Privacy Policy
How Sarath Search handles search queries, optional accounts, device preferences, and third-party services.
Draft: do not treat as final legal advice
Items marked [CONFIRM: …] need owner input. Have an Indian lawyer review the completed notice before launch.
1. The short version
You can use public search without signing in. The search box does not require a profile, and the app does not intentionally build an advertising profile from your searches.
Search terms are sent to Sarath Search services so results can be returned. Some features also send the query to an external search, AI, weather, finance, podcast, or media provider. A provider may receive technical request data such as an IP address as part of a normal web request; we cannot promise that every upstream service removes or does not log it.
The app stores functional preferences and optional recent searches in your browser. You can clear recent searches in Settings. Optional account features use Supabase Auth and related account services.
We do not sell personal data. Retention periods, the legal entity, the grievance contact, and some provider settings still need owner confirmation before this draft is final.
2. What we collect and why
The information depends on the feature you use. Public search, account creation, API access, and site submissions have different data paths. We use information to provide the requested feature, protect the service, answer support requests, and meet legal obligations that apply.
The table describes the data visible in the current application and the backend integrations described for this service. The exact database retention period and server-log schedule have not been confirmed. We will publish the actual schedule before treating this notice as final.
| Data | Why used | Where | How long | Optional? |
|---|---|---|---|---|
| Search terms and request details | Run the search or requested vertical feature; basic aggregate query reporting may also occur. | Sarath edge functions and, when used, selected upstream providers. | [CONFIRM: whether raw queries are logged, fields logged, and retention period.] | Use of search sends the query. |
| Hourly aggregate query records, region tag, result count | Service measurement and improving search operations, if the deployed function records these fields. | Supabase database (schema and live logging require owner verification). | [CONFIRM: retention and whether query text or a hash is present.] | Created by service use. |
| Email and authentication record | Create and secure an account for optional developer/account features. | Supabase Auth. | [CONFIRM: account deletion and backup retention schedule.] | Yes; public search does not require it. |
| API key material and usage details | Authenticate API access, enforce limits, and show usage where configured. | Keys are designed to be stored hashed; exact usage logging requires confirmation. | [CONFIRM: API-key and usage-log retention.] | Yes; only API users. |
| Site submission URL, contact email, sitemap and note | Review a request to include a website in the index. | Submission processing and Supabase storage when enabled. | [CONFIRM: retention after approval/rejection.] | Yes; only submitters. |
| Theme, language, model, filters, blocked sites and recent searches | Remember settings and recent searches on this device. | Browser localStorage. | Until cleared by you or browser storage is removed. | Recent history can be disabled; other values are functional settings. |
| Server and security logs | Operate the service, diagnose failures, rate-limit abuse, and investigate security issues. | Hosting, Supabase, and service infrastructure. | [CONFIRM: providers, fields, and retention periods.] | Generated by service requests. |
3. Where results and answers come from
Search results are assembled by Sarath Search services from the sources configured for the feature. These may include the Sarath crawl index, publisher RSS or Atom feeds, Google News RSS, Bing News RSS, and optional keyed providers such as Brave, Serper, or Tavily. Availability varies by feature and deployment. Weather data may come from Open-Meteo, market quotes from Yahoo Finance, podcast discovery from Apple’s directory and show feeds, and media links from public feeds or publisher pages.
When an external provider is used, the search text and the minimum request parameters needed for that feature are sent to it. The provider processes the request under its own terms and privacy notice. Search requests may also expose ordinary technical metadata, including network address and browser request headers, to the provider. Sarath Search does not send your account email as part of a search query unless you include it in the query yourself.
AI answers may send your question and selected result passages to an AI provider, including models hosted through OpenRouter. A Sarath model is used only when it is configured. AI output can be incomplete or wrong. Check the cited source pages and the model name shown beside an answer before relying on it. Do not use an answer as professional advice.
News and media readers may show publisher-provided summaries and link to the source. YouTube playback may use an embedded privacy-enhanced player. Third-party media providers can receive data when content is loaded or played.
4. Cookies, local storage and embeds
The app uses browser localStorage for functional settings such as theme, language, safe-search preference, result count, selected AI model, blocked or hidden sites, and recent searches. If enabled, recent searches remain on the device until you clear them in Settings or remove the site’s browser storage. A browser extension, shared device user, or malware with access to the browser profile may also be able to read local storage.
The current interface does not intentionally use advertising cookies or cross-site advertising trackers. Hosting, authentication, embedded media, and third-party providers may use service cookies and request logs. [CONFIRM: whether analytics or first-party telemetry is enabled, which tool is used, and what fields it records.] We have not completed a cookie inventory for every live provider.
Opening an embed, audio stream, or external link may share device and network information with that provider. You can avoid this by not loading the embed. Browser settings can clear cookies and local storage.
5. How we use and share information
We use information to return results, deliver optional account and API features, remember device settings, maintain service reliability, investigate abuse, respond to requests, and comply with lawful directions. Access is limited to the service components and people who need the information for those purposes, subject to the controls configured by the relevant providers.
We share request information with infrastructure and feature providers as needed to deliver the feature. Infrastructure includes Supabase and the app’s hosting platform. Search, AI, weather, finance, podcast, or video providers may receive a request when used. [CONFIRM: final subprocessor list, hosting region, and provider-specific logging/retention.]
We do not sell personal data or use search history to target advertising. We may disclose information when required by applicable law, to protect users or the service, or to investigate a credible security or abuse issue. We do not share data for a new purpose without an appropriate legal basis and notice where required.
6. Your rights and choices
Depending on the law that applies to you and the provisions then in force, you may have rights to request access to personal data, correction, erasure, withdraw consent, raise a grievance, or nominate another person to exercise rights in specified circumstances. We will verify requests proportionately and respond within the period required by applicable law. The final response target and identity-verification method must be confirmed by the owner.
To make a request, use the in-app support or privacy contact once published: [CONFIRM: privacy contact email and working request form]. Include enough information for us to understand the request, but do not send a password or full payment-card details. You may also clear recent searches, blocked sites, and other browser settings on your device through the app’s Settings page or your browser controls.
Account access and deletion depend on the available account controls and applicable retention obligations. The current interface does not provide a confirmed self-service deletion flow for every account or all associated records. [CONFIRM: account deletion process, associated data deleted, exceptions, and support response time.] We will not claim that a control exists until it is implemented and verified.
7. Children
The service is not designed for children to create an account without the legally required permission. Where applicable law requires verifiable parental or guardian consent before processing a child’s personal data, that consent must be obtained before the relevant processing begins. The service does not intentionally profile children or serve targeted advertising to them.
To report a child’s data submitted without required consent, contact [CONFIRM: privacy/grievance email]. We will review the request and act as required by applicable law.
8. Security, retention and international transfers
We use the security controls available in our hosting, database, authentication, and provider services and limit access to operational needs. No internet service can guarantee perfect security. If a security incident affects personal data, we will investigate, take reasonable containment steps, and provide notices required by applicable law.
Information is kept only for as long as needed for the stated purpose, to maintain security, resolve disputes, or meet legal obligations. Exact periods for query records, authentication data, submission records, API records, backups, and infrastructure logs are not yet confirmed and must be completed before publication.
Some providers may process requests outside India. The applicable safeguards, provider locations, and transfer conditions depend on the provider and configuration. [CONFIRM: cross-border provider list and transfer safeguards.] We will describe material changes to providers or purposes in an updated notice.
9. Changes, contact and grievances
This notice is intended to work with Indian privacy, information-technology, consumer, and intermediary requirements that apply to the Service. These may include the Digital Personal Data Protection Act, 2023 and the rules made under it as their provisions come into force, the Information Technology Act, 2000 and applicable Intermediary Rules, and consumer-protection requirements for relevant offerings. Applicability depends on the actual service, role, facts, and commencement dates; this draft is not a legal determination.
We will show the effective and updated dates at the top of this notice. For a material change, we intend to use an in-app notice and update the version number. The app may not currently display a change banner in every case; [CONFIRM: owner to implement and approve the change-notice process]. Earlier versions should be retained and made available through a version history after this draft is approved.
Product: Sarath Search. Operator/legal entity: [CONFIRM: legal entity or owner name and registered address]. General privacy contact: [CONFIRM: email]. Grievance Officer: [CONFIRM: name and email]. Governing location: [CONFIRM: city and state, India]. We will acknowledge and resolve grievances within the periods that apply under current law and the service’s applicable rules.
This notice is written for an India-based service. If you access Sarath Search from another country, local privacy laws may also apply. Your rights and remedies may differ, and nothing in this notice removes rights that cannot lawfully be waived.