Trust & Security

In India. All of it.

Your account, your drafts, your case ledger, your photos — everything is stored and processed in the Google Cloud Mumbai region (asia-south1). That includes AI processing: when our models read your photo of a pothole or your voice note about a ration card, that happens on India-region AI endpoints. Your grievance content does not leave the country to be processed somewhere else.

The app is also offline-first. A draft you write in a low-signal area is saved on your phone and syncs when you are back online. Your phone is the first home of your data, not our servers.

These are hard lines, built into how the product works — not policies we hope to follow.

• We never store your government portal passwords. When a filing needs a login, OTP, or captcha on an official portal, you complete that step yourself. We assist the flow; we do not hold the keys.
• We never keep full Aadhaar numbers. If an Aadhaar number appears in a document you upload, it is redacted. We do not ask for Aadhaar and we do not want it.
• We never sell your grievance content or use it for ads. What you report to the government is not marketing data. It is never sent to advertising or analytics systems.
• We never file anything without your confirmation. Every complaint, grievance, and RTI goes out only after you have read the draft and confirmed it with a tap. There is no auto-filing.

Signing up takes a phone number and an OTP, or a Google account. That is all. No Aadhaar, no KYC, no document uploads to get started.

Some government forms genuinely require personal details — an RTI application needs your name and postal address, because the law says the reply is sent to you. When a filing needs a detail like that, we ask for it at that moment, and it goes on that government application. It does not go into a marketing profile, and we do not use it to build one.

Later, we may offer optional DigiLocker verification for people who want it. If we do, it will be opt-in — an upgrade you choose, never a gate you must pass.

Every filing goes out in your name, on official government channels — CPGRAMS, RTI Online, municipal portals, and sector portals. Not through a MyAlly account, not through an intermediary inbox. When the portal issues a registration number, that number is yours, and it works on the government's own site whether or not you ever open MyAlly again.

MyAlly is a technology facilitator acting as your disclosed agent. We prepare the draft, find the right authority, and track deadlines — the CPGRAMS 21-day norm, the RTI 30-day reply clock — and help you with appeals and escalation. We are not a law firm, we do not give legal advice, and we do not guarantee outcomes. The complaint is yours; we make it easier to make.

• Per-purpose consent. We ask for consent for specific purposes, separately. Agreeing to one thing is not agreeing to everything.
• Withdrawal. You can withdraw a consent you gave. Withdrawing one does not quietly break the rest of the app.
• Delete your account and data. You can delete your MyAlly account and the data we hold about you. Note the honest limit: a complaint already filed with the government lives on the government's systems, in your name — deleting your MyAlly account does not withdraw a filing you made.
• A grievance officer for us. If your complaint is about MyAlly itself, you will be able to reach our grievance officer directly. [Grievance officer name and contact — to be published before launch.] Until then, write to support@cosmoneural.com and we will treat it with the same seriousness.

MyAlly is built for India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The commitments on this page — purpose-limited consent, withdrawal, deletion, a published grievance officer — are not extras; they are what the law requires and what we have designed for from the start.

MyAlly is for adults. At launch the service is 18+ only, and we do not knowingly process children's data.

We are in early access. Where a compliance obligation involves something not yet live — such as the published grievance officer contact — we say so on this page rather than pretending it is done.

If you find a security problem in MyAlly, we want to hear about it before anyone else does.

Write to support@cosmoneural.com with "Security" in the subject line. Tell us what you found, where, and how to reproduce it. Please do not access other people's data beyond what is needed to demonstrate the issue, and give us reasonable time to fix it before you publish anything.

We read every report, we will reply, and we will keep you informed as we fix it. Good-faith security research helps the people who use this app, and we treat it that way.