Privacy Policy
- Who we are
- The short version
- What we collect and why
- How your photos, videos and voice notes move
- Chats: what we can and cannot see
- Who can see what
- Outside services that handle your data
- Data stored outside India
- How long we keep data
- Your choices and your rights
- Age and young users
- Security
- What stays on your phone
- Changes to this policy
- Contact and Grievance Officer
- What changed from version 1.1
1. Who we are
Sagora is a social app where people share journeys: a challenge, a moment, a thought or an achievement, and the steps that follow. Others can react, reply, join a journey with steps of their own, connect and chat.
Sagora is run today by Shourya Bordia (10, Chopra Bhawan, Rudra Vihar, Udaipur, Rajasthan) and Rammith K.R. (49-A, Amrit Nagar, Bedla Road, Badgaon (post), Udaipur, Rajasthan), India, two individuals working together as partners ("we", "us"). We decide why and how your data is used, so under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") we are the "data fiduciary". Contact: support@sagora.live.
We plan to move Sagora to a private limited company in India. We will tell you at least 30 days before your data moves, name the company, and you can delete your account first. This policy keeps applying.
2. The short version
- We collect what we need to run Sagora: your account details, what you post, who you connect with, your messages, and basic technical data.
- Your account and posts are stored in a database in Mumbai, India. Photos, videos and voice notes are stored in the United States. Emails we send go through a provider in Japan.
- Chats in Messages are end-to-end encrypted. We cannot read them. Discussion rooms on posts are not end-to-end encrypted.
- We show no ads. We use no analytics or tracking tools, no advertising ID and no crash-reporting service.
- We do not ask for your location or your contacts.
- You can delete your account in the app. Your data is erased 14 days after you ask.
3. What we collect and why
When you create an account you tick one box: "I agree to the Terms of Service and Privacy Policy, and I've read the Data Notice". We use your data on the basis of that consent. Some records we keep because the law requires them or to keep people safe; the DPDP Act calls these "legitimate uses".
Your account
| Data | When | Why | Seen by others? |
|---|---|---|---|
| Email address | Sign-up (required) | Sign you in, send password-reset codes and account emails, answer you. Email sign-up works only with Gmail, iCloud and Outlook addresses. We keep a simplified form of the address (for example without dots or "+tags") to stop one inbox making many accounts. | No |
| Password | Sign-up (required) | Sign you in. Stored only as a hash by Supabase Auth, never in plain text. Before you set a new password, the app checks whether it appears in known data breaches (see section 7, Have I Been Pwned). | No |
| Full name | Sign-up (required) | Shown on your profile and next to what you post. You can change it in Settings. | Yes |
| Date of birth | After sign-up (required) | Check you are 16 or older, and mark accounts of people under 18 so they get the limits in section 11. Set once. Kept in a separate private area that no part of the app can read back. | No |
| Username | After sign-up (required) | Your public handle. You can also sign in with it. | Yes |
| Country | After sign-up (required). You pick it; we do not read your device location. | Know where our users are and apply the right rules. | No |
| Consent record | When you tick the sign-up box | Prove what you agreed to: which version of each document, the time, your phone type (Android or iPhone) and the app version. | No |
| Sign-in sessions | Each time you sign in | Keep you signed in. Supabase Auth stores each session with the IP address and the device type it came from. | No |
If you use Continue with Google
Google tells us your name, your email address, whether Google has verified it, your Google account ID and a link to your Google profile picture. Supabase Auth stores these in your sign-in record. We use the name to make your username and full name, and the email to identify your account. We do not use your Google profile picture as your Sagora photo. We do not get your Google password, contacts or anything else from your Google account. With Google sign-in we then ask only for your date of birth and country.
Your profile
| Data | Why | Seen by others? |
|---|---|---|
| Profile photo (optional): taken with the camera or picked from your gallery | Show who you are | Yes, to anyone who can open your profile, even if your account is private |
| Banner (optional): a picture you make in the banner editor, or one of our six pictures | Decorate your profile | Yes, as above |
| Astronaut picture: one of ten pictures picked at random when your account is made, shown when you have no photo; you can change it | Default picture | Yes |
| Private account switch, "Who can message you", your posting defaults | Apply your choices | No (others see their effect) |
| Counts: connections, journeys started, journeys joined | Shown on your profile | Yes, even if your account is private |
What you post and do
| Data | Why |
|---|---|
| Journeys and steps: their type (challenge, moment, thought, achievement, attempt, outcome), words, photos, videos and voice notes, and each step's settings (who can see it, who can join, whether you approve joins, whether replies are on) | Publish what you share to the people you choose |
| Outcomes and their status (in progress, fully worked, partly worked, not worked) | Show how an attempt went |
| Steps waiting for approval, approvals and declines, drafts (declined or moved steps, seen only by you) | Run joining and approval |
| Reactions, journeys you follow, invite lists | Show reactions and send updates |
| Discussion-room messages, photos, GIFs and emoji reactions on a step or a journey | Run the rooms. These are not end-to-end encrypted: we store the words and files and can read them. |
| Connections, connection requests and blocks | Decide who sees what and who can message you |
| Reports you send: what you reported, the reason, your note | Review problems and act on them |
| Searches | Find people, journeys and steps. We do not keep a history of what you searched. |
What you view
When you view a step while signed in, we record the time you first and last viewed it, how long it was on your screen and how much of it you saw (for example how much of a video played). We use this only to show you steps you have not seen first, to stop showing you steps you have seen in full, and to give each step's author totals of views and time. Authors never see who viewed. We delete the time and the "how much" 180 days after your last view of that step, and the rest when you delete your account. If you are under 18 we only record that you saw a step.
If you use Sagora without an account, your viewing history stays on your phone. Our server only counts your view in a step's totals, under a scrambled form of a random number made on your phone.
Notifications
| Data | Why |
|---|---|
| In-app notifications (reactions, joins, approvals, invites, requests, new steps) | Show you what happened |
| Push token (an address for your phone given by the push service) and your phone type | Send push notifications, if you allow them on your phone |
| Push settings: which kinds you want, quiet hours and your time zone, message preview on or off, muted chats | Send only what you asked for, at the times you chose |
Password reset
If you forget your password, our server makes an 8-digit code and emails it to you. We store only a keyed hash of the code, never the code itself. A code works for 10 minutes and for 5 tries. We keep a short log of reset emails sent and wrong tries, for 2 days, to stop abuse. After a reset we sign you out on every device and email you that your password changed. If your account uses only Google sign-in, we email you a reminder to use Continue with Google instead of a code.
Technical data
- IP address. Our server reads it to limit how many requests one address can make (sign-in, password reset, people using Sagora without an account). We do not store it in our database. Supabase Auth stores it with your sign-in sessions, and Cloudflare's request logs may include it (section 9).
- Request logs. For each request our server logs your account ID, the kind of request, the result and how long it took. Never your email, password, codes or tokens.
- Under-16 check. If someone under 16 tries to sign up, we do not keep their date of birth. We keep a salted hash of their email for 30 days so the same email cannot try again straight away.
When you write to us
If you email support@sagora.live, we keep your message and our reply to deal with your request, for 1 year after the case is closed. Our mailbox is hosted by Hostinger.
What we do not collect
Your device location, your contacts, an advertising ID, or anything for tracking you across other apps or sites. We do not use analytics, advertising or crash-reporting tools. If this changes we will update this policy first.
4. How your photos, videos and voice notes move
- On your phone. The app prepares the file before upload: photos become a WebP image of at most 1080 pixels and 1 MB, videos are compressed to 480p, voice notes to AAC audio. Chat files are encrypted on your phone first (section 5).
- To our server. The app sends the file over an encrypted connection (HTTPS) to our server at api.sagora.live, which runs on Cloudflare. Long videos go up in 5 MB parts, and an upload left unfinished picks up the next time you open the app.
- Checked. Our server checks the type, size and dimensions. For photos (including profile photos and banners) and GIFs it removes hidden metadata, such as the location where a photo was taken, and Cloudflare Images checks the real format and size. We do not separately remove metadata from videos or voice notes on our server.
- Stored. The file goes into a private Backblaze B2 storage bucket in the United States (US East). Our database in Mumbai records who owns it, what kind of file it is, its size and which post or chat it belongs to. The file itself is never in the database.
- Viewed. When someone opens a post, their app asks our server for the file. Every time, our server checks in the database whether that person may see it: the step's audience, connections, blocks, and membership of the room or chat. Only then does it send the file. To make it faster, Cloudflare may keep a copy in the data centre nearest the viewer for up to 7 days, but the check always runs first, so a cached copy is never shown to someone who may not see it. The viewer's phone also keeps a copy in its cache.
- Deleted. When you delete a step, a profile photo, a banner or your account, we delete the file record and erase the file, with all its stored versions, from Backblaze. Our server does this straight away or through a job that runs every 5 minutes and retries if Backblaze fails. Copies in Cloudflare's cache can no longer be reached and expire within 7 days. Copies already saved on someone else's phone (for example a screenshot or a phone cache) are outside our control.
5. Chats: what we can and cannot see
Direct chats, group chats and "Message yourself" in Messages are end-to-end encrypted with open-source tools (vodozemac, which implements the Olm and Megolm protocols). Each phone makes its own keys. Messages, photos, GIFs, videos, polls, to-do lists and reactions are encrypted on the sender's phone and can be read only on the phones of the people in the chat.
We cannot see: the words, files or reactions in a chat, or your private keys.
We store and can see: the encrypted messages and files; who is in each chat and their role (owner, admin, member); when each message was sent and how big a file is; read positions; whether you pinned, favourited, archived or muted a chat; group names; message requests; each phone's public keys (up to 5 phones per account); and key messages waiting to reach a phone, which we delete after 30 days if no phone collects them.
Chat backup (optional). If you set a chat backup password, your phone sends us an encrypted copy of your chat keys, so you can read old chats on a new phone. We cannot open it without your password or the recovery key shown to you once. We do not hold a copy of either. If you lose both, nobody can restore the backup.
Push previews. With "Show message preview" on (the default), a chat push carries no message text. Your phone fetches the encrypted message, decrypts it and shows it; the text is hidden while your phone is locked. With it off, the push shows only one line such as "asha Sent you a message".
Reports. If you report a chat message, your phone sends us the text of that message (and the kind of any file in it) so we can review it. We keep this with the report.
Lawful requests. Because we do not hold the keys, we cannot hand over the content of chats. We may share the records we can see where a court or authority lawfully requires it, or to deal with a serious and immediate threat to someone's life or safety.
6. Who can see what
| What | Who can see it |
|---|---|
| A step set to Public, its files and its discussion room | Anyone, including people using Sagora without an account |
| A step set to Connections | You, your connections, and people you invited to that journey |
| A step set to Only me | You, and people you invited to that journey |
| A step waiting for approval | Only you and the journey's owner |
| Your name, username, profile photo, banner and profile counts | Anyone who opens your profile, including people without an account, even if your account is private |
| Who viewed your steps | Nobody. You see totals only. |
| Your email, date of birth, country | Nobody else |
| Chats | Only the people in the chat |
Blocking someone ends your connection and hides your steps from each other. People you block cannot claim keys to start new encrypted chats with you.
7. Outside services that handle your data
Each of these handles your data only to provide its service to us. We work with no advertisers.
| Service | What it does for us | What it gets | Where |
|---|---|---|---|
| Supabase | Database and sign-in | Everything in section 3 except media files: account, profile, posts, rooms, encrypted chats, connections, reports, records; your email, password hash, sessions (with IP and device type) and Google sign-in details | Mumbai, India (AWS ap-south-1) |
| Cloudflare | Runs our server (Workers), DNS for sagora.live, live connections for chats and rooms, media cache, image format checks, request limits | Every request between the app and our server, including your IP address; media files in transit and in its cache (up to 7 days); short request logs | Cloudflare's global network, the data centre nearest you |
| Backblaze B2 | Storage for photos, videos, voice notes, profile photos, banners, room files and encrypted chat files | The files only, under random names | United States (US East, us-east-005) |
| Resend | Sends our emails (password-reset codes, Google sign-in reminders, "password changed") and Supabase Auth's account emails | Your email address and the email's text. Open and click tracking are off. | Japan (Tokyo, ap-northeast-1) |
| Expo push service | Delivers push notifications | Your push token and the push: a one-line text such as "asha wants to connect with you", or for chat previews only ids, the sender's name and a group's name, never the message | United States |
| Google Firebase Cloud Messaging (Android) or Apple Push Notification service (iPhone) | Carries the push from Expo to your phone | The same push | Google's or Apple's servers |
| Google Sign-In | Continue with Google | Google already has your account; it tells us the details in section 3 | |
| Have I Been Pwned (Pwned Passwords) | Checks a new password against known breaches | Only the first 5 characters of a scrambled (SHA-1) form of the new password. Never the password, your email or your account. | Its own servers (served through Cloudflare) |
| Hostinger | Hosts our support mailbox (support@sagora.live) | Emails you send us and our replies | Hostinger's mail servers |
| Google Fonts | Downloads a font when you pick one in the banner editor | Your IP address and the font name |
We may also disclose data:
- to authorities where the law requires it, including reports of child sexual abuse material;
- to authorities that give us a lawful written order. We check each order, give only what it requires and tell you unless the law forbids it;
- to protect someone from serious harm, or to enforce our Terms;
- to the company that takes over Sagora, as described in section 1.
8. Data stored outside India
Your account, profile, posts and records are stored in India. Media files are stored in the United States, our emails pass through Japan, and Cloudflare, Expo, Google and Apple handle data in many countries. Indian law allows this unless the Government restricts a country; it has not restricted any so far, and we will not send your data to a country it restricts. Your rights in section 10 apply wherever the data is.
9. How long we keep data
| Data | Kept for |
|---|---|
| Account, profile, posts, rooms, chats, connections | While your account is open, unless you delete them earlier |
| A step you delete | Its words and files go at once. A "deleted" mark stays in its place so steps after it stay in order. Its discussion room and messages are deleted. |
| A message you delete for everyone | Its words or encrypted content are cleared at once; a "deleted" mark stays |
| Your whole account after you ask to delete it | Erased after 14 days (section 10) |
| Viewing activity | Time and amount seen: 180 days after your last view of that step. That you saw it: until you delete your account. Step totals: as long as the step exists |
| In-app notifications | 90 days |
| Push notifications waiting to be sent | 2 days |
| Push token | Until you log out, the push service says the token no longer works, or you delete your account |
| Chat key messages nobody collected | 30 days |
| Password-reset code / reset ticket / reset log | 10 minutes / 15 minutes / 2 days |
| Sign-in sessions (with IP address and device type) | Until you log out, reset your password or delete your account |
| Uploads that were started but never finished | Deleted automatically, usually within minutes; leftover parts within a few days |
| Cloudflare request logs | Up to 7 days |
| Copies in Cloudflare's media cache | Up to 7 days, unreachable once the file is deleted |
| Email hash after a failed under-16 sign-up | 30 days |
| Reports and what we did about them | 1 year after we close the report. Evidence of child sexual abuse material: at least 1 year, or longer if the police or a court direct. A report stays after the reporter's account is deleted, without their name. Reported chat text sent by the reporter stays with the report. |
| Database backups kept by Supabase | Daily backups, each kept for up to 7 days. Data you delete can stay in a backup until it rolls off. |
| Erasure record | One line saying an account was erased and when, with no personal data |
Indian rules may require us to keep some records longer, for example content removed after a complaint or an order, or records an authority asks us to hold. We keep those only for that purpose. Today your registration details (email, username, date of birth, country) are erased with the rest of your account.
10. Your choices and your rights
In the app
- Change your full name, username, country, profile photo, banner and astronaut picture (Settings, Profile).
- Make your account private, choose who can message you, set who sees and who can join each step.
- Delete a step, move it to your drafts, delete a message for yourself or for everyone, remove someone's step from your journey.
- Remove connections, block and unblock people (Settings, Privacy, Blocked accounts), report steps, accounts and messages.
- Choose which push notifications you get, set quiet hours, turn message preview off, mute chats. You can also turn notifications off in your phone's settings.
- Set, change or delete your chat backup; remove one of your phones.
- Change your password (accounts with a password), or reset it with an emailed code.
- Delete your account: Settings, Account, Delete account. You are signed out at once and the account cannot be used. Your profile and posts stay where they are for 14 days; then the account is erased: your sign-in details, profile, date of birth, consent records, connections, blocks, reactions, notifications, push details, phone keys, chat backup and viewing activity are deleted; your steps lose their content and become "deleted" marks; your messages are cleared; your files are erased from storage. Steps other people added to your journeys stay theirs. Once confirmed, you cannot undo this in the app.
To delete your account without the app, email support@sagora.live from the address on your account.
Your rights under the DPDP Act
- Access: ask for a summary of the personal data we hold about you and how we use it. The app has no download button yet; email us and we will send it.
- Correction: correct, complete or update your data. Most of it you can change in Settings. Your date of birth is set once; to correct it, email us.
- Erasure: delete your account (above), or ask us to erase specific data.
- Withdraw consent: as easily as you gave it, by deleting your account or emailing us. Withdrawing does not undo what we lawfully did before, and we cannot run your account without it.
- Grievance: complain to us (section 15) and, if not resolved, to the Data Protection Board of India.
- Nominate someone to use these rights if you die or cannot act.
Write to support@sagora.live or the Grievance Officer. We will check it is you, acknowledge your request within 24 hours and reply within 30 days.
11. Age and young users
You must be 16 or older to use Sagora. We ask for your date of birth on a neutral screen. If you are under 16 we do not create the account: we delete the sign-in at once, do not keep your date of birth, and keep only a salted hash of the email for 30 days. The app also stops new sign-ups on that phone for 24 hours.
Indian data law treats everyone under 18 as a child. For users aged 16 or 17 we only record that they saw a step, not how long or how much, and we show no ads to anyone. The DPDP rules will require a parent's verifiable consent for under-18s from May 2027. Before then we will either add that step or raise the minimum age to 18, and tell users aged 16 or 17 at least 60 days before.
Parents and guardians can write to support@sagora.live about a young person's account.
12. Security
- All traffic between the app and our server is encrypted (HTTPS).
- The app never talks to our database directly. Every request goes through our server, which checks who you are and what you may do. The database tables are locked to everyone except our server.
- Passwords are stored only as hashes by Supabase Auth. Reset codes are stored only as keyed hashes, expire after 10 minutes and stop working after 5 wrong tries.
- Your date of birth is kept in a private area that no request can read back.
- Chats are end-to-end encrypted (section 5).
- We limit how often an account or an IP address can sign in, reset a password, post, message or upload.
- Media buckets are private; each part of our server uses a storage key with the least power it needs; files are sent only after an access check.
- Our logs leave out emails, passwords, codes and tokens.
No system is perfectly secure. If a breach affects your data, we will tell you without delay through the app or by email, saying what happened, what it means for you and what we are doing, and we will report it to the Data Protection Board of India as the law requires.
13. What stays on your phone
The app keeps some things only on your phone: your sign-in tokens (in the phone's secure storage, for up to 5 saved accounts), your chat keys and decrypted chat files, posts waiting to upload, the banner editor's fonts, your autoplay choice, and, if you use Sagora without an account, the list of steps you have seen in full and the random number used to count your views. Uninstalling the app or clearing its data removes them. Signing out keeps your chat keys on the phone so your chats still work if you sign in again.
The app asks for the camera (photos, videos, profile photo, scanning QR codes), the microphone (voice notes and the sound of videos) and notifications. It uses the system photo picker, so it sees only the photos you choose. Each one is optional, and you can say no and still use the rest of the app.
14. Changes to this policy
We will tell you in the app and by email at least 30 days before a material change, and ask you to agree again where the law requires it.
15. Contact and Grievance Officer
Support: support@sagora.live
Grievance Officer: Shourya Bordia, support@sagora.live (subject "Grievance"), +91 98758 57998, 10, Chopra Bhawan, Rudra Vihar, Udaipur, Rajasthan, India. We acknowledge every complaint within 24 hours and resolve it within 7 days. The Grievance Officer also answers questions about your personal data.
16. What changed from version 1.1
- Renamed SevaFlow to Sagora; new address sagora.live and support@sagora.live.
- Describes the app as it is built today: journeys, steps, outcomes, joining and approvals, discussion rooms, encrypted chats, connections, private accounts, Explore and search. Removed features that do not exist (votes, "poster-confirmed", Seva Score, AI labels, proof documents).
- Added full name, Continue with Google, push notifications, viewing activity, password reset by code, chat backup and message previews.
- Named every outside service and where it runs, including Resend (Japan), Expo, Google and Apple push, Have I Been Pwned and Google Fonts. Backblaze is in the United States. Removed Sentry, which we do not use.
- The app now asks for the microphone (voice notes) and notifications.
- Retention follows what the system actually does, for example account erasure after 14 days, notifications 90 days, Cloudflare logs up to 7 days.
- Explains how media moves and who can see what.