How your questions are stored and used
What Ask Mahaguru collects, why, who can see it, and how to get rid of it. Written to be read, not to be survived.
Version 8. Wording is never edited once published — a change is a new version at a new address, so the words you agreed to stay readable at the link you agreed to them from.
1. The short version
Your questions are stored against your account so you can come back to a conversation. To answer them, the text is sent to two AI companies, Anthropic and Google, on paid terms that do not allow them to train on it. If you use voice chat, your voice is sent live to Google. No administrator has a screen for reading your profile, and reading anyone's conversation has to be justified in writing and is logged.
We ask for a birth year and a country once, to work out which minimum age applies to you. We do not ask for your date of birth, we do not record your IP address against your consent, and we run no advertising or analytics trackers.
You can delete everything from inside the app, and it actually deletes.
2. Who is responsible for your information
The controller of your information is Mahaguru Foundation Australia Pty Ltd, 8 Plumegrass Avenue, Denham Court, NSW 2565, Australia.
Contact for privacy questions and requests: secretary@mahagurucenter.org.
This policy covers the Ask Mahaguru website, the iPhone and iPad app and the Android app.
3. What we collect, why, and how long we keep it
Itemised, because a list is the only honest way to answer this question.
| What | Why | Kept until |
|---|---|---|
| Your email address, or the private relay address Apple gives us | To identify your account and sign you in. It is not used to market anything to you. | You delete your account |
| Your name, if you sign in with Apple or Google and choose to share it | It arrives with the sign-in and is stored with your account. We do not ask for it and do not show it anywhere. | You delete your account |
| An account identifier | A random identifier for your account. It is given to the seller when you buy a plan so that the purchase can be attached to your account. | You delete your account |
| Birth year and country | The year decides which minimum age applies to you, and it is a year rather than a date because a full date of birth is a strong identifier and the age check does not need one. The country decides the minimum age too, and which crisis helplines an answer shows you, so that a number you are given is one you can actually call. We also record which threshold was applied and whether you passed it. | You delete your account |
| Which consents you gave, at which wording, and when | To be able to show what you agreed to. Recorded as a log, so a withdrawal is as provable as a grant. Each record notes the app version and the country you gave, not your IP address. | You delete your account |
| Your questions and the answers, with the sources each answer cited | To answer you, and to let you return to a conversation. Alongside each answer we keep which AI model wrote it, the result of an automatic check of whether the answer stayed within the teachings, and any crisis resources that were shown with it. | You delete your account. |
| A written record of voice chat turns | When you use voice chat, the answer you were given and a written version of what you asked are saved to the conversation, marked as spoken. No audio is kept. See section 6. | You delete your account |
| Your preferences: answer depth, language, whether to keep the teachings' own terms, how familiar you are with the teachings, what brings you here, and what fills most of your days | To shape answers the way you asked for. "What fills most of your days" is optional; one of its options is "In religious life", which can indicate a religious belief, and it is covered by the same consent as your questions. | You delete your account, or change the setting |
| Thumbs up or down on an answer, and any comment you write | To find answers that are wrong. A written comment needs a separate consent, because a comment is free text and may be read by a person. | You delete your account |
| Counts of the questions you have asked this month and today, and a ledger of questions that do not expire | To apply the limits on your plan, and to know what is left of anything given at sign-up or bought. The ledger records grants, spending and refunds rather than editing a single number. | You delete your account |
| Purchase records | If you buy on the website: the customer identifier Paddle assigns you and the status and dates of your subscription. If you buy in the iPhone or iPad app: Apple's transaction identifiers and the status and dates of your subscription. Never your card details, which the seller holds. | You delete your account, except as described in section 11 |
| Spoken answers we generate for you | If your plan includes generated speech and you ask for an answer to be read aloud, the audio file is stored so it does not have to be generated again. | You delete your account |
| Which in-app notices you have dismissed | So a notice you have closed stays closed. | You delete your account |
| A notification token for your device, if and when you turn notifications on | To tell you that an answer you asked for is ready. The notification carries no question, no answer and no conversation title, only that something is waiting. Notifications are not yet available; nothing is held until they are and you turn them on. | You turn notifications off, or delete your account |
| Emails you send to us | To answer you. | As long as needed to deal with what you wrote about |
| The topic and shape of questions, with no account attached | To see what people ask about in aggregate: the topic, depth, language, model, whether the crisis path ran, and what the answer cost. This carries no identifier and cannot be traced back to you. | Kept, since there is nothing in it that is yours |
| An audit record when an administrator accesses someone's data or deletes an account | So that access can be checked afterwards. | Kept without your identity after you delete your account |
4. What is deliberately not collected
Your date of birth. Only the year, because that is all the age check needs.
Your IP address against your consent record. It would add very little to the record and a great deal to what that record reveals about you.
Your location. The country you give us is the one you chose, not one we inferred.
Advertising identifiers, analytics trackers or tracking cookies. There are none in the website or the apps.
Any recording of your voice. See section 6.
5. Why we are allowed to do this
Asking about the Dhamma can reveal your religious or philosophical beliefs, and so can the optional "In religious life" answer in your preferences and anything you say in voice chat. In the European Union and the United Kingdom that is special-category data, and the lawful basis we rely on for it is your explicit consent, which is why it is asked for separately, on its own screen, and can be withdrawn on its own. Without it we do not answer, because there would be no lawful basis to process the question at all. We ask for that consent from everyone, wherever they live.
Sending your questions to AI providers is covered by a separate explicit consent, for the same reason.
Everything else rests on performing our contract with you: providing the Service you asked for, applying the limits of your plan, and keeping the records the law requires us to keep. Detecting extraction and abuse rests on our legitimate interest in protecting the teachings and the Service.
In California, information that reveals religious belief is sensitive personal information. We use it only to provide the Service you asked for, and the "Reviews and comments" switch on your Account screen is where you limit any use beyond that.
6. Voice, speech and audio
This section describes four different things, because they behave differently.
Voice chat (beta). Voice chat is available only to accounts we have enabled for it. When you start it, your microphone is on and your voice is streamed live, through our server, to Google's Gemini service, which understands what you said, searches the teachings on our server, and speaks an answer back. Our server sits between you and Google so that Google never sees your account and the teaching passages never leave our server to your device. The screen tells you this at the moment the microphone starts.
What Google receives during voice chat is the audio itself, our instructions to the model, the passages our server finds, and a note about which language to answer in. It does not receive your name, email address, account identifier or earlier conversations. After each turn, the written transcript of what you said is checked by an automatic crisis classifier, the answer is checked against the passages, and both go to Google for those checks as text.
We keep no recording of your voice. What we save to your conversation is a written record of each turn that involved the teachings: a short written version of what you asked, prepared by the model from what it heard, and the answer you were given, in full even if you stopped it before it finished. Greetings and small talk are not saved.
Voice chat uses questions from your plan, as the Terms of Use describe.
Read-aloud (generated speech). If your plan includes spoken answers and you ask for an answer to be read aloud, the text of that answer is sent to Google to be turned into speech, and the audio file is stored on our behalf by Cloudflare so that it does not need to be generated again. The audio is marked as AI-generated inside the file. It is deleted when you delete your account.
Read-aloud (device speech). On the free plan, and on any plan if you prefer, answers can be read aloud by your phone's or browser's own speech engine. On a phone, that runs on the device. In a web browser, some voices run on the browser maker's servers, and we cannot tell which voice your browser used.
Dictation. When you dictate a question instead of typing it, the recognition is done by your phone's operating system or your browser, and the audio may be sent to Apple's or Google's speech service to be turned into text. The device decides that, based on the language and on what it can do offline, and it does not tell us which it chose. Your phone asks for your permission separately before any of this happens, and what that company does with the audio is governed by its own privacy policy, not ours. The recognised text then travels exactly as a typed question would. If you would rather no audio ever left your device, type instead of dictating.
7. The AI providers, and what they receive
Two companies process your questions: Anthropic and Google. Both are used on paid business terms under which what we send is not used to train their models. Anthropic keeps what is sent for up to 30 days and then deletes it.
When you ask a question, this happens:
1. Your question is sent to Google to be turned into a searchable form and to check its language, and the candidate passages are sent to Google to be ranked. This happens for every question.
2. Your question is checked for signs of crisis, first by a word list on our server and then by a Google model.
3. The question, the last few messages in that conversation, the passages found, and a short note describing how you prefer to be taught are sent to either Anthropic or Google, whichever is configured for that kind of question, to write the answer.
4. The finished answer and the passages are sent to Google to check that the answer stayed within the teachings and to label its sources and topic.
What is not sent to either company: your name, your email address, your account identifier, your country and your age. Nothing that could identify you rides along with a question.
The note about how you prefer to be taught is built from your preferences: familiarity with the teachings, what brings you here, and what fills most of your days. It shapes the framing and examples of an answer only. It is never used on a crisis answer.
8. Temporary chat
A question asked in temporary chat is not saved to a conversation. The answer is held on our server only until your device confirms it has received it, and in any case for no more than about an hour, so that an answer can be collected if your phone put the app to sleep mid-answer. The anonymous aggregate record described in section 3 is still written.
9. Who else receives your information
We do not sell your information, and we do not share it with anyone for advertising.
| Recipient | Role | Where | What they receive |
|---|---|---|---|
| Supabase | Database and sign-in provider | Frankfurt, Germany | Everything in section 3 |
| Vercel | Runs the website and the API | The API runs in Frankfurt, Germany. | Requests and their logs |
| Cloudflare | Stores generated spoken answers | Audio files, keyed by an internal message identifier | |
| Anthropic | Writes some answers | United States | Section 7 |
| Searches, checks, writes some answers, generates speech, and understands voice chat | United States | Sections 6 and 7 | |
| Paddle.com Market Ltd | Seller of purchases made on the website | United Kingdom | Your email address, your account identifier, and what you bought. Paddle holds your card details and is a controller in its own right for the purchase. |
| Apple | Seller of purchases made in the iPhone or iPad app; sign-in provider if you choose it | United States | Your account identifier attached to the purchase. Apple is a controller in its own right for the purchase. |
| Google, as sign-in provider | If you choose Google sign-in | United States | Handled under Google's own policy |
| Apple or Google, as your device's operating system | Dictation, device speech, notifications | As per your device | Section 6 |
10. International transfers
Our database is in Germany, but your questions are sent to AI providers in the United States to be answered, so a transfer outside the European Economic Area and the United Kingdom happens for every question, and where the database sits is not the whole story.
For people in Australia, this means your information is disclosed to overseas recipients in Germany, the United States and the United Kingdom.
11. Getting rid of it
Delete your account from the Account screen. It queues an erasure with a 7-day cooling-off period so that a mistaken tap can be undone, and you can call it off yourself from the same screen during that time. After that the erasure runs and removes your conversations, messages, feedback, spoken-answer audio, profile, preferences, consent records, age record, usage counters, purchase records and notice dismissals, and your sign-in itself. Cached copies of your answers on your own device or browser are removed when you request deletion or sign out.
A subscription bought on our website is cancelled when the erasure runs. A subscription bought through Apple cannot be cancelled by us; cancel it yourself in your device's Settings, or Apple will keep charging you.
A few things survive, and each is deliberate:
The aggregate topic record has nothing of yours in it to remove.
The record that an administrator once accessed someone's data, or deleted an account, is kept with the identity removed, because an audit log a deletion can erase is not an audit log.
The raw notifications the sellers sent us about your purchases are kept for reconciliation and dispute purposes. These contain your email address (Paddle) or your account identifier (Apple).
Records the sellers hold themselves are governed by their own policies.
If you can no longer sign in, write to us from the email address on the account and we will delete it for you.
You can withdraw the optional consents at any time from your Preferences and Account screens, and it takes effect immediately. The consents that are required to answer at all cannot be withdrawn while keeping the account; to withdraw those, delete the account.
12. Your rights
Depending on where you live, you may have the right to access the information we hold about you, to receive a copy of it in a portable format, to have it corrected or erased, to restrict or object to its processing, to withdraw a consent, and to complain to a supervisory authority. You will not be treated differently for exercising a right.
Most of these you can do yourself: read your conversations in the app, change your preferences, withdraw a consent, or delete your account. For anything else, write to secretary@mahagurucenter.org. We will respond within one month, or within any shorter period the law where you live requires.
European Economic Area and United Kingdom. You have the rights under the GDPR and UK GDPR listed above. You may complain to your local data protection authority; in the UK that is the Information Commissioner's Office.
Australia. You may access and correct the information we hold about you under the Australian Privacy Principles, and complain to us first and then to the Office of the Australian Information Commissioner.
California. You have the right to know, delete, correct, and to limit the use of sensitive personal information, and the right not to be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioural advertising.
India. You have the right to access, correct and erase your information, to withdraw consent as easily as you gave it, to nominate someone to act for you, and to have your grievance addressed.
Sri Lanka. The Personal Data Protection Act's substantive obligations have not commenced as at the date of this policy.
13. Children
There is a minimum age, and it depends on which country's rules apply to you: 13 in some countries, 18 in others, and 16 elsewhere, including throughout the European Economic Area and the United Kingdom. If you are under it, the Service will not answer, and you are not asked to consent to anything further. We refuse rather than ask a parent, because we would rather hold no information about a child than hold a parent's consent to it. If you believe a child under the applicable age has created an account, write to us and we will delete it.
14. Who can see it inside the Foundation
Your profile and preferences are not readable by any administrator. Not as a policy: there is no screen for it.
Reading an individual's conversation is possible, but it has to be justified in writing and is recorded in an audit log that deletion cannot erase. It is not a default view anyone opens.
Administrators can see your email address, when you joined and last signed in, your plan and your usage counts, and any deletion request you have made, so they can support you.
The Center's answer reviewers can review answers only in their own conversations. If you give the "Reviews and comments" consent, your written comments on answers may be read by a person.
Anyone with administrative access to the database itself can read it. That access is limited to the people who operate the Service.
15. Security
Your information is stored in a managed database with row-level access rules, transmitted over encrypted connections, and reachable only through authenticated requests. The teaching passages used to answer you are never sent to your device. Spoken answers are stored in a private bucket and served through links that expire after an hour. Cached answers on the website are kept in your browser's local storage, which is not encrypted at rest; on the phone apps they are kept in the app's own storage.
17. Changes to this policy
When this policy changes materially, you will be asked to read and acknowledge the new version before continuing. Every version stays published at its own address, so you can always read the one you actually accepted, and which version you accepted is recorded against your account.
18. How to complain
Write to us first at secretary@mahagurucenter.org. If you are not satisfied, you may complain to the supervisory authority where you live, as listed in section 12.
Known gaps
Listed rather than papered over. Each one needs a decision from someone qualified to make it, and a plausible-looking clause nobody wrote on purpose would be worse than the blank.
- To confirm: ABN or ACN.
- To confirm: whether to name a privacy officer, and whether an EU or UK representative under GDPR Article 27 is required given users in the EEA and UK and no establishment there.
- Note for lawyer: a separate, login-protected reviewer site exists for the Center's own reviewers; it serves the teaching texts, not user data, and each read is logged. It is not a consumer surface and is not covered here.
- To confirm: Apple sign-in stores the name in account metadata; Google sign-in probably does the same by default. Decide whether to stop storing it.
- To confirm: there is no way yet to delete a single conversation, and the published policy says there is. Either build it or say "your account" only.
- To confirm: our hosting provider keeps ordinary request logs, which include IP addresses, for its own operational period. State that period once it is known.
- Note for lawyer: California also requires a notice at collection naming the sensitive information and its purposes; confirm this policy discharges that.
- To confirm: the saved question is the model's own summary of what it heard, with the raw speech recognition transcript as fallback. Decide whether to say "prepared by the model" as drafted.
- To confirm: whether the storage bucket is set to the European Union jurisdiction. The code allows it; the setting is not visible from the code.
- To confirm: Google's retention period for paid Gemini API traffic, including the live voice service, and whether zero-data-retention terms are wanted from either provider.
- To confirm: the region of the website deployment.
- To confirm: EU jurisdiction setting
- Note for lawyer: the transfer safeguard relied on needs to be named here. Anthropic and Google both offer standard contractual clauses in their commercial terms and Google Cloud is under the EU-US Data Privacy Framework; confirm which applies to the services actually used and whether a transfer impact assessment is needed given the religious nature of the data.
- Decision needed: these payloads are currently kept indefinitely with no link to the deleted account. Either purge or redact them at deletion, or set a retention period and state it here.
- To confirm: an automated export is not built. A request for a copy of your data is currently handled by hand; the one-month deadline under GDPR starts when someone asks.
- Note for lawyer: confirm whether the Foundation is an APP entity given the small business threshold, and whether it opts in regardless.
- Note for lawyer: the Digital Personal Data Protection Rules require a standalone notice available in English or any scheduled language of the person's choice, enforceable from 13 May 2027.
- To confirm before publication.
- To confirm: the consent wording currently says reviewers may read your questions and answers; in practice they can only read their own. Align the wording.
- Note for lawyer: consider whether to state this, and confirm the internal access policy.
- Note for lawyer: keep this section factual and short; do not promise a standard the Foundation has not been audited against.
- To confirm: what Paddle.js sets on the plans page.