Privacy Policy

Effective Date: 1 April 2026  |  Last Updated: 23 May 2026

NameRoot ("we", "us", "our") is a baby naming application published by Dinesh ("Developer"). This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under applicable laws including the General Data Protection Regulation (GDPR), the Indian Digital Personal Data Protection Act 2023 (DPDPA), and the California Consumer Privacy Act (CCPA).

1. Data We Collect

Category	Data	Purpose	Storage
Account	Anonymous ID (auto-generated) or Google or Apple sign-in email	Authentication, purchase restoration	Secure cloud (Google Firebase)
Baby Profile	Parent names, baby's due date / date of birth, gender preference, religion, ethnicity, and (optional) birth city, birth time & coordinates for birth-star (nakshatra) accuracy	NCI scoring engine — computing compatibility scores personalised to your family	Secure cloud, encrypted at rest
Favourites	Names you save	Building your shortlist	Secure cloud
Usage	Swipe count, session data, names viewed (aggregated, anonymous)	Improving recommendations, app performance	Aggregated analytics (if consented)
Purchase	Transaction ID, product ID, purchase date	Verifying premium access	RevenueCat (processor) and secure cloud
Device	Timezone, locale	Nakshatra calculation (moon position requires timezone), localised pricing	Not stored — used transiently
Crash Reports	Stack traces, device model, OS version, app version (no user identifiers)	Diagnosing and fixing app crashes (essential for service stability)	Firebase Crashlytics — collected under legitimate interest / DPDPA "legitimate use" (necessary for service performance)
AI Portraits	AI-generated baby illustrations (not photographs)	Visual personalisation of name cards	Secure cloud cache (deletable via Settings → Delete Account)

2. How We Use Your Data

• NCI Scoring: Your baby profile (parent names, DOB, religion, ethnicity) is used locally on your device to compute the 6-signal Name Compatibility Index score. Parent names and DOB are sent to our secure server only when needed for nakshatra calculation and semantic meaning extraction.
• AI-Generated Content: Baby-name portrait illustrations are rendered by Google's Gemini AI (the prompt contains only the name, language, and meaning — no personal data). To enrich name-compatibility scoring, the parent name(s) you enter are sent to Anthropic (Claude) to derive a short meaning and themes — this is the one place a personal name is shared with an AI sub-processor; it is processed transiently and cached by name only (and deleted when you delete your account).
• Purchase Verification: Transaction data is processed by RevenueCat alongside the Apple App Store or Google Play to verify your premium purchase. We store only the purchase status (premium/free), never your payment method details.
• Analytics (with consent): If you grant analytics consent during onboarding, we collect anonymous usage patterns (e.g., names explored, features used) to improve the app. You can withdraw this consent at any time in Settings.
• Crash reports (legitimate interest): We collect anonymous crash reports — stack traces, device model, OS version, app version — through Firebase Crashlytics whenever the app crashes. No user identifiers, account data, or personal content are included. This data is processed under GDPR Article 6(1)(f) "legitimate interest" and DPDPA § 7(d) "legitimate use" (processing necessary for performance of service), since basic stability monitoring is essential for us to keep the app working. Crash reports are independent of your analytics consent; if you wish to stop all data collection, the only option is to uninstall the app.

3. AI-Generated Content Disclosure

NameRoot uses artificial intelligence to generate:

• Baby portrait illustrations — these are AI-generated artistic image renderings, not photographs of real babies.
• Name facts and cultural insights — generated by AI (Google Gemini and Anthropic Claude) and may contain inaccuracies. They are provided for informational and entertainment purposes only.

All AI-generated content is labelled with an "AI" badge in the app.

4. Data Sharing & Third-Party Services

Service	Data Shared	Purpose	Privacy Policy
Google Firebase	Account, profile, favourites (with consent or contract basis); anonymous crash logs (legitimate interest); analytics (only if consented)	Authentication, database, storage, crash reporting (always-on for stability), anonymous analytics (consent-gated)	Firebase Privacy
RevenueCat	Anonymous user ID, purchase data	In-app purchase management	RevenueCat Privacy
Google Gemini AI	Baby name, language, meaning (no personal data)	Generating baby-name portrait illustrations	Gemini Terms
Anthropic (Claude)	Parent name(s) you enter	Deriving a short name meaning & themes for compatibility scoring	Anthropic Privacy
Astronomy API	Date, timezone coordinates (no personal data)	Panchang / nakshatra calculation	Used transiently; no account data shared

We do not sell your data. We do not use your data for targeted advertising. We do not share your data with data brokers.

5. Data Retention

• Your profile and favourites are retained as long as your account exists.
• Anonymous usage analytics are retained for 14 months, then automatically deleted by Firebase.
• Cached AI-generated content (name facts, parent-name meanings) is retained to avoid redundant API calls. The parent-name meaning cache is keyed by the name you entered; it is deleted when you delete your account.
• When you delete your account, all your personal data (profile, favourites, sessions, exports) is permanently purged within 30 days.

6. Your Rights

For all users:

• Access: View all your data in the app (Settings → Export My Data).
• Deletion: Delete your account and all associated data (Settings → Delete Account). This is irreversible.
• Consent withdrawal: Toggle analytics, personalisation, and marketing consent individually in Settings. Changes take effect immediately. Note: anonymous crash reporting is processed under legitimate interest (not consent — see Section 2) and is not affected by these toggles. To stop crash reporting too, uninstall the app.
• Portability: Export a machine-readable copy of your data (JSON) from Settings.

Additional rights under GDPR (EU/EEA/UK):

• Right to rectification — update your profile in Settings at any time.
• Right to restriction of processing — withdraw personalisation consent to stop NCI scoring.
• Right to lodge a complaint with your local data protection authority.
• Legal basis for processing: consent (analytics, personalisation, marketing); contract (account creation, premium purchase, favourites); legitimate interest (core app functionality and anonymous crash reporting necessary for service stability — Art. 6(1)(f)).

Additional rights under DPDPA (India):

• Right to correction and erasure of personal data.
• Right to grievance redressal — see Grievance Officer details below.
• Right to nominate another person to exercise your rights.
• Right to access a summary of your personal data and processing activities.

This policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 (notified 13 November 2025). NameRoot classifies as a Data Fiduciary under the Act.

Sensitive Data Disclosure:

NameRoot collects data that may be considered sensitive under certain jurisdictions, including religion and ethnicity. This data is collected solely to provide the core functionality of the app (personalised name scoring based on your family's cultural and religious heritage). This data is:

• Collected only with your explicit consent during onboarding.
• Stored securely in our cloud database with industry-standard encryption at rest.
• Never shared with third parties for advertising, profiling, or any purpose beyond app functionality.
• Deletable at any time via Settings → Delete Account.

Additional rights under CCPA (California):

• Right to know what data is collected and how it is used.
• Right to request deletion of your data.
• We do not sell personal information. We do not use personal information for cross-context behavioural advertising.

7. Children's Privacy & Age Requirement

NameRoot is designed exclusively for adults aged 18 years and older — specifically parents and expectant parents. The app enforces an age confirmation gate during onboarding: users must confirm they are 18 years or older before completing setup.

We do not knowingly collect personal data from anyone under the age of 18. We do not knowingly collect personal data from children under 13 (or under 16 in the EU/EEA). In compliance with the Children's Online Privacy Protection Act (COPPA, United States), if we learn that we have inadvertently collected personal data from a child under 13, we will delete it promptly and terminate the associated account.

Under the Indian DPDPA 2023, verifiable consent from a parent or legal guardian is required before processing any personal data of a child (defined as a person under 18 years of age). Our age gate prevents such collection.

If you believe a child has provided us with personal data, please contact us at dinosdev1986@gmail.com and we will take immediate action.

8. Data Security & Encryption

We take appropriate technical and organisational measures to protect your personal data:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using industry-standard transport-layer security.
• Encryption at rest: All data stored on our cloud infrastructure is encrypted at rest using industry-standard encryption.
• Authentication security: We do not store passwords. Authentication is handled through Sign in with Apple, Google Sign-In, or anonymous identifiers issued by our cloud platform. Your provider password is never shared with NameRoot.
• Server-verified purchases: Premium status is only granted through our server-side verification flow — never by client code alone. Access controls enforce that users can only read and write their own data.
• Sensitive data handling: Religion and ethnicity data you provide is used solely for name scoring and is never shared with third parties for advertising or profiling purposes.

9. Cookies & Tracking

NameRoot is a native mobile application and does not use cookies. We do not use any third-party advertising SDKs, tracking pixels, or fingerprinting technologies.

10. International Data Transfers

Your data is processed on globally-distributed cloud infrastructure. Data may be transferred to and processed in countries outside your country of residence, including the United States. Our cloud providers maintain adequate safeguards for international data transfers including Standard Contractual Clauses (SCCs) for EU/EEA data.

11. Grievance Officer (DPDPA — India)

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via an in-app notification. The "Last Updated" date at the top of this page reflects the most recent revision. Continued use of the app after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or your data, please contact us:

• Email: dinosdev1986@gmail.com
• In-app: Settings → Contact Support