Privacy Policy

Who We Are

This Privacy Policy explains how AI Saarthi Labs LLP collects, uses, discloses, retains and protects personal data when you use the DrinkBuddy mobile application and related services (collectively, the "Service").

AI Saarthi Labs LLP is the operator and, where applicable, the controller or Data Fiduciary responsible for the processing described in this Policy.

This Policy should be read with the DrinkBuddy Terms of Use.

Scope and Important Context

DrinkBuddy is an adult self-tracking, entertainment and AI-companion application. It can process information about drinking sessions, moods and conversations. This information may be private and, in some jurisdictions, may be regarded as sensitive or health-related even though DrinkBuddy is not a healthcare service and does not use it to diagnose a medical condition.

DrinkBuddy is not an emergency, medical, counselling or crisis-monitoring service. Conversations are not continuously reviewed by people. Do not use DrinkBuddy to report an emergency.

The Service is intended for people aged 18 and older. Alcohol-related features also require a declaration that the user has reached the legal drinking age and is legally permitted to consume alcohol where they are physically located.

Personal Data We Process

The categories below describe current processing. A category may not apply to every user or every feature.

3.1Account and profile data

We process your mobile number, display name, date of birth, gender selection, country selected during signup, avatar, account identifiers, signup date and account status.

We use the date of birth to enforce the minimum account age. Before the first drinking session, we record the version and server timestamp of your legal-drinking-age declaration. We do not collect government identity documents or precise location to verify that declaration.

3.2Authentication and OTP data

To authenticate your mobile number, we and our providers process the number, delivery and verification status, request timestamps and anti-abuse or rate-limit information. A short-lived OTP session record contains the mobile number, a salted hash of the OTP and an expiry timestamp. We do not store the OTP in plain text.

Expired OTP-session and rate-limit records are subject to Firestore's automatic time-to-live deletion process. Removal may occur after the expiry timestamp rather than immediately, commonly within approximately one day.

3.3Preferences and onboarding data

We may process drinking frequency, preferred drinks, usual settings or quantities, selected AI persona, safety reminders, "bewares," onboarding status and other choices used to configure the Service.

3.4Drinking-session and wellbeing-adjacent data

We process information you choose to record during a night, including:

• drinks, quantities, types and timestamps;
• water entries, pace and user-selected targets;
• mood and morning-after mood;
• place or setting text you type and who you say you are with;
• safety reminders, "bewares," belongings and end-of-night checklist responses;
• session start, end and status information; and
• AI-generated observations and recaps.

The place field is user-entered text. It is not GPS location.

3.5Chat and AI data

We process the messages you send, AI responses, recent conversation history, chosen persona and cards or actions associated with the chat. When a drink is detected in chat, a proposed entry is shown to you. Nothing is added to your drink tracker unless you confirm it.

For AI responses and recaps, the relevant request may include your message and recent conversation; current session facts such as drink counts and types, pace, hydration and time; chosen session settings such as typed place, company, mood, target and "bewares"; and the country you selected at signup.

AI prompts do not currently include your name, mobile number, Firebase user identifier, date of birth or advertising identifier.

The signup country is used only for light contextual flavour, such as potentially relevant food, music, films, sport or expressions. It is not treated as nationality, residence or current location and is not used to decide what is legal, select an emergency number, identify where to obtain alcohol, or infer religion, caste, ethnicity or language.

3.6Multiplayer and game data

We process room codes, room membership, selected display name and avatar, game settings, role information, answers, clues, votes, actions, scores, timestamps and connection state needed to operate multiplayer games.

Other people in a room can see information needed for gameplay. Section 9 explains that visibility.

3.7Notifications and local alarms

We process an Expo push token, notification preferences and delivery-related technical data. Expo relays push notifications to the applicable platform service, including Google Firebase Cloud Messaging or Apple Push Notification service.

Recap notifications use generic text such as "Last night's recap is ready" and "Tap to read how your night went." The AI-written recap itself is stored with the user's night and displayed inside the app rather than in the push body.

Alarms and snoozes are ordinarily scheduled on the device. Their timing and status may be stored locally as needed for the feature.

3.8Optional analytics

Firebase Analytics remains disabled unless you choose to opt in. If you opt in, analytics may process a pseudonymous Firebase user identifier, screen views, feature interactions, timestamps, app version, device and operating-system information, approximate network-derived region, age band, gender selection and technical event data.

We are designed not to send your mobile number, name, date of birth, chat text, free-text session fields or detailed drink-session content as analytics event parameters. Analytics events relating to account deletion are sent only if analytics is enabled.

You may change the analytics choice in Profile. Withdrawing stops new optional analytics collection but does not automatically delete information already collected; you may request deletion where applicable.

3.9Device, network and operational data

Our servers and providers may automatically process IP address, device or app identifiers, device type, operating system, app version, language, request timestamps, network status, authentication events, error information, security events and usage or performance metadata needed to operate, secure and troubleshoot the Service.

Sentry crash reporting is not currently active. If we activate Sentry or another optional crash-reporting service, we will update this Policy and configure the service and consent controls before sending data to it.

3.10Support, complaints and legal communications

If you contact us, we process your contact details, registered number where relevant, message, attachments and records of our response.

3.11Account-deletion feedback

The deletion screen may ask for an optional reason from a fixed list and an optional comment of up to 200 characters. After deletion, we may retain a standalone feedback record containing the deletion date, selected reason, optional comment and number of days between signup and deletion. It is not stored with the user's account identifier or mobile number. Because free text and timing can sometimes identify a person indirectly, do not include names, phone numbers or other sensitive details in the comment.

AI Saarthi Labs does not retain a deleted user's mobile number for the purpose of contacting that person for feedback.

3.12Consent and legal records

We process consent choices, policy or declaration versions, timestamps, withdrawal records, grievance records and information reasonably necessary to demonstrate compliance, secure the Service or establish and defend legal claims.

3.13Future purchases, advertising and affiliate activity

If paid services are introduced, we may receive product, price, currency, subscription status and transaction identifiers from an app store or payment provider. We ordinarily will not receive complete payment-card details.

Advertising identifiers and advertising SDK data are not currently collected for live advertising. If advertising or affiliate features are introduced, we will update this Policy and provide legally required choices before relevant processing begins.

Information We Do not Currently Request

DrinkBuddy does not currently request precise GPS location, device contacts, microphone recordings, camera images, photo-library content or advertising identifiers for live advertising.

The current Android application uses permissions needed for internet access, notifications, vibration, wake locks and boot completion. It does not require draw-over-other-apps or read/write external-storage permission for the described features.

If a future feature begins collecting a new data category, we will update our notice and request any permission or consent required by law.

Sources of Personal Data

We obtain personal data:

• directly from you when you register, complete onboarding, use a session, chat, play, set preferences, delete an account or contact us;
• from other players when they invite you, vote, answer or otherwise interact with you in a room;
• automatically from your device, app and network when you use the Service; and
• from service providers supporting authentication, hosting, notifications, analytics, AI, security, media and app operations.

If you provide another person's personal data, you are responsible for having authority to do so and avoiding unnecessary disclosure.

How We Use Personal Data

We use personal data to:

• create, authenticate and secure accounts;
• enforce the 18+ account requirement and record the legal-drinking-age declaration;
• personalise the companion, personas, reminders and content;
• operate tracking, session history, checklists, alarms, recaps and next-day check-ins;
• generate AI responses, observations and recaps;
• create, join, operate, synchronise and score multiplayer games;
• deliver push notifications;
• provide support and respond to complaints and rights requests;
• measure and improve the Service if optional analytics is enabled;
• detect abuse, prevent fraud, maintain security and enforce our Terms;
• comply with law and lawful process and establish, exercise or defend legal claims;
• communicate account, security, policy and service messages;
• administer paid or commercial features if introduced with required notices and choices; and
• create and use aggregated or de-identified statistics that are not reasonably capable of identifying an individual.

We do not sell personal data. We do not use raw chat or detailed drink-session information to build third-party advertising profiles.

Lawful Bases Where Applicable

The lawful basis depends on the processing and the law applicable to you.

7.1India

We process digital personal data for lawful purposes with consent or another use permitted by applicable law. You may withdraw consent through available controls or by contacting us. Withdrawal does not affect processing already lawfully completed and may make a requested feature unavailable.

7.2European Economic Area and United Kingdom

Where the EU GDPR or UK GDPR applies, we may rely on:

• performance of a contract to provide the account and features you request;
• legitimate interests to secure and support the Service, prevent abuse, improve non-essential aspects and establish or defend claims, after considering your rights;
• consent for optional analytics, direct marketing, future personalised advertising and processing for which consent is legally required; and
• legal obligation to comply with applicable law and binding legal process.

Drinking and mood information may be sensitive or health-related in some contexts. We do not use it to diagnose a medical condition. Where applicable law requires explicit consent for particular processing, we may request that consent or make the relevant feature unavailable in that jurisdiction.

AI Processing

8.1Fireworks AI as the primary provider

DrinkBuddy sends AI requests from server-side infrastructure to Fireworks AI, Inc. Fireworks hosts and runs the open-weight DeepSeek model used to generate responses. DeepSeek developed the model, but AI Saarthi Labs does not use DeepSeek's first-party API for this processing and does not send DrinkBuddy prompts to DeepSeek as a separate recipient.

Fireworks states that ordinary open-model inference does not log or store prompt or generation content without customer opt-in and does not use customer API inputs to train or improve models without opt-in. AI Saarthi Labs has not opted in to prompt logging or model training. Prompt and response content may exist transiently in volatile memory, including brief volatile prompt caching. Fireworks may retain limited technical metadata such as token counts to operate, bill for, secure and troubleshoot its service.

Fireworks may apply automated safety screening to inputs or outputs. Such screening is not a human-monitored emergency service and may not detect every harmful message.

8.2OpenAI fallback

If Fireworks fails, times out or is unavailable, DrinkBuddy may automatically send the same relevant prompt and session context to OpenAI as a fallback. We configure the fallback request with provider-side storage switched off where supported.

OpenAI states that API data is not used to train its models unless the customer opts in. AI Saarthi Labs has not opted in. OpenAI may retain prompts, outputs and related safety or abuse-monitoring information for up to 30 days unless a shorter or zero-retention control applies to our account or the particular service. OpenAI may perform automated abuse monitoring.

8.3Our storage and AI limitations

Provider-side handling is separate from our storage. AI Saarthi Labs may retain chat history, generated responses, recaps and related session data in Firebase so that you can access the requested features and history.

AI output is probabilistic and can be inaccurate, inappropriate or offensive. DrinkBuddy does not use AI to make solely automated decisions producing legal or similarly significant effects.

When AI identifies a possible drink in chat, it proposes an entry. The drink is saved only if you confirm it.

Multiplayer Visibility

Anyone with a valid room code may attempt to join the associated room, subject to available controls. Participants can see information needed for gameplay, including display name, avatar, answers, clues, votes, scores, role-dependent actions and room status.

A room code is not a promise of confidentiality. Other players may remember, screenshot or separately record information shown to them. Do not enter private or sensitive information in a display name, clue, answer or other free-text field.

When We Disclose Personal Data

We may disclose personal data to the following recipients for the described purpose.

10.1Other players

We disclose multiplayer information as described in Sections 3.6 and 9.

10.2Service providers

Current providers may include:

• Google Firebase - phone authentication, Firestore databases, Cloud Functions, infrastructure, push delivery and consent-based Firebase Analytics;
• 2Factor.in - delivery of OTP messages using the mobile number and verification information needed for SMS delivery;
• Expo - push-notification delivery and relay to Google Firebase Cloud Messaging or Apple Push Notification service;
• Fireworks AI, Inc. - primary AI inference using a Fireworks-hosted open-weight DeepSeek model;
• OpenAI - automatic fallback AI inference when Fireworks cannot complete the request;
• GIPHY or another media provider - GIF or sticker search and delivery; and
• Google Play and future payment, support, advertising or communications providers when the related feature is introduced.

Providers may act as our processors or as independent controllers for limited aspects of their services. Their processing locations and retention practices vary.

10.3Legal, safety and rights protection

We may preserve or disclose information when reasonably necessary to comply with law, a court order or lawful government request; report or investigate cyber incidents; protect life or safety; prevent fraud or abuse; enforce agreements; or establish, exercise or defend legal claims.

DrinkBuddy is not an emergency-monitoring service and does not promise that messages will be detected, reviewed or reported.

10.4Business transactions and advisers

If AI Saarthi Labs is involved in a merger, financing, restructuring, acquisition, insolvency or transfer of the Service, personal data may be disclosed under confidentiality and transferred subject to applicable legal requirements. We may also disclose necessary information to lawyers, auditors, insurers and other professional advisers under confidentiality obligations.

Analytics, Advertising and Affiliate Links

11.1Optional analytics

Firebase Analytics remains disabled unless you opt in through the separate analytics choice. Acceptance of the Terms and this Policy is not analytics consent.

11.2No current sale or behavioural advertising

As of the Last updated date, AI Saarthi Labs does not sell personal data, and DrinkBuddy does not use personal data for third-party cross-context behavioural advertising. Google AdMob is not active.

11.3Future advertising

We may later introduce advertising. Before activating personalised or cross-context behavioural advertising, we will update this Policy and app-store disclosures, identify material partners and purposes, and provide the consent, rejection, withdrawal or opt-out controls required by applicable law.

Consent to product analytics will not by itself constitute consent to future personalised advertising.

11.4Affiliate links

If DrinkBuddy uses an affiliate link, AI Saarthi Labs may receive a commission when you follow the link or complete a qualifying transaction. The merchant or affiliate network may independently process click, transaction and device data under its own notice. Sponsored and affiliate relationships will be identified where required.

International Data Transfers

DrinkBuddy is operated from India and uses providers that may process data in India, the United States and other countries. Fireworks and OpenAI may process AI requests in the United States or other provider locations. Those countries may have privacy laws different from those where you live.

Where transfer restrictions apply, we use an appropriate lawful mechanism where available, such as a provider data-processing agreement, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, an adequacy decision or another legally recognised safeguard.

If a required basis or safeguard cannot be put in place, we may restrict an affected feature or the Service in the relevant jurisdiction.

Data Retention

We retain personal data only for as long as reasonably necessary to provide an active account and requested history, fulfil the purposes described in this Policy, comply with law, maintain security, resolve disputes and enforce agreements. We do not promise a fixed period where the relevant technical deletion schedule is not yet configured.

The following principles currently apply:

• Account, profile, preferences, session history, drink and water logs, chats, moods, safety reminders and recaps are retained while the account is active or until the user deletes them through an available control or deletes the account, subject to the exceptions below.
• Play Together rooms, members, votes and actions are automatically scheduled for deletion approximately 12 hours after room creation. Only aggregate daily counts that do not identify players are retained for metrics. A room may be removed earlier when its host deletes their account.
• Expired OTP-session and rate-limit records are subject to Firestore time-to-live deletion. Removal may occur after expiry, commonly within approximately one day.
• Fireworks handles prompt and generation content as described in Section 8.1. OpenAI may retain fallback API content in abuse-monitoring logs for up to 30 days as described in Section 8.2. AI Saarthi Labs separately retains chat and session history as described in paragraph (a).
• Firebase Analytics information is retained according to the Google retention configuration applicable to our account and may later be aggregated. Users can withdraw optional analytics for future collection and request deletion where applicable.
• Account-deletion feedback is retained only for as long as reasonably needed to analyse deletion reasons and improve the Service. It is stored without a user identifier or phone number, but free-text comments may still be indirectly identifying.
• Consent, grievance, support, security and legal records are retained for as long as reasonably needed to demonstrate compliance, resolve the matter, prevent fraud and establish or defend claims.
• Server, security and cyber-incident logs are retained for the operational or legal period that applies. Certain logs may be retained for at least 180 days where Indian cyber-security directions apply.
• Deleted data may remain temporarily in encrypted or access-restricted backups until overwritten through the ordinary backup cycle. It is not used for ordinary product purposes and, where reasonably practicable, deletion controls are reapplied if a backup is restored.

We may retain aggregated or de-identified information that is not reasonably capable of identifying you.

Account Deletion

You can delete your account through Profile using the two-step deletion process or request deletion by emailing saathi@aisaarthilabs.com. We may require recent authentication or proportionate proof of account control.

The server-side deletion process is designed to remove the user's nights and chat messages, room memberships and private game records, rooms hosted by the user, profile, applicable OTP records and Firebase Authentication account. The sign-in record is processed last so an interrupted request can be retried.

Deletion is permanent. If the process is interrupted or fails, some information may already have been removed. Retry the request or contact us so that remaining steps can be completed.

We do not retain the deleted user's phone number for feedback contact. Aggregate metrics, standalone deletion feedback described in Section 3.11, short-lived logs, legally required records and backups pending overwrite may remain. Votes or actions associated with the user inside another person's room may remain only until that room's scheduled deletion.

Deleting a DrinkBuddy account does not automatically cancel a future app-store subscription; that subscription must also be cancelled through the applicable store.

Security and Incident Response

We use reasonable technical and organisational safeguards appropriate to the nature and risk of the data. Measures may include encrypted network connections, Firebase access rules, server-side API calls, access controls, authentication, least-privilege access, monitoring, provider due diligence and incident-response procedures.

No system is completely secure. Protect your device, OTPs and room codes, and avoid entering unnecessary sensitive information in chat or free-text game fields.

If a personal-data breach occurs, we will investigate, contain and document it and notify affected individuals and competent authorities where and within the time required by applicable law.

Your Rights and Choices

Depending on your location and applicable law, you may have rights to:

• receive information about processing;
• request access to or a copy of personal data associated with you;
• correct, complete or update inaccurate information;
• request deletion or erasure;
• withdraw consent without affecting processing already lawfully completed;
• object to or restrict certain processing;
• request portability of eligible information;
• opt out of direct marketing, sale, sharing, targeted advertising or qualifying profiling;
• nominate another person where Indian law provides that right;
• complain to us and an applicable regulator or supervisory authority; and
• receive equal service and not be unlawfully discriminated against for exercising a right.

You may use available Profile controls or email saathi@aisaarthilabs.com. Describe the right and data concerned. We may verify your identity, account control, residence or an authorised agent's authority. Rights are not absolute, and we may limit a request where an exception applies, it cannot be verified, another person's rights would be adversely affected or retention is legally required.

You can disable notifications through device settings and withdraw optional analytics in Profile. Service-critical messages and reminders you requested may continue while the account remains active.

Region-Specific Information

17.1India

Eligible Data Principals may exercise rights available under the Digital Personal Data Protection Act, 2023 and its applicable rules as and when the relevant provisions are in force, including access to information, correction, completion, updating, erasure, grievance redressal and nomination. Consent may be withdrawn through available controls or by contacting us.

You should first use the grievance process in Section 21. Where the statutory framework permits, you may then approach the Data Protection Board of India through its designated mechanism.

17.2European Economic Area and United Kingdom

Eligible individuals may have rights of access, rectification, erasure, restriction, objection and portability, the right to withdraw consent, and the right to complain to an applicable supervisory authority.

You may object to processing based on legitimate interests, including relevant profiling, and to direct marketing. DrinkBuddy does not currently make decisions based solely on automated processing that produce legal or similarly significant effects.

If an EU or UK representative becomes legally required for our offering, we will publish the representative's contact details. We may restrict availability where necessary to comply with local processing or transfer requirements.

17.3United States

Residents of certain states may have rights to know, access, correct or delete personal data, obtain a portable copy, opt out of sale, targeted advertising or qualifying profiling, limit certain uses of sensitive personal data, and appeal a denied request.

We do not currently sell personal data or share it for cross-context behavioural advertising. These rights apply only where the relevant law covers AI Saarthi Labs and the processing at issue.

Service and Marketing Communications

We may send OTP, account, security, requested reminder, alarm, recap, check-in, grievance and policy communications needed to provide or protect the Service.

We will send promotional communications only where permitted. You may opt out using provided instructions or by contacting us. Opting out of marketing does not stop essential service communications or reminders you requested.

Third-Party Links and Content

The Service may include GIFs, stickers, links or content supplied by third parties. Their independent processing is governed by their own notices. An integration or link does not mean AI Saarthi Labs endorses the provider's content or privacy practices.

Changes to This Policy

We may update this Policy to reflect changes in law, providers, features, retention, advertising or other practices. We will post the revised version with a new Last updated date. If a change materially affects how we use personal data or reduces your rights, we will provide reasonable notice and seek renewed consent where required.

Privacy Contact and Grievance Officer

Use this contact for privacy questions, rights requests, account deletion, data complaints, security concerns and reports of unlawful or privacy-invasive content.

For a grievance, include your name, contact details, registered mobile number where relevant, a description of the issue, supporting information and the remedy requested. Never send a password, financial PIN or OTP.

We aim to acknowledge qualifying grievances within 24 hours and resolve them within seven days, or within another period required by the law applicable to the particular request. Certain content complaints may require faster action. Privacy-rights requests may follow separate statutory response periods.

If dissatisfied, you may have the right to approach the Data Protection Board of India, a Grievance Appellate Committee, a court, consumer forum or another competent privacy authority, subject to applicable requirements.