device position (satellite or network positioning):

the Rashifal / Gochar screen, which asks for your real position first and only falls back to your chosen city if you refuse the permission or the fix times out;
the weather panel in Women’s Health, which sends your coordinates to the third-party service open-meteo.com to fetch local weather;
the Vaastu land-drawing and compass screens, which use position and device orientation;
the “use my current location” option in the city picker, which reads your position including altitude and, when the device reports no altitude, sends your latitude and longitude to api.open-elevation.com to look the elevation up.

If you decline the location permission, those specific features fall back to your chosen city or to defaults, or stop working; the rest of the App is unaffected.

3.4 Astrology and profile content

Birth details, Kundali charts, saved horoscope readings, events and family records that you enter are stored on your device and backed up to your account in our cloud.

3.5 Women’s Health — SENSITIVE CATEGORY

If you use the Women’s Health module, the App stores reproductive and child-health information, including: cycle dates and lengths, period regularity, birth-control method, symptoms, moods, sleep, basal body temperature, cervical-mucus and discharge observations, intercourse and ovulation-test logs, pregnancy details (last menstrual period, estimated due date, conception date, weight, height, complications), pregnancy appointments including doctor and clinic names and your notes, medicines and doses, vaccines, contractions and kick counts, and baby records (name, sex, date of birth, blood group, feeding, sleep, diaper, growth, temperature and milestone logs).

This data is written to a separate database on your phone. If you are signed in, it is also synchronised to our cloud so it survives a lost or replaced phone. It is stored there under your account identifier and is not shared with other users — except where you deliberately use the partner-sharing or share-group features, which publish a summary (such as cycle mode, due date, pregnancy week, predicted period and fertile window, latest weight and mood) and any notes to the person you linked with.

Your on-device notes marked local-only, partner links, and your saved AI question history are not part of the cloud sync.

How we ask for your consent. Before the module opens for the first time we ask you for two things separately: agreement to this Privacy Policy and the Terms, and — as a distinct, explicit consent — agreement to our storing and synchronising your health records. Both are required, and the module does not open without them. A third box, for marketing messages, is optional and is never bundled with the other two: refusing it changes nothing about your access to the module. Your decision is recorded on your device together with the date and the version of this policy you agreed to, and it stays on your device — the consent record itself is never uploaded to us. If that record is missing, damaged, or was given against an older version of this policy, the App treats it as no consent at all and asks you again rather than assuming.

Withdrawal, honestly: there is currently no button in the App that withdraws this consent. We are not going to describe a control that does not exist. To withdraw it, email us at the address in Section 12 and we will erase your synchronised Women’s Health data and stop the sync. You can also delete your records inside the module and delete your account (Section 9). Withdrawing does not make what we did before you withdrew unlawful.

3.6 Money Manager — SENSITIVE CATEGORY

The Money Manager module stores your financial records: accounts, balances, budgets, categories, and every transaction you enter with its amount, currency, date, payee/description and notes. This lives in a database on your phone and, when you are signed in, is also synchronised to our cloud under your account so you can restore it.

We never see your bank credentials — the App has no bank connection and you enter everything manually.

3.7 Transaction photos — STORED DIFFERENTLY

Photos you attach to a transaction (receipts and similar) are kept in the App’s private storage on your phone, and a copy is written to your device’s own gallery under Pictures / Mero Nepal / Money Manager so you can find them.

Transaction photos are never uploaded to our servers. The file path is deliberately stripped out of everything the App sends to our cloud, so the cloud copy of a transaction contains no reference to the photo at all — not the image, not the file name, not even a flag saying one exists. The only way a transaction photo leaves your device is if you turn on Google Drive backup, in which case it goes into your own private Drive folder described in Section 5.

This applies to transaction photos only. It does not apply to images you attach to a support message — see Section 3.8.

3.8 Support chat

Messages you send through the in-app Support Chat are stored in our cloud so we can answer you. The conversation also records, beyond the messages themselves:

your email address and account identifier on the conversation record, so our reply and its notification reach you;
the text of your most recent message, kept in readable form on that same record so the support list can show a preview;
if your message contains a link, the App fetches that web page from your device and stores the page’s title, description and preview-image address next to the message;
an online/offline presence entry with a last-seen time, and a “typing” flag while you are writing, both in our real-time cloud database;
a refresh of your notification token each time you open the chat, so our answer can reach your phone.

If you attach an image to a support message, that image IS uploaded to our cloud file storage, so our support team can see what you are asking about. Please do not send anything in support chat that you would not want us to hold. Your support conversation and its images are deleted when your account is deleted (Section 9.2).

3.9 AI features

The App offers AI-generated readings and answers (horoscope, Kundali, matching, Vaastu, Nakshatra, and Women’s Health guidance). These run on Google’s Gemini models through Google’s AI service. The one exception is the paid “Claude: Opus 5.5 MAX(Best Model)” option for Kundali questions and Kundali-matching questions: when you choose it, the answer is produced by Anthropic’s Claude Opus 5.5 model, and the request is sent to Anthropic from our server rather than from your phone.

When you ask an AI question we send your question together with a structured summary of the relevant context. Be aware that for Women’s Health this summary contains health information — for example cycle regularity, birth control, predicted ovulation and fertile window, mood and sleep summaries, and for baby-related questions your baby’s name, sex and date of birth. For Kundali it contains the name, gender, age and chart data of the person whose Kundali it is, who may be someone other than you; for Kundali matching it contains the names, ages and chart data of both people being matched. When you ask a Kundali question about choosing a day — the “📅 शुभ मिति” option, which costs extra points and which you can switch off before sending — the summary also contains the panchanga of the coming days (up to 60) for the city you picked: tithi, nakshatra, yoga, karana, Rahu Kaal and Moon-sign times. It contains no city name or coordinates, but these sunrise-based times can show roughly which region you chose.

A copy of the question, the AI’s answer, and the context summary is also saved to our cloud under your account, so your reading history is available to you, and an audit record of each call (type, model, cost in points, your email, timestamp — and, for a Claude Opus 5.5 answer, also the token counts, the response time and Anthropic’s identifiers for the request) is kept for billing and abuse prevention. For a Claude Opus 5.5 answer we also keep a temporary copy of the answer on our server for 24 hours, so that if you leave the screen or lose your connection while it is being prepared, the App can still give it to you without taking points again; after that an automatic daily clean-up removes it — normally within about two days of your question. A copy is kept on your device too.

Does what you send train an AI model? This is the question we are asked most, so here is the honest answer in two parts. We train nothing. We do not train, fine-tune, evaluate or improve any model on your questions, your answers, or the context we send with them — not a model of ours, and not anyone else’s. The second part is not ours to promise: the calls go to Google’s Gemini Developer API through Google’s AI service, and what Google itself may do with what it receives is governed by Google’s own terms for generative AI services, at https://policies.google.com/terms/generative-ai. Those terms treat paid and unpaid use of that API differently, so whether a prompt can be retained or reviewed by a human depends on the service plan we use for Google’s AI service. The paid Claude Opus 5.5 option is the exception here too: its calls go from our server to Anthropic’s API, and what Anthropic itself may do with what it receives is governed by Anthropic’s own Commercial Terms and Data Processing Addendum, at https://www.anthropic.com/legal/commercial-terms and https://www.anthropic.com/legal/data-processing-addendum. Under those terms Anthropic may not train its models on it. How long Anthropic keeps it is set not by those terms but by Anthropic’s published retention practice, which Anthropic can change (https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data): it deletes API inputs and outputs within 30 days, except where its automated safety systems flag them as breaking Anthropic’s Usage Policy (then up to 2 years), where Anthropic needs to keep them longer to enforce its Usage Policy, or where the law requires longer. Until you have those answers from us in writing, the safe assumption is the cautious one: do not put anything into an AI question that you would not want read by someone else.

3.10 Notifications

If you allow notifications we store a push-notification token for each of your devices, along with the platform, a randomly generated per-install identifier, and the time it was last refreshed. This is what lets us deliver your daily horoscope and reminders.

3.11 Analytics and crash reporting

The App uses Google Analytics and a crash-reporting service. This is the full list of what analytics actually sends:

the screens you open, and each app open;
feature usage — the name of the feature you tapped, a timestamp, and any extra parameters that particular screen attaches. Nothing filters those extras out, so today they also include: the identifier of the saved birth chart you opened (a random id, not your birth details), the rashi you shared from Rashifal and its index, the full date you were looking at on the Rahu Kaal, Bar Bela and Abhijit Muhurat screens, and the language the calendar is in;
language changes, and location changes carrying the city name only — never the coordinates;
premium-screen views, and which Vaastu screen you opened. The Vaastu event is able to carry a project identifier as well, but no screen in the App currently sends one, so it does not reach analytics;
Money Manager actions — that a transaction was added, a budget was set, a Drive backup ran, a CSV export ran, or a manual sync ran. These carry no amount, no balance, no currency value, no payee, no description, no note and no category name.

Analytics receives none of the following: your search terms, your sign-in or sign-up method, your purchases, or the contents of anything you record. No search term is ever sent to analytics — the search, login, sign-up and purchase events exist in our code but are never triggered by any screen.

That is a statement about analytics only, and we should not let it be read as more. The text you type into the city search does leave your device, because a place name has to be turned into coordinates: it is sent first to your phone’s own operating-system geocoder, and if that fails or times out, to nominatim.openstreetmap.org. Both are named in Section 7.

Please note honestly: screen names reveal which Women’s Health mode you are in. Names such as pregnancy_today, ttc_my_cycle, period_cycles and baby_immunization reach Google Analytics, so the fact that you are pregnant, trying to conceive, tracking periods or caring for a baby is visible there — even though no cycle date, symptom, or other health value is ever sent.

The crash-reporting service records crashes and fatal errors with diagnostic detail. We attach no custom keys and no user identifier to a crash report — it carries only what the crash-reporting SDK gathers by itself. The five user properties we do set — your platform, your app version, your build number, your chosen language, and whether you are signed in — are set on Google Analytics, not on the crash-reporting service.

3.12 Purchases and subscriptions

The App sells optional premium plans through Google Play Billing and Apple In-App Purchase. We never receive your card or payment details — the store handles payment entirely. We do store the purchase token Google Play issues for your subscription, on our own servers. We keep it for one reason: so we can ask Google whether your subscription is still valid, which is how your access, tier and expiry stay correct. It sits in a server-only store that no app user can read — not you, not anyone else. It is never displayed in the App, and it cannot be used to charge you or to take money from your account. We also keep a one-way SHA-256 hash of that token as the key of our anti-fraud ledger, which is what stops the same purchase being redeemed by two accounts. What we do store against your account is your email address, the product id, the store you bought from, the purchase date, your subscription status and expiry, and your resulting tier. The anti-fraud ledger row also records how many points that purchase awarded, the time of the last store sync and whether that sync was a new purchase or a restore, and the expiry date Google Play reported back to us.

3.13 Software updates

The App can receive over-the-air code updates through an over-the-air update service, which contacts that service’s servers to check for patches.

3.14 Family Tree — RECORDS ABOUT OTHER PEOPLE

The Family Tree module is unlike every other part of the App, because most of what it holds is not about you. It is about your relatives, living and dead, who are not users of this App, have never read this policy, and cannot come to us to exercise their rights over it. We would rather state that at the top of this section than let it be discovered.

For each person you add, the App can store: their name and Nepali name, gender, gotra and caste (each in English and Nepali), whether they are alive, a short and a long description in both languages, and a link to a saved Kundali. It stores their birth date, time and place — including latitude, longitude, elevation and time zone — the Bikram Sambat date, and the tithi, paksha and nakshatra. For someone who has died it stores that same full set a second time for the death, plus any Shraddha special case. Alongside the people it stores the relationships between them, and for the tree as a whole a caste, gotra, pravara and origin village.

Caste and gotra can reveal ethnic origin and religious or philosophical belief. Under European data-protection law that is special-category information (GDPR Art. 9(1)), and it is sensitive under Nepali law too. The App never requires these fields — leave them empty if you would rather not record them about someone.

You are responsible for what you record about other people. Where a relative is alive and able to be asked, you should have their agreement; you should enter only what they would be content for every other member of the tree to see; and you must not enter anything you are not entitled to share. We hold that information for you, but you are the one who decided to collect it. If a person in your tree asks us to remove what was recorded about them, we will contact you, and we may remove it.

How sharing works:

A tree you create is local to your device only. Until you switch sharing on it makes no call to our cloud at all, and no copy of it exists on our servers.
When you switch sharing on, the whole tree — every person and every field listed above — is compressed into a single file and uploaded to our cloud file storage, with an index record in our main cloud database and an entry in our real-time cloud database for every member. Each later edit uploads a new version of that whole file, and earlier versions stay until the tree itself is deleted.
People join either by an invitation sent to their email address, or by a 6-digit code that a tree administrator generates. A code carries a role — view or edit — and expires 24 hours after it is created. Anyone who enters a valid code in time joins the tree; the code does not check who they are.
There are no per-person permissions inside a tree. Every member can see every person in it and every field recorded about them. A member holding the edit role can change or delete anything in the tree, including entries you created.
A shared tree outlives your account. Deleting your Mero Nepal account does not delete the tree — see Section 9.3. The cloud copy goes only when a tree administrator deletes the tree itself, which has its own 30-day grace period.

4. WHERE YOUR DATA IS STORED

Three distinct places — the difference matters:

4.1 On your device

Local SQLite databases and app-private files. This is the primary home for your Money Manager ledger, Women’s Health records, calendar and Kundali data, your settings and chosen location, and your transaction photos. Data here is protected by your device’s own security and is removed when you uninstall the App.

4.2 Our secure cloud servers

Operated for us by our cloud service provider as our processor, in its data centres. This holds your account record, device information, app version, push-notification tokens, Kundali backups, Women’s Health sync data, Money Manager sync data, AI question history and audit records, support-chat messages, subscription status, and — once you switch sharing on for a Family Tree — the complete uploaded copy of that tree and everyone in it (Section 3.14). Traffic between the App and our cloud servers is encrypted in transit (HTTPS/TLS) and encrypted at rest by our cloud service provider.

4.3 Your own Google Drive

Only if you enable it — see Section 5. This is your storage, not ours.

5. GOOGLE DRIVE BACKUP

Money Manager and My Events can back themselves up to your personal Google Drive. Both are off by default.

The Drive permission is not requested when you sign in. It is requested only at the moment you switch Drive backup on, and you can decline.
The App requests a single, narrow Google permission called drive.appdata. This grants access only to a hidden, application-private folder that belongs to this App.
The App cannot see, read, list or modify any of your other Google Drive files — your documents, photos and folders are outside the scope entirely and remain invisible to us. Every read and write the App performs is restricted to that app-private space.
Your backup — the Money Manager database, your own My Events entries, and, if present, your transaction and event photos — is stored in your Drive account, under your control. We cannot read it from our servers.
Turning the feature off, or removing the App’s access from your Google Account settings, stops further backups. You can delete the backup files from your Google Account’s storage management page at any time.

5.1 Google API Services Limited Use

Mero Nepal’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy

Concretely, for the drive.appdata permission described above:

We use it only to store and restore your own Money Manager and My Events backups, which are the features you switched on to obtain it.
We do not transfer that data to anyone, except where it is necessary to provide that feature, or to comply with applicable law.
We do not use it for advertising, and we do not allow humans to read it — except with your explicit permission, for security purposes, to comply with the law, or where the data has been aggregated and anonymised.
We do not sell it. Ever.

6. HOW WE USE YOUR INFORMATION

To provide the features you use — calendar, Panchanga, Kundali, Rashifal, Vaastu, Women’s Health, Money Manager
To sign you in and keep your account secure
To synchronise and restore your data across your devices
To send notifications you have enabled
To generate AI readings you request
To operate subscriptions and prevent fraudulent or duplicate redemption
To answer your support messages
To diagnose crashes, fix bugs, and understand which features are used and on which devices
To comply with legal obligations

We do not use your data for advertising, and we do not build advertising profiles.

6.1 Our lawful basis for each purpose

European and UK data-protection law requires us to name the legal ground for each thing we do with your data, rather than to list purposes and leave the ground unsaid. These are ours:

Performance of a contract (Art. 6(1)(b)) — signing you in, holding your account, running the features you use, synchronising and restoring your data across your devices, and answering your support messages. This is what you asked us for when you accepted the Terms.
Your explicit consent (Art. 6(1)(a) together with Art. 9(2)(a)) — everything in the Women’s Health module, including the health context we send with an AI question and any summary you choose to share with a partner. That is health data, so explicit consent is the only ground we rely on, and we ask for it separately before the module opens (Section 3.5).
Performance of a contract (Art. 6(1)(b)) — the Money Manager module, which is a feature of the App you chose to use. Financial records are sensitive to you, but they are not special-category data in law, so consent is not the ground here.
Performance of a contract, plus explicit consent for the sensitive fields (Art. 6(1)(b), and Art. 9(2)(a) where they are filled in) — the Family Tree module. Caste and gotra are optional; entering them is a choice to record special-category information about the people in your tree, and Section 3.14 sets out what you are responsible for there.
Your consent (Art. 6(1)(a)) — notifications, your device location, and Google Drive backup. Each is off until you permit it, and each can be revoked in your device or Google Account settings.
Our legitimate interests (Art. 6(1)(f)) — analytics, crash reporting, and the device diagnostics in Section 3.2. Our interest is in knowing which features are used and on which devices the App breaks. We balance it against you by never sending analytics the contents of anything you record, never selling anything, and never building an advertising profile.
Our legitimate interests together with a legal obligation (Art. 6(1)(f) and Art. 6(1)(c)) — verifying purchases, preventing duplicate or fraudulent redemption, and keeping the transaction and tax records we are required to keep.
A legal obligation (Art. 6(1)(c)) — any disclosure the law requires us to make.

Where we rely on legitimate interests, you have the right to object (Art. 21): write to us at the address in Section 12 and we will stop, unless we have compelling legitimate grounds that override your objection — in which case we will tell you what they are. Where we rely on consent, you can withdraw it at any time (Art. 7(3)), and withdrawing does not make what we lawfully did beforehand unlawful. Section 10.2 explains how, and Section 3.5 is honest about the fact that the Women’s Health withdrawal runs through us by email rather than through a button.

6.2 Automated decisions

A few things in this App are decided by code alone, with no person involved at the moment they take effect. You are entitled to know which, and what each one does to you. This is the complete list:

The welcome bonus is refused to a re-created account. When an account deletion finishes we keep a one-way hash of the address (Section 9.3). If you later sign up again with the same email, the account is created and works normally, but it starts with zero points instead of the welcome bonus. This block is permanent — it does not expire on its own, and only we can lift it.
Support chat locks after 20 unanswered messages. If you send 20 messages in a row without a reply from us, the App stops you sending more in that conversation. Our first reply resets the counter to zero and unlocks it.
An expired subscription is downgraded automatically. Once the expiry date we hold has passed, your tier is set back to Normal, your subscription is marked expired, and your horoscope and question points are reset to the free daily allowance — which will usually be fewer points than you had. Restoring the purchase from the store reverses this if the subscription is in fact still live.
A purchase already used by another account is refused. We compare a one-way hash of the purchase token against our anti-fraud ledger, and if that token is recorded against a different account the redemption is rejected. The ledger row survives account deletion, so deleting and re-creating an account does not clear it.
Kundali cloud backup is refused when your account records disagree. If the subscription tier we hold for you is not identical in both of our databases, the backup is stopped, the mismatch is recorded as a security incident against your account, and an administrator is alerted to review it by hand.

No profiling is involved in any of these. None of them examines your behaviour to predict or infer anything about you; each is a fixed rule applied to a single stored value. And to be explicit about the two modules people worry about: nothing you record in Women’s Health or in Money Manager is an input to any of these decisions — not one health record, not one transaction, not one amount.

You can ask a human to look again. Email us at the address in Section 12, say which of these has affected you, and a person — not the code — will review it, explain the decision in plain terms, and reverse it where it was wrong.

7. SHARING AND DISCLOSURE

We do not sell, rent, or trade your personal information. Ever.

Your data is shared only with:

Our cloud service provider (account sign-in, our main and real-time cloud databases, our cloud file storage, our server functions, a crash-reporting service and push-notification delivery) and Google (Google Analytics, and Gemini through Google’s AI service), each acting as our service provider/processor — https://policies.google.com/privacy
Anthropic (the Claude Opus 5.5 model) acting as our service provider/processor — only when you choose the paid “Claude: Opus 5.5 MAX(Best Model)” option. Our server sends it your question, the context summary described in Section 3.9 and the language you want the answer in; our server adds no email address or account identifier — https://www.anthropic.com/legal/data-processing-addendum
Google Play and Apple for purchases and subscription validation
open-meteo.com, which receives coordinates only when you use the weather panel
nominatim.openstreetmap.org (OpenStreetMap), which receives the text you type into the city search — and, as with any web request, your IP address
api.open-elevation.com, which receives a latitude and longitude in the request whenever the App has to look up a location’s elevation
flagcdn.com, which serves the two language-flag icons in the menu and therefore sees your IP address
Google Drive (googleapis.com), which receives your Money Manager and My Events backup files and their photos — but only after you switch Drive backup on, and only into your own private folder (Section 5)
wa.link, a WhatsApp/Meta link shortener: tapping the WhatsApp contact button in the main menu or on your profile opens a wa.link address, so that service sees your IP address before forwarding you to WhatsApp
An over-the-air update service, for update checks
Another user you deliberately link with through Women’s Health partner sharing or share groups
Every other member of a Family Tree you shared — each of them receives the whole tree, which means every person in it and every detail recorded about them, including the caste and gotra fields (Section 3.14)
Authorities, where we are legally required to disclose

Embedded YouTube players may set cookies and be subject to Google’s policies when you play a video.

7.1 Access by our own staff

We should say this plainly rather than let “only you can see it” stand where it is not true. Two named administrator accounts belonging to us have broad access to your data, through our server-side security rules and an internal admin screen. This exists for support and for investigating abuse, and it is limited to those two accounts — but it is wider than “read a support ticket”, and you should have the accurate version.

Those two accounts can read:

your support-chat conversation, and the images attached to it;
your saved AI questions and answers, and your horoscope results;
your profile record and your device list, both in our main cloud database and in our real-time cloud database;
your subscription record, which is keyed by your email address;
your Suva Sait consent record, if you accepted those terms — it holds your email, your account id, your device identifier, your app version, and the city and its latitude and longitude that you had selected;
any security-incident record we raised against your account, which carries your email and a diagnostic description.

They can also write and delete, and this is the part such a section usually leaves out. The write permission in our database rules is not restricted to the records listed above: both administrator accounts can create, change or delete any document in our database, including your synchronised Women’s Health records and your synchronised Money Manager records. In our real-time cloud database they likewise have both read and write on your account entry. We only use this for support and abuse investigation, and we keep no separate copy — but the permission is real, and telling you we can only “read” would be false.

Support-chat images live in our cloud file storage, and we will not promise that nobody else can reach them. Access through the storage interface is limited to you and to those two accounts. However, the chat shows an image using a download link that carries its own access key, and a link like that works for anyone who holds it, signed in or not. If such a link is forwarded, copied or leaked, the image can be fetched with it. Please do not send anything through support chat that you would not want us — or someone holding that link — to have.

Our security rules restrict the records named in Section 13 — your account record, Money Manager, Women’s Health, Kundali backup and support chat — to your own account. We are not going to make the blanket claim that no one else can reach anything we hold, because that is a claim about every collection in our database, and we would rather correct a gap than have promised one does not exist.

8. RETENTION

Data on your device stays until you delete it in the App or uninstall the App.
Data in our cloud is retained while your account exists, and is removed as described in Section 9 after deletion.
AI question history is capped on our server: your saved AI results are trimmed to the most recent 25 per topic, and the audit trail stored inside your own account record to the most recent 100 entries.
Two AI records are not trimmed. The first is a second copy of every audit entry, written into one database-wide audit collection that holds every user’s entries, not a per-account one; nothing trims that collection, so your entries in it accumulate for as long as your account exists (the ones carrying your email are erased with your account — Section 9.2). The second is the copy of your question history kept on your own device, which stays until you delete it in the App or uninstall.
A shared Family Tree is retained until a tree administrator deletes the tree itself, which then runs its own 30-day grace period before the cloud copy is erased. Every uploaded version of the tree file is kept until that point, and the retention does not follow your account — see Section 9.2. A tree you never shared has no cloud copy to retain.
Analytics and crash data are retained according to the retention settings of Google Analytics and of the crash-reporting service.
Backups in your Google Drive persist until you delete them; older Money Manager and My Events backups are pruned automatically to the most recent few.

9. ACCOUNT DELETION

You can request deletion inside the App: Profile → Delete Account, or the Delete Account entry in the main menu.

9.1 The 30-day grace period

Your account is scheduled for deletion 30 days ahead, and you are signed out.
Signing in again within those 30 days automatically cancels the deletion.
After 30 days a scheduled job permanently deletes the data listed below.

9.2 What the automatic deletion removes

After the 30 days, a scheduled job permanently deletes:

Your user record, and your device-information and log entries
Your saved AI results for horoscope, Kundali, matching, Vaastu, Nakshatra, and the Women’s Health topics (period, trying-to-conceive, pregnancy, baby), plus the associated audit records
Your premium/subscription record
Your Kundali cloud backup
Your synchronised Women’s Health records, and any partner-shared summaries and notes
Your synchronised Money Manager records
Your support-chat conversation, including any images you sent in it
Your account entry and stored notification tokens in our real-time cloud database
Your sign-in account itself
Not your Family Trees — this job does not touch them at all. A tree you shared to our cloud stays there even if you are its only member, until a tree administrator deletes the tree itself (Section 9.3). A tree that is yours alone — one you never shared — was never on our servers in the first place, so it goes with the App when you uninstall (Section 9.4).

9.3 What we keep, and why

A few records outlive your account. We would rather list them than imply the slate is wiped completely:

A purchase-verification row tying a Google Play purchase token to your account. Without it, deleting and re-creating an account would reset the anti-fraud guard on a purchase. Your email in that row is replaced with a one-way hash on deletion.
The purchase-token record for that purchase — the token itself plus what Google Play told us about the subscription (product, state, start and expiry). It holds no email address, it is readable only by our servers, and it cannot be used to charge you. It stays because the purchase it describes stays.
A hashed record that this email address was deleted, so a deleted account cannot be recreated to farm the welcome bonus. It stores a hash, not your address.
Hashed security/incident logs, where we had to record an integrity problem on your account.
Your Suva Sait consent record, if you accepted those terms. It is stored as immutable legal evidence of consent and contains your email, account id, device identifier, app version, and the city and coordinates you had selected. Because it is evidence, it is not erased with your account.
Family-tree records you shared with other people. A shared tree belongs to its members too, so removing your account does not delete the tree for them. Ask us if you want your own entries removed from a shared tree.

9.4 What we cannot reach

Data held on your device — uninstalling the App removes it.
Your Money Manager and My Events backups in your own Google Drive — those are yours, and you can delete them from your Google Account’s storage settings.
Receipt photos you saved to your device gallery (Pictures / Mero Nepal / Money Manager) — they are in your own gallery, so you delete them like any other photo.

If anything above did not work as described, email us at the address in Section 12 and we will complete it manually.

10. YOUR RIGHTS

You may:

Access the personal data we hold about you
Correct anything inaccurate — most of it you can edit directly in the App
Delete your account and request full erasure (Section 9)
Export your Money Manager data as CSV from within the App, and request a copy of other data from us
Withdraw permissions — location, notifications, and Google Drive access can all be revoked in your device or Google Account settings
Object or complain to us, or to your local data-protection authority

10.1 Analytics — what you can and cannot switch off, honestly

There is currently no in-app toggle to disable Google Analytics or the crash-reporting service; they are enabled whenever the App runs. We are not going to claim otherwise. What you can do today is limit device-level ad personalisation in your Android or iOS settings, or stop using the App. If you want your analytics data deleted, contact us and we will action it.

10.2 If you are in the EU, the UK or the EEA

The GDPR and the UK GDPR give you the following in addition to the list above. Write to us at the address in Section 12 to use any of them.

Restriction of processing (Art. 18) — you can ask us to pause what we do with your data instead of erasing it, for example while a correction or a complaint is being resolved.
Data portability (Art. 20) — you can ask for the personal data you gave us in a structured, commonly used, machine-readable format, and ask us to transmit it to another provider where that is technically feasible. Money Manager can already be exported to CSV from inside the App; ask us for the rest.
Withdrawal of consent (Art. 7(3)) — where we rely on your consent you can take it back at any time, and it must be as easy to withdraw as it was to give. For the Women’s Health health-data consent this runs through us by email today, not through a button in the App; Section 3.5 says so plainly rather than describing a control we have not built. Withdrawal does not make what we did beforehand unlawful.
Complaint to a supervisory authority (Art. 77) — you can complain to the data-protection regulator where you live, where you work, or where you believe the problem occurred, and you do not have to come to us first. In the UK that is the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/ — in the EU, the list of national authorities is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

We answer these requests within one month of receiving them. If a request is unusually complex we may extend that by up to two further months, and we will tell you within the first month if we need to. We do not charge for any of this.

10.3 Nepal — the Individual Privacy Act, 2075

Mero Nepal is operated from Nepal, and the Individual Privacy Act, 2075 governs what we may do with your personal information. Under that Act:

Your personal information may be collected and used only with your consent, and only for the purpose you were told about when it was collected.
It must be used only for that purpose — not silently repurposed for another one you never agreed to.
It must not be disclosed to anyone else without your consent, except where the law itself compels the disclosure.
Whoever holds it must keep it secure and confidential, and is answerable for a failure to do so.
You have the right to see the personal information held about you, and to have it corrected where it is wrong or incomplete.

If you believe we have fallen short on any of these, write to us first at the address in Section 12 — we would far rather fix it than argue about it. If we do not resolve it to your satisfaction, the Act lets you pursue the matter through the courts in Nepal, and nothing in this policy or in our Terms takes that route away from you.

11. CHILDREN’S PRIVACY

You must be 18 or older to hold an account. Because sign-in is required to use the App (Section 3.1), a person under 18 may use the App only through an account held by their parent or legal guardian, who accepts the Terms, supervises that use, and is responsible for it and for every purchase made from that account. This matches Section 2A of our Terms and Conditions; the two documents state one rule, not two.

Children under 13 may not use the App at all. It is not directed at them and we do not knowingly collect their personal data. The Women’s Health and Money Manager modules are intended for adults. If you believe a child has provided us data, contact us and we will delete it. Where a parent records a baby’s details in the Women’s Health module, that information belongs to the parent’s account and is covered by this policy.

12. CONTACT US

Questions, access requests, or full-erasure requests:

Email: meronepalapp@gmail.com
Website: https://meronepal.app
Delete your account without installing the App: https://meronepal.app/delete-account/

13. SECURITY

We rely on our cloud service provider’s platform security, server-side security rules that restrict your account record, Money Manager, Women’s Health, Kundali backup and support-chat data to your own account, an app-integrity check to attest that requests come from a genuine copy of the App, and TLS for all network traffic. Money Manager can additionally be locked behind a passcode you set, which is stored only as a salted hash on your device. No system is perfectly secure, and we cannot guarantee absolute security.

13.1 If there is a data breach

If a breach of our security exposes your personal data, we will:

tell you without undue delay, both in the App and by email to the address on your account;
describe what happened and which of your data was involved, in plain language — not a generic notice that leaves you guessing whether it was your health records, your ledger, or your family tree;
tell you what you should do about it, such as changing a password you have reused elsewhere or reviewing recent access to your Google Account;
notify the relevant supervisory authority within 72 hours of becoming aware of the breach where the law requires it, and tell you which authority we notified.

We will not hold the notice back until the investigation is finished. If we do not yet know the full extent, we will tell you what we do know and follow up as we learn more.

14. INTERNATIONAL TRANSFERS

Our cloud service provider, and Google for Google Analytics and for Gemini through Google’s AI service, process and store data on servers outside Nepal, including in the United States. Rather than rest that on your having tapped “accept”, here are the safeguards these transfers actually rely on:

Our cloud service provider and Google act as our processors under data processing terms that incorporate the EU Standard Contractual Clauses as the transfer mechanism.
Our cloud service provider and Google LLC self-certify under the EU-US Data Privacy Framework and its UK Extension, which is the further basis relied on for transfers to the United States.
For the paid Claude Opus 5.5 option only, your question and the context summary are also sent from our server to Anthropic, which processes them outside Nepal, including in the United States. Anthropic acts as our processor under Anthropic’s Data Processing Addendum, which includes the EU Standard Contractual Clauses for transfers where data-protection law requires them: https://www.anthropic.com/legal/data-processing-addendum
Ask us at the address in Section 12 and we will send you a copy of the transfer terms we rely on.

And the part a section like this usually omits: we operate this App from Nepal. Nepal has no adequacy decision from the European Commission or from the UK government, and the two administrator accounts described in Section 7.1 reach your data from Nepal. If you are in the EU, the UK or the EEA, that is a transfer to a country without an adequacy decision, and you should know it before you decide to use the App rather than after.

15. CHANGES TO THIS POLICY

We may update this policy. Material changes will be announced in the App, and the “Last Updated” date above will change. Continuing to use the App after an update means you accept the revised policy.

16. CONSENT

By using Mero Nepal, you consent to this Privacy Policy.