1. Introduction

This Privacy Policy explains how ORCHXTRA TECH PRIVATE LIMITED (“Sworg,” “we,” “us,” or “our”) collects, uses, shares, and protects personal data when you use the Sworg household management application, website, and related services (the “Service”). It applies to all users worldwide, with jurisdiction-specific provisions for users in the United States (Section 12) and India (Section 13). This Policy is incorporated into the Sworg Terms & Conditions.

Sworg offers AI-assisted meal planning, a conversational household assistant that can act on your data, medication tracking including reading prescriptions you photograph, a finance list, in-app messaging, and a recognition and rewards system. Some of the information you provide is therefore health-related or financial in nature. Sections 4 and 5 explain how we handle it.

By using the Service you acknowledge the practices described here; where consent is legally required, including under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”), we will obtain it.

2. Information We Collect

2.1 Information You Provide

• Account information: name, email address, phone number, password, profile photo (optional), and household role. Either an email address or a phone number is required depending on how you sign in; Service Partner accounts are created and verified using a phone number and a one-time code.

• Age category: when an adult household owner adds a member, the owner understands that they are an adult, according to the local guidelines. See Section 8.

• Household content: chores and tasks, shopping, pantry and inventory items, notes, schedules, reminders, and photos you and your household members create in shared spaces.

• Meal and dietary information: cuisine and meal preferences, likes and dislikes, household size, and any dietary restrictions, intolerances, allergies, religious or ethical dietary requirements, and health-related dietary goals recorded for yourself or another household member.

• Medication information: medication names, strengths, dosages, dose times, schedules, adherence records, prescription refill dates, remaining-supply figures, and pharmacy details where you enter them.

• Finance information: bill names, amounts, payees, and due dates, stored as records in your household.

• Images and documents you upload: photographs of grocery items, shelves and packaging used to add items to your inventory; photographs or scans of prescriptions used to create medication entries; dietary or medical documents you upload so that dietary restrictions can be extracted; and profile photos. These images are processed by an AI provider to read their contents, and prescription and dietary documents contain health information.

• Recognition and rewards data: points awarded for completed tasks, leaderboard standings, completion history, reward definitions, and redemption requests and approvals.

• Household membership data: which households you belong to, who belongs to them, roles assigned, invite codes and links, and join requests and approvals.

• Payment information for Paid Plans: processed by our merchant of record or the app stores — we do not store full card numbers.

• Communications: support requests, feedback and issue reports, and survey responses.

• Waitlist and pilot access data: if you join the waitlist or are added to the pilot access list, we hold your email address and any details you provide, before and whether or not you become a user.

2.2 Information Collected Automatically

• Device and technical data: device type, operating system, app version, language, time zone, IP address, unique device identifiers, and — if you enable notifications — a push notification subscription containing an endpoint and cryptographic keys for your device or browser.

• Usage data: features used, actions taken (for example chores completed, reminders dismissed or snoozed, meal suggestions accepted or rejected, assistant actions confirmed), session times, and crash logs.

• Cookies and similar technologies on our website, as described in Section 14.

2.3 Information from Third Parties

If you sign in with Google, we receive the name, email address, and profile image you authorize Google to share. If you sign in with a phone number, our messaging provider processes that number to deliver a one-time code. We do not currently offer a calendar integration and do not currently support Apple sign-in; if we add either, we will update this Policy before it launches.

2.4 Information About Other People

You may record information about other household members, including children and dependent adults — for example a child’s food allergy or a parent’s medication schedule. You are responsible for having their consent, or lawful authority in the case of a minor or dependent, before doing so. We process that information as a service to your household on the basis of the authority you represent that you have.

You may also invite people who are not members of your family — for example a cook, cleaner, driver, or other domestic worker — as a Service Partner. When you do, you provide their phone number and, optionally, their name and the categories of work assigned to them. You are responsible for telling that person you are adding them to Sworg and for having their agreement before you do so.

3. How We Use Information

• To provide and operate the Service, including syncing content across the households you belong to;

• To operate our in-app assistants. Sworg includes two AI assistants: one that helps you manage household records by conversation, and one that helps with meal planning. When you ask the first assistant to do something — for example add items to a list, create or reassign a chore, log a medicine, or invite a member — it carries out that action on your household’s data on your behalf, after showing you what it intends to do;

• To generate meal plans, menus, recipes, and shopping lists from your recorded preferences and restrictions;

• To read images and documents you upload, so that grocery items, medication details, and dietary restrictions can be extracted and turned into entries;

• To translate content and read it aloud when you request translation or speech;

• To schedule and deliver reminders and notifications, including medication dose, refill, and bill payment reminders;

• To operate a recognition and rewards system within your household;

• To manage accounts, subscriptions, billing, and renewals;

• To send service communications: transactional emails, one-time sign-in codes, and notices about changes to terms or pricing;

• To provide customer support and respond to requests;

• To maintain safety and security: detecting fraud, abuse, and unauthorized access;

• To maintain and improve the Service through internal administration, including product metrics computed in aggregate and support access by authorized staff (see Sections 7 and 10);

• To comply with legal obligations.

We do not sell your personal data. We do not use the content of your household records, messages, meal preferences, medication entries, finance entries, or uploaded images for advertising or ad targeting, and we do not use health-related information for marketing.

4. AI Features and Automated Processing

4.1 What Is Processed

AI Features are used in several places in the Service, and what is processed depends on the feature you use:

• (a) Meal planning: your recorded dietary and cuisine preferences, restrictions and allergies, the household’s dietary summary, household size, your pantry and inventory contents, and your past acceptances and rejections of suggestions.

• (b) Household assistant: the text of the message you send, together with the household records needed to answer it — which may include your lists, chores, inventory, medicine entries, and finance entries.

• (c) Prescription reading: the photograph or scan of a prescription you upload, and the text extracted from it, including medication names, strengths, and schedules. This is health information.

• (d) Dietary document extraction: the document you upload and the dietary and medical restrictions extracted from it.

• (e) Item recognition: photographs of grocery items and packaging you upload.

• (f) Translation and speech: the text you select for translation or reading aloud.

We do not send your password, payment card details, or authentication tokens to our AI provider.

4.2 Third-Party AI Providers

AI Features are delivered by sending your request directly to the Gemini API, operated by Google LLC. We do not route requests through an intermediary AI gateway. The models currently used are Gemini 2.5 Flash and Gemini 2.5 Pro.

Google acts as a processor under the Gemini API Additional Terms of Service. On paid Gemini API service Google does not use prompts or responses to improve its products. Prompts and responses are logged for a limited period solely to detect and prevent violations of Google's Prohibited Use Policy, to maintain the safety and security of the service, and for any legally required disclosures.

4.3 Model Training

We do not use your household content, meal preferences, messages, medication or finance entries, or reminder data to train AI models, and we do not permit our AI provider to do so. This applies to all AI Features, including prescription reading and dietary document extraction: we do not use uploaded images or extracted health information to train models, and we do not permit our provider to do so. We may use aggregated or de-identified statistics that cannot reasonably be linked back to you or your household to evaluate and improve the quality of suggestions. We will not begin using your personal data for model training without notifying you and, where required by law, obtaining your consent.

4.4 Data Minimization

We aim to send our AI provider only the data needed to answer your request. Where a feature requires an image or a document — for example prescription reading or dietary document extraction — the file itself is transmitted and cannot be pseudonymized.

4.5 Minors

We do not send the personal data of members under 18 to our AI provider for the purpose of profiling, behavioural monitoring, or targeted advertising, consistent with the DPDP Act. Managed profiles for children under 13 have no access to the AI assistants.

4.6 Automated Decisions and Assistant Actions

Meal planning produces suggestions only. The household assistant, by contrast, performs actions on your household’s records when you instruct it to — creating, changing, and deleting entries and sending invitations — after showing you the action it proposes. Every such action follows from your instruction and your confirmation. Neither assistant is used to make decisions producing legal or similarly significant effects concerning you.

5. Health-Related, Dietary, and Financial Information

Allergy, dietary, and medication information — including prescription images and documents — is health-related, and finance entries are financial in nature. Some U.S. state privacy laws treat certain health data as “sensitive personal information,” and the DPDP Act requires care in processing such data. We handle it as follows:

• We collect it only because you choose to enter or upload it in order to use meal planning, medication, or finance features;

• We use it only to deliver the feature you requested, and not for advertising, profiling, or sale;

• We apply row-level access rules so that medication entries are visible only to the person they concern and to household members expressly given access, and we rely on encryption in transit and on the encryption at rest provided by our hosting platform;

• Service Partners cannot see medication entries or finance entries at all;

• We do not disclose this information to third parties other than the processors described in Section 7, or where legally compelled;

• You may delete individual meal preferences, medication entries, finance entries, and uploaded images at any time within the app, and deleting them removes them from your household’s shared view.

Finance entries you create — including bill names, amounts, payees, and due dates — are stored as records in your household’s shared space, not only as transient reminders, and remain visible until you delete them.

Sworg is not a healthcare provider, pharmacy, insurer, or clearinghouse, and is not a “covered entity” or “business associate” under the U.S. Health Insurance Portability and Accountability Act (HIPAA). Information you record in the Service is not protected health information under HIPAA, and HIPAA protections do not apply to it. We are not a payment service and do not access your bank or biller accounts.

6. Visibility Within and Beyond Your Household

Sworg is a shared household tool. Content you contribute to shared spaces — chores, lists, inventory, notes, schedules, meal preferences, and uploaded images — and related activity such as task completion is visible to other members of that household according to its settings. This visibility is a core function of the Service, not a disclosure to third parties.

Medication entries are an exception: they are visible to the household member they are assigned to and to members expressly given access, rather than to everyone.

Service Partners see a restricted view. A Service Partner can see the tasks assigned to them and the shared lists relevant to their work. They do not see medication entries, or finance entries. Household owners can see a Service Partner’s assigned tasks, completion history, and points.

If you belong to more than one household, members of one household cannot see content from another household you belong to.

Be deliberate about health information in particular: a medication entry, an allergy, or a prescription image reveals health information about the person it concerns. Use the access controls available to you for anything you do not wish others to see.

7. How We Share Information

• Service providers (processors): hosting and database, file storage, the AI model provider, the messaging provider used for one-time codes, the transactional email provider, push notification delivery, the payment merchant of record, and customer support tooling. Each is bound by contract limiting its use of your data. A current list is at Appendix A;

• Agent integrations you authorize: Sworg can be connected to external AI assistant applications. If you authorize such a connection, that application can read and act on your household’s tasks, lists, inventory, and household membership on your behalf, for as long as the authorization remains active. Such an application is controlled by whoever operates it, not by us, and is governed by its own terms. You can revoke the authorization at any time in settings;

• Our personnel: a small number of authorized staff can access account and household data through an internal administration tool for support, abuse investigation, and service operation, subject to the safeguards in Section 10;

• App stores and platforms: Apple and Google, in connection with distribution, purchases, and subscriptions;

• Legal and safety: where required by law, legal process, or to protect the rights, safety, or property of users, the public, or Sworg;

• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy and with notice to you;

• With your direction or consent: for example, integrations you enable.

8. Children’s and Minors’ Privacy

8.1 Age Categories and Consent

Accounts must be created by a person that is an adult, per the local guidielines.

When an adult adds a member under 18, they take sole responsibility of being the person’s parent or legal guardian or have that authority, and consent on that person’s behalf to the processing described in this Policy.

8.2 Children Under 13

We do not knowingly collect personal data directly from a child under 13, and a child under 13 cannot create an account. Information about a child under 13 held in a managed profile is provided by the responsible adult under their parental responsibility, consistent with the U.S. Children’s Online Privacy Protection Act (COPPA). If we learn that a child under 13 has created an account, we will delete it promptly.

8.3 Minors in India

The DPDP Act treats all persons under 18 as children. .

8.4 Information Recorded About Minors

Where a parent or guardian records a child’s dietary restrictions, allergies, or medication entries, that information is processed under the parent’s or guardian’s authority and is subject to the protections in Section 5. Parents and guardians may review, correct, or request deletion of their child’s data by contacting us at contact@thesworg.com or through household settings.

9. Data Retention

We retain personal data for as long as your account is active and as needed to provide the Service.

Using the in-app account control disables access to your account; it does not by itself establish a fixed deletion timetable. To request permanent deletion, use our Delete My Data page or contact contact@thesworg.com. We may verify your identity before processing the request. We delete or de-identify personal data in response to a verified request, except where retention is required by law, needed to resolve disputes, or held temporarily in routine encrypted backups pending their normal deletion cycle.

Other retention periods:

• Prompts and responses sent to Google: logged by Google for a limited period solely to detect and prevent violations of Google's Prohibited Use Policy, to maintain the safety and security of the service, and for any legally required disclosures, as described in Section 4.2. The exact period is [AI LOG RETENTION PERIOD];

• Uploaded images and documents, including prescription and dietary documents: retained for 120 days or until you delete the entry they relate to, whichever is sooner;

• Aggregate product metrics: retained indefinitely in a form that does not identify you.

Content you contributed to a shared household space may remain visible to that household after you leave, as described in the Terms. If a household is disbanded by its owner, its shared content is deleted for all of its members.

10. Security

We use reasonable technical and organizational safeguards to protect personal data, including encryption in transit, the encryption at rest provided by our hosting platform, row-level access rules, access controls, and monitoring.

A small number of authorized staff can access account and household data through an internal administration tool, and staff with the necessary privileges are technically able to export data from our database. Such access is limited to support, abuse investigation, and service operation, is subject to internal policy, and is restricted to named individuals. No system is completely secure; you are responsible for keeping your credentials and your phone confidential. In the event of a personal data breach, we will notify affected users and regulators where required by applicable law, including the DPDP Act and applicable U.S. state breach notification laws.

11. Your Rights

• Access and portability: request a copy of the personal data we hold about you;

• Correction: update inaccurate or incomplete data, largely self-service in the app;

• Deletion: delete individual entries using available in-app controls, disable access to your account in the app, or request permanent deletion through our Delete My Data page, which is reachable without installing the app. Deletion requests follow the process in Section 9;

• Marketing opt-out: unsubscribe using the link in any marketing message. We currently send only service and transactional messages;

• Consent withdrawal: where processing is based on consent, withdraw it at any time without affecting prior processing. Withdrawing consent to AI Features disables the assistants and meal planning but does not affect other features;

• Revoke integrations: withdraw an external application’s authorization at any time in settings.

To exercise rights, use in-app settings or contact contact@thesworg.com. We may need to verify your identity. We will respond within timelines required by applicable law.

12. Additional Disclosures for U.S. Users

Depending on your state of residence (including under the California Consumer Privacy Act as amended, and comparable laws in other states), you may have rights to know, access, correct, delete, and obtain a portable copy of your personal information, and to opt out of “sales” or “sharing” of personal information and certain targeted advertising. Sworg does not sell personal information and does not share it for cross-context behavioural advertising.

Certain information you provide — including health-related dietary and medication data, prescription images, and financial entries — may constitute sensitive personal information under state law. We use and disclose it only to perform the services you requested and for the purposes described in Sections 3 through 5, which are purposes for which no right to limit applies; you may nonetheless delete this information at any time. Several states also regulate consumer health data specifically; where such a law applies to you, we obtain any required separate consent before collecting or sharing that data. We will not discriminate against you for exercising your rights. Authorized agents may submit requests as permitted by law. Categories of information collected and purposes are described in Sections 2 and 3.

13. Additional Disclosures for Users in India

For users in India, OrchXtra Tech Private Limited acts as the Data Fiduciary under the DPDP Act. We process personal data on the basis of your consent or for certain legitimate uses recognized by the Act. You have the right to access a summary of your personal data and processing activities, correction and erasure, grievance redressal, and to nominate another individual to exercise your rights in the event of death or incapacity. Consent requests are presented in clear language, and you may withdraw consent as easily as it was given; where consent is withdrawn, we will cease the related processing within a reasonable time. Consent for AI Features and for health-related data is sought separately at the point of enabling those features.

Grievance Officer, as required under the Information Technology Act, 2000 and the DPDP Act: [Nithya Subramaniam], [contact@thesworg.com]. If you are not satisfied with our response, you may approach the Data Protection Board of India.

14. Cookies and Analytics

Our website and app use cookies and similar technologies for authentication and preferences. We compute product usage metrics ourselves from activity in the Service — for example counts of active users and of actions taken — and store them in aggregate. We do not currently use a third-party analytics provider; We do not send health-related content, message content, or reminder content to any analytics provider.

15. International Data Transfers

Our database and file storage are hosted in Singapore (ap-southeast-1). AI model requests are processed by Google in regions it determines; processing is not pinned to a single region and may occur outside India. Where personal data is transferred across borders, we take the steps required by applicable law, including transfers from India in compliance with the DPDP Act and any countries restricted by the Central Government.

16. Changes to This Policy

We may update this Policy from time to time. For material changes, we will notify you via the app or email at least 15 days before the changes take effect, and where required by law we will seek renewed consent. Each version is recorded in the version history at Appendix B.

17. Contact Us

ORCHXTRA TECH PRIVATE LIMITED

Privacy inquiries: contact@thesworg.com

Grievance Officer (India): [Nithya Subramaniam], [contact@thesworg.com]

Appendix A — Subprocessors

The third parties that process personal data on our behalf. We will update this list before engaging a new subprocessor that materially affects the processing described in this Policy.