Your ghar's data, handled with care.

Dalemma is run by Dalemma (operated by its founder), based in India ("we", "us"). Under the DPDP Act we are the Data Fiduciary for the personal data described here: we decide why and how it is used. You are the Data Principal.

For anything about your data, write to privacy@dalemma.com.

Your account (the organizer)

• Name and email address. If you sign in with Google, we also receive your Google account ID and profile photo link. Google also gives us sign-in tokens, which we store but never use to read anything else in your Google account (no contacts, no Gmail, no Drive).
• Login codes. If you sign in by email, we send a 6-digit code. We store it only in scrambled (hashed) form, and it expires after 10 minutes.
• Sign-in sessions. For each device you log in on, we keep the session's start and expiry time, your IP address and your browser type. We use these to keep you logged in, to stop abuse (for example, limiting how many login codes one address can request) and to investigate security problems.

Your household

• Household name, time zone, reminder times and how you poll the family.
• House rules, such as veg-only Tuesdays, no onion-garlic days or quick-cook days.
• Your menu: which dishes are on or off, how often they can repeat, and any custom dishes you add.
• Meal history: the options we suggested each day, what was finally cooked, and days you skipped (for example, eating out or leftovers).

About each family member (entered by the organizer)

• A name or nickname, and an emoji.
• Diet: veg, egg, non-veg or Jain.
• Foods they skip, and which of those are allergies.
• Fasting days (for example Navratri or Ekadashi) and their fasting rules.
• Which days they usually eat lunch or dinner at home.
• Whether they have their own link or the organizer answers for them (a "managed" profile, often used for grandparents).

Reactions, votes and cravings

• Each person's Nope / Chalega / Haanji on dishes, their votes on today's options, and dishes they crave for tomorrow. We note whether they reacted themselves or the organizer reacted on their behalf.

Reminders (optional)

• If you turn on reminders, your browser gives us a push address and encryption keys for that device. The reminder is delivered through your browser maker's push service (for example Google, Apple, Mozilla or Microsoft). The message is encrypted, so the push service can't read it.

Usage, errors and technical logs

• Product usage events and error reports. See Cookies and analytics.
• Standard request logs kept by our hosting provider (such as time, page requested and IP address), used to keep the service running and secure.
• Server error records, with emails, links and other secrets removed, kept on our own servers for 30 days. Alerts about these errors are emailed to the person who runs Dalemma.

What we don't collect

• No phone numbers, contacts or WhatsApp chats. When you share a message to WhatsApp, Dalemma only prepares the text; you send it yourself from your own WhatsApp.
• No payment details (payments are not live yet).
• No precise location.

Family members don't create accounts. The organizer adds them and shares a personal link. Anyone with that link can see the household name, that member's name, and today's options, and can react or vote as that member. We store only a scrambled (hashed) version of each link, so we can't read it back.

If you are the organizer, you are giving us information about other people. Please add someone only if they are fine with it, tell them what Dalemma is for, and share their link only with them. For children, see Children.

If you are a family member and want your details changed or removed:

• Ask your organizer. In Settings they can edit your details, remove you (your link stops working at once), and then tap Delete for good to erase your name, food preferences, allergies, fasting days, reactions, votes and cravings.
• Or write to privacy@dalemma.com from any email, with your household name and your name as it appears there. We may ask the organizer to confirm, then we'll remove your data.

• To run Dalemma: suggest three meals everyone at home can eat, collect the family's votes, and record the final pick.
• To log you in and keep your account and your family's links secure.
• To send reminders you have switched on, and login codes you ask for.
• To understand which features work and fix errors, using the limited analytics described below.
• To reply when you contact us, and to meet our legal obligations.

We don't sell personal data, show ads, or use your family's data to train AI models for anyone else.

We process your personal data on the basis of your consent, which you give when you create an account and use Dalemma after reading this policy. The organizer gives consent for the details they enter about family members, and confirms they have those people's permission. A small amount of processing, like keeping security logs, is done because the law requires it.

You can withdraw consent at any time, as easily as you gave it: delete your account in Settings → Your data, or write to privacy@dalemma.com. After that we stop processing your data and delete it as described in How long we keep it. Withdrawing doesn't make earlier processing unlawful, and without the data Dalemma can't plan meals for your home.

We use a few trusted service providers ("Data Processors") who handle data only on our instructions and only to provide their service to us:

• Cloudflare: hosting, our database and file storage, and security. Data may be stored in and served from Cloudflare's global network, including outside India.
• Google: sign-in, only if you choose "Continue with Google".
• Resend: sends your email login code (it receives your email address and the code), and sends error alerts to us.
• PostHog (United States): product analytics and error reports, as described below.
• Browser push services (Google, Apple, Mozilla, Microsoft): deliver reminders you switch on.

Some of these providers store data outside India, for example in the United States. The DPDP Act allows this except to countries the Government of India restricts; we will follow any such restriction. We may also share data if the law requires it (for example, a valid order from a court or authority), or to protect people from harm.

• Login cookie. When you log in we set a secure cookie that keeps you logged in. It is essential and is removed when you log out or delete your account.
• Analytics (PostHog), on dalemma.com only. We record simple events such as "household created" or "family member voted". These never include names, emails or household names. Before anything leaves your browser, the secret part of member links and household addresses is replaced with a placeholder. For organizers, events are tied to a random account ID, not your name or email. PostHog stores an ID in your browser to tell visits apart and may estimate a rough location (country or city) from your IP address.
• Screen recordings (organizer pages only). To find confusing screens, PostHog may record how organizer pages are used. Anything you type and all text on screen (including names in your member list) is hidden in recordings; they show layout, taps and scrolling. Family member links are never recorded.
• Error reports. When something breaks, we send the error and the page address (with links and household names removed) to PostHog so we can fix it.

We don't use advertising cookies or trackers from ad networks.

• Account and household data: for as long as your account exists. When you delete your account, it is removed from our live database at once. It can remain in our private backups (a nightly copy kept for 35 days, and our database provider's 30-day restore history) until those expire, and is then gone for good. We use backups only to recover from a failure, never to bring back a deleted account.
• A removed family member: their past ratings stay (so they can be added back) until the organizer taps Delete for good or deletes the account.
• Login codes: 10 minutes. Sign-in sessions: until you log out or the session expires.
• Analytics and error reports: kept by PostHog for a limited period under our account settings, and never linked to your name or email.
• Records the law requires: where the law makes us keep certain logs (for example, to look into misuse or a security incident), we keep only those, only for as long as required (currently up to one year), and then delete them.
• Unused accounts: if an account isn't used for 3 years, we may delete it. We'll email you at least 48 hours before, so you can log in to keep it.

Under the DPDP Act you can:

• Access a summary of your data and how it is used. Tap Download my data in Settings for a copy of everything tied to your account, or write to us for a list of the providers we share it with.
• Correct or update anything: edit members, rules and your menu in Settings.
• Erase your data: Delete my account in Settings removes your account and every household you run at once (backups expire within 35 days). Organizers can delete a single family member for good.
• Withdraw consent at any time (see Your consent).
• Nominate someone to use these rights for you if you die or can no longer act yourself. Email us their name and contact details.
• Raise a grievance with us, and then with the Data Protection Board of India (see Complaints).

For any request by email, write from the email address on your account so we can confirm it's you. We aim to reply within 7 days, and always within the time the law requires.

You must be 18 or older to create a Dalemma account. Children under 18 can be part of a household only when the organizer adds them.

We use a child's details only to plan the family's meals. We don't show ads to anyone, and we don't track, profile or target children. Member links are never screen-recorded. If we learn that a child's details were added without a parent's or guardian's consent, we will delete them. Parents can write to privacy@dalemma.com at any time.

• Everything travels over encrypted connections (HTTPS).
• Member links and login codes are stored only in scrambled (hashed) form.
• Access to the production database is limited to the people who run Dalemma.
• We keep private, access-controlled backups so a mistake or outage doesn't lose your family's setup.

No service is perfectly secure. If a breach affects your personal data, we will tell you and the Data Protection Board of India as the law requires, explain what happened, and tell you what you can do.

Our grievance contact is the Grievance Officer, Dalemma, at privacy@dalemma.com. Tell us what happened and which account or household it is about. We aim to respond within 7 days, and at most within the period the law requires.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India, set up under the DPDP Act. Please contact us first; the law expects you to use our grievance process before going to the Board.

If we change this policy, we'll update the date at the top. For important changes, such as a new use of your data or a new kind of provider, we'll tell you in the app or by email before the change applies, and ask for fresh consent where the law requires it.

See also our Terms of use.