Effective 1 November 2026 · Version 6
This policy explains what Vekkoa ("the app", "we", "us") does and does not do with your information. We have written it in plain language on purpose. If anything is unclear, that is our fault, not yours, and you are welcome to ask.
Vekkoa is operated by Rajvardhanh Verma, in India. We decide how the personal information described here is used, which makes us the "data fiduciary" under India's Digital Personal Data Protection Act, 2023, and the "controller" under the GDPR for people in the EU and UK. You can reach us at hello@vekkoa.com.
Most of what you do in Vekkoa is saved only in your browser's storage on your own device. It is never transmitted to us or to anyone else:
Your location, if you allow it for the compass, is used on your phone to correct for magnetic north and is not sent to us. Now and then the app may ask our server whether a newer magnetic model is available, so the compass stays accurate over the years; that request carries only the name of the model your app already has (for example "WMM2025"), never a position and never anything about you.
When you use the room-direction scan, the phone's compass is read on the device. Where your phone allows it, its magnetic-field sensor is read too, only to notice metal or electronics nearby that may bend the reading. The field strength is used on the phone for that one moment; it is not stored and not sent.
When you open the app, it may also ask our server whether Vekkoa is being looked after, so that a short, calm notice can be shown to everyone while we make an update. That request is the same for everyone and carries nothing about you: no position, no name and no identifier. As with any visit to a website, our host can see the network address a request comes from. Nothing is kept on your device except which notice you chose to close.
The Material Atlas and your place. The Material Atlas can show the typical climate of your area and the weather for the next few days on site. It asks for your location only when you press "Use my location". Your phone then rounds your position to the centre of an area about 50 km wide before anything leaves it; the exact position is neither kept nor sent. That rounded position is kept on your device, and it is sent to our server so that our server can ask NASA POWER for the area's typical climate and MET Norway for the forecast. Neither of them receives anything about you, and we do not keep a record of who asked. "Forget my place" removes it from your device. If you prefer not to share a location, you can choose a climate and region by hand and the Atlas works the same way.
Backups. Settings lets you save a copy of this information as a file, and restore from one. That file is created on your device and goes wherever you put it; we never receive it. Please keep it as carefully as you would keep the information itself, because it can contain names, birth dates and your firm details.
If you clear your browser data or uninstall the app, this information is permanently deleted from that device. We don't have a copy, so we can't restore it for you.
If you sign in, we collect and store your first name and email address, along with a record of the plans and packages you hold (so we know what to unlock for you, and until when) and the date your account was created. Your name is used to address you directly — for example, in emails and inside the app — and is never shared with anyone else.
Signing in works by emailing you a one-time code or link, which stays valid for 15 minutes. We use a third-party email delivery service (Resend) solely to send that email, and a welcome note when you first sign up; they process your email address only to deliver it and do not use it for any other purpose. You can be signed in on several devices at once. Each device gets its own secure session, which lasts 30 days, and any of them can be signed out independently without affecting the others.
To make switching accounts easy, this device remembers the name and email address of the last few accounts used to sign in, so you can choose one with a tap. They are kept only on your device, are never sent anywhere except in the sign-in request you make, and never include a code or a session. You can remove any of them, or all of them, on the sign-in screen, and an account you delete is removed from the list. A fresh code is emailed each time you sign in.
When you buy a plan or package on the web, the payment is handled by Razorpay (in India) or, where it is offered for payments from outside India, Stripe. Your card, UPI or bank details go to them and never reach us. We keep a record of each payment — the payment reference, what you bought, the amount and currency, the time, and your email — so that we can give you access and keep complete accounting and tax records. Where we issue a GST invoice and you ask for one, we also keep the business name and GSTIN you enter. Because accounting and tax rules require it, we keep these payment records even after you delete your account.
If you buy in the Apple App Store or Google Play, the store takes the payment and we receive only a confirmation of the purchase.
If you buy a gift, we keep the gift code, the recipient's first name, your message, and your email address (for the receipt) so the gift can be opened. When it is claimed, we record the email address that claimed it.
If you hold a plan or package, we may now and then send you a calm email about it: a heads-up well before it ends, a welcome back after it has ended, a thank-you after you choose a plan, a note when your Year Ahead is ready, a thank-you once a year if you have stayed with us, or a quiet seasonal line. Professional and Enterprise members may receive a short personal check-in instead. These notes never charge you or renew anything, and they never carry offers, discounts or countdowns. We write them in the language you use in the app, and we send them through the same email delivery service (Resend) as your sign-in emails.
Every note has a link to stop them with a single tap. If you stop them, we do not write to you about your plan again unless you ask us to, and nothing else changes: your plan, your saved homes and everything you made stay as they are.
To do this we keep, on your account, the language you last used in the app (just its short code), whether you have asked us to stop, and a short record of the notes sent to you (the kind of note, its subject and the date; the most recent dozen), so that nobody is written to twice. A note that is prepared but not yet sent is kept in a queue until it is sent or set aside.
The yearly thank-you may come with a small gift: a Home Report added to your account for two years, free, with nothing to do, nothing to pay and nothing asked in return. We keep it on your account like any other plan, marked as a gift, so we do not count it as a purchase. On the first time the app opens after it arrives, it plays one short, quiet animation of thanks. To play it only once, the app keeps a short list on your device (the reference of each gift it has already shown, at most twenty); that list is never sent to us.
The reading pages of the Advanced Library and the full Build & Care documents guide are kept on our server, not on the public website. When your plan includes them, the app asks our server for them and sends your sign-in session so the server can confirm your plan; the server replies with the pages. They are held in your device's memory while you read and are not saved on the device, so they are not available offline and they disappear when you sign out or your plan ends. We do not record which pages you open.
So that the reading cannot be copied and resold unnoticed, every page is sent with a short invisible mark, worked out from your account and a key only our server holds. It changes no word you see, it is not stored anywhere, and it does not say what you read; it is simply inside the text we send you. If pages carrying it are found shared or sold, we can use it to see which account they were sent to. We also limit how many premium pages one account can open in an hour, or from how many different network addresses: past that the reading pauses for fifteen minutes. We keep no record of this beyond a short, masked note in the server's memory that forgets itself.
If you are signed in on a plan that includes the Design Studio, a layout you save there is also kept in your account — with the room photo, if you added one — so it follows you between devices. It is the only home information that ever reaches our server, and only when you save it while signed in. It is removed when you delete your account.
If you choose to list yourself as a Vastu or Feng Shui practitioner, we collect:
This information is used to display your public profile in the directory and to let us check you before we put a Verified mark on it. A Verified profile shows which checks were made. Until then it shows “New member”. Your listing is made with your consent, and you can ask us to change or remove it at any time.
If you tap “I am a practitioner” and send your details for review because you have no invitation, we keep what you send in a private list: your name, city and tradition, your email and/or phone number, what you wrote about yourself, and a link if you added one. You tick a box to agree that we may contact you about it. Nothing is published and nobody outside Vekkoa sees it. We read it, reply to you ourselves, and use it only for that. If we do not invite you, we delete it within 12 months, or sooner if you ask.
If we contact you before you have registered, for example to invite you to list yourself, we keep a private note: your name, city, how to reach you, where we found your work, and what we checked. It is used only to contact you and to check your listing. Tell us and we will delete it.
If you report a review or a listing, we keep the report: the reason, any note you add, and the time. We also keep a one-way code made from your account or your network address, so that one person cannot flood the queue. The code is not your name or email and cannot be turned back into either. A person at Vekkoa reads each report. If you hide a practitioner in the app, that choice is saved only on your device.
To review a practitioner you must be signed in. We keep your rating and comment together with your email address so that each person can leave one review per practitioner; your email is never shown publicly. The short rating and comment you can leave after a secure session are not linked to your name or email.
When you start or join a secure chat/voice session, our signaling server temporarily relays connection information (not message content or audio) between the two devices so they can connect directly. This technical connection data is not stored after the session ends. Message text and voice audio are end-to-end encrypted and travel directly between the two devices — they never pass through, or get stored on, any server we operate.
If you use the in-app Contact Us form, we collect the name, email address, and message you provide, together with what you choose from the short lists above the message (what it is about, and optionally what exactly), solely to relay your message, sort it so the right person reads it, and reply to you. If you email us at hello@vekkoa.com, your message and email address reach our mailbox, which is hosted by Zoho Mail. If you send a business enquiry (for a Professional or Enterprise plan, or an expert review), we also collect the organisation, role and scale you describe, and keep the enquiry on our server (the most recent 500) so that we can follow up. We don't publish any of this, and we don't use it for marketing. A message you send through the Contact Us form is kept on our server so that a person can read and reply to it: up to 60 days after it has been answered, and for at most one year if it is never answered, and then it is deleted. A small number of trusted helpers may, when we ask them to, read the first name, a partly hidden email address and the topic of a message and send a reply using wording we have approved; they cannot see the words of a message about a payment, your personal data or a business enquiry, and each action is recorded.
Once, and only after you have made something in the app, Vekkoa may ask which age group you are in (11 to 20, 21 to 30, 31 to 40, 41 to 50, or over 50, each shown with the stage of life it often goes with: students, studying and starting out, making a home, growing and renewing, settled and sharing) so that we can improve the quality of Vekkoa and your experience with it. You can decline. The answer is sent only as the name of the group: it is not linked to your name, email or device, and no birth date is asked. If you are under 18, you are welcome to ask a parent or guardian before you answer, or to leave it unanswered.
Phone notifications are not switched on yet: they start only once Vekkoa is available in the Play Store or the App Store, and until then nothing in this section happens. When they do start, if you turn on notifications (for example the daily reminder in Home Rhythm), your browser generates a private subscription — not your name or email. We store that address together with only these few facts, so the reminder can arrive at the right time: the hour you chose, your time zone's offset from universal time, your language, the last day you opened the app (so we stay quiet on a day you were already here) and, if you asked for a rest, the day it ends. We send an empty knock; your phone itself chooses the small note to show, from the date, the season of your place and the rooms you keep, all of which stay on your device. We never receive or send the note, your home, your rooms or your name, and we store no encryption keys, because an empty knock needs none. The knock travels through the push service run by the maker of your browser or phone (for example Google, Apple, Mozilla or Microsoft), which can see that a knock was sent to that address, but there is no note in it to see. Turning the reminder off in Home Rhythm, or notifications off in Settings, removes this subscription from our server. A phone that no longer answers is removed automatically.
We count, per day, how often features are used — for example rooms scanned, breathing sessions, or designs saved — together with a non-personal detail such as the room type or tradition. These counts carry no name, email address or device identifier.
We also note a few milestones — such as a first completed scan, signing up, or buying a plan — so that we can see where people get stuck. Each note records the time and the kind of milestone and, if you are signed in, your email address; if you are not, it records your IP address, which we keep only to spot abuse.
For Home Intention, the Lotus of the Home, the room-direction scan and the thank-you moment we count only that something happened (a page opened, a change started, a petal opened, a reading steadied, a moment played), never what you chose or which home it was. What you choose in Home Intention, and which petals are open, stay on your device. The strength of the magnetic field, if your phone offers it, is read on your phone only and is never stored or sent.
The thank-you line on Home (after you choose a language, and the first time you reach Home each day) keeps one thing on your device: the date it was last shown. Nothing about it is sent anywhere.
For Home Rhythm and Notice we count only that something happened (a note marked done, a reminder switched on, how a space felt, a change started or finished), never what you wrote or which home it was.
A few early steps (opening the app, starting a first scan, finishing it, and looking at the plans) are counted once for each device, with no name, email or identifier sent. To avoid counting the same device twice, your device remembers that it has sent each step.
In the same way, and so that we can see whether people stay, the app notes once for each device that it was opened again after at least a week, and again after at least a month. It does this by comparing today with the date your device already keeps of when you first opened Vekkoa (used for the greeting). That date stays on your device and is never sent; only the name of the step is.
If requests to our server look abusive — for example repeated failed attempts or forged payment messages — we log the IP address and the kind of event (keeping the most recent 500 entries) and may block that address temporarily.
Vekkoa does not use tracking cookies. It does save its own files and your settings in your browser's storage (local storage and a cache) so that it opens quickly, remembers your choices and works offline. These stay on your device, and clearing the site's data removes them.
Our server also reads NOAA's public pages for the next magnetic model, which involves nothing about any user. It asks NASA POWER (typical climate) and MET Norway (the forecast) about the rounded area you choose in the Material Atlas, and Nager.Date for public holidays. Those requests come from our server, so those services see our server's address and the rounded area, not your device or you. When you use Vekkoa, these services can see your device's IP address: Google Fonts (to show the app's typefaces); date.nager.at (public-holiday dates for festival greetings — we send only the year and your country code); Razorpay's or Stripe's checkout (only when you start a payment); Google's connection-assistance (STUN) server, and the other person in the session (only when you start or join a secure chat/voice session, so the two devices can find each other and connect directly); and WhatsApp or your email app (only when you tap to contact a practitioner). To run Vekkoa we use Netlify to serve the website, Render to run our server, MongoDB Atlas to store the information described above, Resend to send sign-in and service emails, and Zoho Mail for our mailbox. They handle that information only on our behalf, to provide those services.
The providers named above (Netlify, Render, MongoDB Atlas, Resend, Zoho and Razorpay) run their services in data centres that may be in India or in other countries. We use established providers and give each one only what it needs to do its job. By using Vekkoa you understand that your information may be processed in those places.
Vekkoa is not directed at children. Accounts, purchases and practitioner listings are for people who are 18 or over. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, please tell us at the address below and we will delete it. The optional age-group question described above is anonymous: it is sent as the name of a group only, so it is not personal information about any child or adult.
Under India's Digital Personal Data Protection Act, 2023, you have the right to ask for a summary of the personal data we hold about you, to have it corrected or erased, to have a complaint about it answered, and to nominate another person to exercise these rights for you if you cannot. If you are in the EU or UK, you have rights under the GDPR (access, correction, deletion, portability, restriction and objection). If you are in California, you have rights under the CCPA. We honour these rights for all users, wherever they live, as a matter of practice and not only where the law requires it.
How to use them. Write to hello@vekkoa.com (or use Contact in the app) and say what you would like. To protect you, we may first check that you are the account holder, for example by sending a code to the email address on the account. We will reply within a reasonable time and in any case within the time the law gives us. If you are not satisfied with our answer, you can complain to the data-protection authority where you live (in India, the Data Protection Board of India).
Vekkoa contains no advertisements and never will, in any form — no ad networks, no sponsored content, no third-party ad SDKs of any kind. Nothing in this app is funded by or shares your data with advertisers. This isn't a current policy that could change quietly — it's a structural commitment, and any future update that introduced ads would require rewriting this policy explicitly and telling you directly, not burying it in fine print.
We use HTTPS encryption for all connections to our website and server. Premium pages are sent only to a signed-in person whose plan includes them, and are marked so that browsers do not keep a copy. Secure consultation sessions use end-to-end encryption (DTLS/SRTP via WebRTC), meaning the content is unreadable even to us. Payment messages from Razorpay and Stripe are accepted only when their signature checks out. We keep notes of what we checked about each practitioner, not copies of identity documents.
We keep our own backups of the service’s data (accounts, plans, payment records, practitioner and review records). They are locked with a passphrase, they leave out sign-in sessions, a copy is saved on our server every day (the latest seven are kept), and a locked copy is emailed to us once a week. We delete emailed copies after 90 days. If you delete your account, it can remain in a backup until that backup is replaced, and then it is gone.
No system is perfectly secure, and we can't guarantee absolute security — but we've deliberately designed this app to minimise what could ever be exposed in the first place, by keeping your personal home data on your device unless you choose to save a layout to your account. If a breach affecting your personal information ever occurs, we will tell you, and the authorities, as the law requires.
If we make material changes to this policy — especially if we start collecting or storing more data — we will update this page and its date at the top, and where appropriate tell you in the app. This policy is written to accurately describe Vekkoa as it is today; as features are added, it is updated before they launch.
Questions, requests, or concerns about this policy or your data — including a complaint about how we handle your information — can be sent to hello@vekkoa.com with "Privacy" in the subject. It is read by Rajvardhanh Verma, who is responsible for answering it.