Privacy

Last updated 22 October 2026

Śodha is a hosted writing and reading studio operated as part of RAS. This page explains what the service stores, why, and what you can do about it.

What we store

• Account data: your email address, a salted password hash, account status and sign-in times.
• Your documents: the text you write, document titles, version history, trash state, and your workspace (open tabs, cursor and scroll positions, reading mode and context windows).
• Your history: dictionary lookups, pinned words, saved instructions and AI generations you keep in the app.
• Preferences: appearance, typography, language and editor settings.
• Session data: a session cookie, plus hashed IP address, browser user agent and timestamps used for security and abuse limits.
• Request metadata: which surface ran, the model identifier, status, duration and token counts. We do not log prompts, document text or model responses.

Guests without an account get a temporary workspace with a cookie, a hashed IP address and usage counters. Guest workspaces are kept for 30 days.

Model providers

When you ask Śodha to generate text or look up a word, the relevant text is sent to the configured model provider (currently OpenRouter or Xiaomi) so it can produce the response. Those providers process the request under their own terms and privacy policies. Provider keys are held on the server and are never sent to your browser.

Cookies

The application uses a session cookie to keep you signed in and a guest cookie for temporary workspaces. These are required for the service to work. The public landing page does not set cookies and does not use advertising trackers.

Where data lives

Accounts and documents are stored in databases on a server in the European Union. Backups are kept on the same server for up to 14 days. We do not sell personal data.

Retention

• Documents stay until you delete them. Deleted documents remain in trash for 30 days.
• Version history is pruned on a thinning schedule: recent versions are kept frequently, older versions less often.
• Request metadata is kept for 30 days.
• Guest workspaces are kept for 30 days.
• Database backups are kept for 14 days.

Export and deletion

You can export your documents and delete your account from the application. Deletion removes your account, documents, history and preferences from the live database; backups age out within 14 days. During the private beta, the operator who gave you access can also action an export or deletion for you.

Security

Passwords are hashed, traffic is served over HTTPS, and model credentials stay server-side. No system is perfectly secure; if you believe your account has been compromised, stop using it and tell the operator who gave you access.

Changes

This policy may change as the beta develops. The date at the top of this page is the date of the latest revision.

Contact

This is a private beta without a public support inbox. Please use the contact route through which you were given access.