Ik Onkar Privacy Policy

Overview

Blue Sparrow is a solo developer based in India and operates Ik Onkar, a Sikh-wisdom, spiritual-practice, meditation and mindful app-pausing companion. This policy explains what information the app handles, why it is needed, where it goes and the choices available to you. Ik Onkar is designed around data minimisation, purpose limitation, transparency and the rights provided by the EU General Data Protection Regulation and other applicable privacy laws.

Ik Onkar does not use a Blue Sparrow-operated service to synchronise your prayer, reflection, meditation, favourite, selected-app, unlock-history or preference database. That working database stays on your device. Optional account, purchase and support features create separate, limited connections as described below.

Data we handle

Ik Onkar may handle the following categories:

• Practice records you create, including prayers, reflections, meditation sessions, completion times, durations, goals, streaks, achievements and favourite passages.
• Android mindful-app information, including the installed launchable apps shown for selection, their names, package identifiers and icons, the apps you select, usage time checked for a selected app, temporary access windows, unlock times, durations and intention categories.
• Preferences such as language, theme, font and display choices, onboarding goal, reminder schedules, notification choices, meditation duration, app-pause limits and strict-mode choices.
• Optional Google and Firebase account information, including an account identifier, email address, display name, profile image URL and account timestamps.
• Limited Firestore profile and premium records for signed-in users, including entitlement state, product identifier, expiry, verification and administrator-granted access fields.
• Purchase and entitlement information handled by Google Play and RevenueCat, such as product, transaction, renewal and subscription status. Blue Sparrow does not receive your full payment-card details.
• Information you deliberately submit through contact or feedback, including reply email, optional name and subject, message, app version, platform and locale. Extra diagnostics are included only when you select that option.
• Technical security information used by Firebase App Check and Google Play Integrity or Apple DeviceCheck to verify a genuine app installation.
• A passage and related display text stored for the optional home-screen widget, and temporary image files created when you choose to export or share a quote or journey card.

Religious interests, spiritual practice and app-use choices can be sensitive. Ik Onkar keeps these in its local database rather than adding them to the Firebase profile. The app does not request contacts, SMS content, call history, precise location, microphone recordings or camera media. It removes Android advertising-ID permission and does not create a cross-app advertising profile.

How we use data

Information is used only as reasonably necessary to:

• Present Sikh-wisdom content, favourites, practice tracking, meditation, statistics, reminders, widgets and user-requested sharing.
• List eligible Android apps locally, detect a selected app, show the mindful pause and remember temporary access and intention history.
• Authenticate an optional account and associate premium access with the correct user.
• Process purchases, restore entitlements and prevent subscription abuse.
• Receive and answer a contact or feedback request you choose to send.
• Protect connected requests, maintain reliability and meet applicable privacy, consumer-protection, security and record-keeping obligations.

Ik Onkar does not sell or rent personal information and does not use it for targeted advertising. Firebase Analytics and Firebase Crashlytics components are included in the application, but the app does not currently set an explicit collection choice in its Dart code. Depending on the installed release, platform configuration and provider defaults, they may process limited app-interaction, device, performance or crash information. Ik Onkar does not intentionally attach passage text, spiritual-practice records, selected-app lists or unlock intentions to those services. Blue Sparrow is reviewing the production collection state and will keep this disclosure and any required controls current.

Sharing and processors

Blue Sparrow does not share personal information for independent advertising. Limited information may be processed by these providers for the stated feature:

• Google and Firebase for optional Google sign-in, Firebase Authentication, the limited Firestore profile, App Check and related security checks.
• Firebase Analytics and Firebase Crashlytics for limited usage measurement and diagnostics when collection is active in the installed release.
• RevenueCat and Google Play for products, purchases, receipts, subscription entitlements and store updates.
• Blue Sparrow's support-request service and its delivery providers when you submit contact or feedback information.
• Your operating system and a destination you select when you use the system share sheet for a passage or generated image.
• Infrastructure, security or professional service providers where reasonably needed to operate, protect or comply with obligations relating to the service.

These third-party providers act under their own terms and privacy notices and may process limited account, purchase, security, diagnostic or support information in locations determined by their infrastructure. Blue Sparrow may disclose limited information when required by applicable obligations or to protect users and the service from fraud, abuse or serious security threats.

Cloud and backups

Guest use does not upload your working practice database. If you sign in, Google and Firebase receive the optional account information, while Firestore stores the limited profile and premium fields described above. The RevenueCat webhook is configured for a European Firebase Functions region, but that does not establish the location of Firebase Authentication, RevenueCat or every connected provider operation.

The current Flutter runtime does not implement Google Drive backup, restore or cross-device synchronisation for practice data. References to Drive in setup or planning documents do not mean that a backup has been created. Unless a future release clearly presents and you activate such a feature, keep your own device and any user-created exports protected and do not rely on Ik Onkar as the only copy of irreplaceable information.

Retention

Local information remains until you remove it with an available app control, clear app storage or uninstall the app. Uninstall behaviour can vary where operating-system backup is enabled. Notification schedules remain on the device until disabled, cleared or removed with the app. Temporary export images are placed in app cache and are scheduled for best-effort cleanup after sharing; the receiving app or person controls any copy you choose to share.

Firebase account and Firestore profile or entitlement records may be kept while the account or purchase relationship is active and for a limited period afterwards where needed for security, reconciliation or applicable obligations. RevenueCat and Google Play keep purchase records under their own retention requirements. Support messages and delivery logs are kept only for support, abuse prevention and operational record needs, then deleted or de-identified under the relevant retention process.

The in-app Delete Account action attempts to delete the current Firebase Authentication account and clear only certain local tables and onboarding state. It does not currently delete the Firestore profile, RevenueCat or Google Play records, support messages, all local practice tables, shared copies or operating-system backups. A local cleanup step may also fail on some app versions. Contact [email protected] for an end-to-end account-data request, and clear app storage or uninstall after preserving anything you need.

Security

Ik Onkar uses proportionate safeguards including platform app isolation, HTTPS for connected requests, Firebase App Check, Google Play Integrity or Apple DeviceCheck, authenticated Firestore rules and provider purchase validation. Access within Blue Sparrow is limited to the solo operator and providers that need information for their assigned purpose.

No device, transmission or connected service can be guaranteed completely secure. Keep your device lock, Google account and purchase account protected, install trusted updates and avoid including unnecessary sensitive information in a support message or shared export.

Your rights

Depending on where you live and subject to applicable exceptions, you may have rights to know or access personal information, correct it, obtain a portable copy, delete it, restrict or object to processing, and withdraw consent where consent is the basis. You may also have a right to complain to your local data-protection authority. These protections include, where applicable, the EU GDPR and EEA rules, UK GDPR, India's Digital Personal Data Protection framework, California and other US state privacy laws, Brazil's LGPD, Canada's privacy laws, and comparable laws in other regions.

Most practice information can be managed locally. You can disable notifications, revoke Android usage or overlay access, stop mindful app pausing, sign out, remove favourites and clear app storage through app or device controls. Store subscriptions must be managed through Google Play.

To exercise a privacy right, email [email protected] with the app name and enough detail to identify the relevant account or request. Blue Sparrow may ask for proportionate verification and will respond within the period required where you live. Ordinary requests are free, subject to any exception permitted by applicable law.

Children

Ik Onkar is intended for a general audience interested in Sikh wisdom and personal spiritual practice and is not designed to collect children's information. A parent or guardian should supervise use by anyone who cannot validly make their own privacy choices. Do not create an account, make a purchase or submit support information for a child unless the responsible adult has a valid basis and provides any required permission. Contact [email protected] if you believe a child's personal information was provided inappropriately.

International transfers

The working practice database stays on your device. The Blue Sparrow support endpoint and RevenueCat webhook are intended to use European infrastructure, but production configuration and downstream delivery or provider paths must be verified separately. Optional Google, Firebase, RevenueCat, Google Play and support connections may process limited information outside your country or region.

For transfers requiring safeguards, Blue Sparrow and relevant providers rely on appropriate contractual, adequacy or other lawful mechanisms and apply data-minimisation and security measures. Blue Sparrow does not claim that every item of Ik Onkar information remains exclusively in the European Union. EU users receive the protections required by the EU GDPR, while provider-controlled account, purchase, diagnostic, security and support information follows the provider's disclosed infrastructure and transfer safeguards.

Changes

This policy may change when Ik Onkar, its providers or applicable requirements change. Material updates will be presented in the app or on the website where appropriate, and the updated date will be revised. Earlier processing remains covered by the version applicable at that time unless a change must apply sooner for security or compliance reasons.

Contact

Blue Sparrow is the developer and privacy contact for Ik Onkar. For privacy questions, rights requests or account-data deletion, email [email protected]. For general help, email [email protected]. Product and policy information is available at https://bluesparrow.dev.