Back to Ingress Within
Ingress WithinIngress Within
Official Privacy Charter

Privacy Policy

Effective Date: January 1, 2025 · Last Updated: September 29, 2026 · Complies with Google API User Data Policy & Indian DPDPA

Google API Services User Data Policy Compliance

Ingress Within's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never sell your Google data, never use it for targeted advertising, and never use it to train generalized AI/ML models without your explicit consent.

1. Introduction & Overview

Welcome to Ingress Within (https://ingresswithin.com). Ingress Within is a psychological wellness platform providing guided self-reflection, psychometric inquiry, emotional pattern recognition, and teletherapy session coordination with licensed mental health practitioners in India.

We believe your emotional reflections and mental health journey are deeply personal. This Privacy Policy details our transparent commitments: what data we collect, how it is secured, how Google Calendar and Google Meet integrations function, and how you retain complete ownership and control over your records.

2. Information We Collect

We only collect information strictly required to provide our reflective and teletherapy services:

  • Authentication & Profile Data: Mobile phone number (verified via one-time OTP for passwordless login), preferred name or alias, age bracket, and profile preferences.
  • Journaling & Self-Work Data: Personal journal entries, emotional check-ins, psychometric questionnaire responses (e.g., OCEAN Big Five traits, MHPI psychological scores), and prompt answers.
  • Therapy & Clinical Records: Client intake questionnaires, appointment booking schedules, SOAP session notes written by consulting therapists, and clinical care status.
  • Google Account & Calendar Data (Optional): When you explicitly connect your Google Calendar, we collect your authorized Google email address and query external event start/end timestamps (Free/Busy intervals) to prevent scheduling conflicts.
  • Transactional & Billing Data: Payment order identifiers, transaction amounts, and refund records processed securely through Razorpay. We never see or store debit/credit card numbers or banking PINs.

3. Google Calendar & Google Meet Integration

Ingress Within offers seamless integration with Google Calendar and Google Meet for therapists and clients. Here is exactly how Google user data is handled:

Scopes Requested:https://www.googleapis.com/auth/calendar.eventsandhttps://www.googleapis.com/auth/userinfo.email
  • Busy Slot Detection: We inspect start and end times of external calendar events to prevent clients from booking when a therapist is occupied. We strictly strip and discard all event summaries, descriptions, attendee emails, and personal details.
  • Automated Session Events & Google Meet: When an appointment is booked and paid for, our system creates a calendar event on the consulting therapist's calendar with an official Google Meet conference link (meet.google.com/...) and updates the client's session details.
  • Token Security: Google OAuth 2.0 access and refresh tokens are encrypted at rest using industry-standard AES-256 encryption. They are stored with strict Row-Level Security (RLS) and are never exposed in client JavaScript.
  • Revocation & Disconnection: You can disconnect your Google Calendar at any time with one click from Settings or the Calendar view. Upon disconnection, all stored tokens are permanently deleted from our database.

4. Artificial Intelligence & Processing Boundaries

Ingress Within uses advanced language models (e.g. Anthropic Claude) strictly to provide reflective questions, summarize weekly themes, and calculate structured emotional indices.

  • Zero Training on Personal Data: We maintain strict commercial API agreements that prohibit AI vendors from using your journal entries or personal data to train public or foundational models.
  • Client Self-Work Privacy Boundary: Private journal entries and self-guided reflections are exclusively accessible by the client. Even when connected with a consulting therapist, a client's private journals are never visible to the therapist unless explicitly shared by the client.

5. Data Security & Storage Architecture

Encryption at Rest & Transit

All HTTP transmissions are encrypted with TLS 1.3. Journal contents are encrypted at the field level with AES-256-GCM.

Strict Database RLS Isolation

PostgreSQL Row-Level Security (RLS) ensures each user’s records can only be queried by their verified cryptographic JWT session.

6. Your Rights & Data Deletion

You maintain total authority over your personal information. Under India’s Digital Personal Data Protection Act (DPDPA 2023) and global privacy principles, you have the right to:

  • Inspect & Export: Request a complete machine-readable archive of all journal entries, assessment scores, and appointment history.
  • Correction: Update personal details or communication preferences at any time.
  • Permanent Account Deletion: You can permanently wipe your account directly from Settings > Delete Account. This immediately deletes all journal entries, reflection history, OAuth tokens, and session records with zero retention.

7. Children's Privacy

Ingress Within is designed for individuals aged 18 and older. We do not knowingly collect or solicit personal information from minors under 18 years of age without verifiable parental consent.

8. Grievance Officer & Contact Information

If you have any questions, feedback, or grievances regarding your data privacy, please contact our designated Grievance Officer:

Entity: Ingress Within

Website: https://ingresswithin.com

Privacy Inquiries: privacy@ingresswithin.com

General Support: hello@ingresswithin.com

Location: Mumbai, Maharashtra, India