Privacy · Terms · Contact

What we do with your data.

Written against what the software actually does, not from a template. Every claim here is a claim about code that you can hold us to.

Last updated 12 August 2026 · Vastometry is invite-only and nothing is charged for.

Privacy Terms Contact

Privacy

Vastometry is operated by Nimish Mehrotra as an individual. It is a small, invite-only product with no sales team, no advertising and no investors, and the data practices below follow from that rather than from a policy document.

The short version. We store the account you create and the work you do in it. We do not track you, we do not profile you, we sell nothing to anyone, and there is no advertising or analytics network anywhere in this product. There is no cookie banner because there is nothing to consent to beyond the one cookie that keeps you signed in.

What is stored, and why

What	Why
Your email address, which is also your sign-in name	To identify your account and to send you a sign-in code, an invite, or a password reset. It is confirmed by a six-digit code before the account is created.
Your password, as a `scrypt` hash with a per-account random salt	To sign you in. The password itself is never stored and cannot be recovered from the hash — not by us either.
Your designs: plots, rooms, walls, doors, furniture, floors	They are the product. Stored so they are on every device you sign in from.
Your Vastu analyses, including the floor-plan images you upload	Every outline, marker and door you place is stored in that image's own coordinates, so the image has to be kept for the analysis to mean anything.
A small number of preferences	Whether you have finished the first-run checklist, and whether you have ever scored a plan.
Previous versions of your work	So a bad save or a sync accident can be undone. See retention below.
A security log of events on your account: sign-ins and failed sign-in attempts, invites issued and redeemed, password changes, shared links created and revoked, and deletions	So that a break-in attempt can be seen, and so that "who changed this?" has an answer. Each entry is a time, a fixed event name and the account it concerns — no IP address, no device, and no free text of any kind. It is not a log of what you did in the app: it records no page views, no plans and no saves. Kept 90 days, then deleted automatically.

Floor plans are the sensitive part, and we treat them that way

Location and camera data are removed from photographs on import. A phone photo of a plan normally carries GPS coordinates. Those metadata blocks are stripped before the image is stored — losslessly, so the picture itself is unchanged. The app tells you when it has done this.
Stored plan images never leave your account. They are not used for anything else, and they are not included in the version history that older copies of an analysis are kept in — those hold geometry only.
A shared report is a snapshot you create deliberately. It is readable by anyone holding the link, which is the point of it, so share it only with people you mean to. You can revoke any link at any time from Your shared links… in the analyzer, and every link expires by itself after 90 days. Shared reports are marked not to be indexed by search engines.

What we deliberately do NOT collect

No IP addresses are stored. They are used in memory to rate-limit sign-in attempts and then discarded — they are never written to the database.
No user-agent strings, and no log of what you did in the app. Usage is counted as daily totals only: how many people signed in on a given day, how many plans were scored. Those counters cannot be traced back to an individual action. The security log described above is the one exception and is deliberately narrow — it records events on your account, never what you opened, drew, scored or saved.
No advertising, no third-party analytics, no social widgets, no fonts or scripts loaded from anyone else's server. The application makes zero external requests. That is a build-time guarantee, not a preference.
No profiling and no automated decisions about you. The only automated judgement this product makes is about a floor plan.

When something goes wrong in your browser

If the app hits an error it sends a short, aggregated report so the fault can be found. That report carries a five-value browser family (for example “Chrome”), whether you were signed in, and an error message that has been scrubbed first: embedded images, URL query strings and any long run of characters are removed before it is stored, because an error message can otherwise contain a copy of your plan. It does not carry your account, your address, your IP or a stack trace, and reports are kept for 30 days as daily counts.

Cookies

One cookie, griha_sid, which keeps you signed in. It is HttpOnly (unreadable by scripts), SameSite=Lax, marked Secure over HTTPS, and holds a random token — not your identity, not your email. It lasts 30 days and renews while you keep using the site. Signing out deletes it here and on the server. There are no other cookies, of any kind.

Who else sees your data

Two service providers, and no one else:

The server host. The application and its database run on a single virtual server rented from a hosting provider. Your data sits on its disk.
The email provider (Resend). Used only to deliver sign-up codes, invite codes and password-reset messages. It therefore handles your email address and the text of those messages. It never receives your designs, your analyses or your plan images.

Nothing is sold, rented, shared for advertising, or handed to a data broker. If we were ever legally compelled to disclose something we would tell you unless prohibited from doing so.

How long things are kept

Data	Retention
Your account and your current work	Until you ask for it to be deleted.
Previous versions of your work	The last 10 versions of your designs and the last 5 of each Vastu analysis, subject to a size cap; older ones are discarded automatically as newer ones arrive.
Shared report links	90 days, or until you revoke one. Revoking takes effect immediately.
Backups	Seven nightly database snapshots on a rolling basis, plus an off-site copy. A deletion therefore takes up to a week to disappear from every backup.
Daily usage counts, client error counts	Usage counts are aggregate and kept indefinitely; error counts are pruned after 30 days. Neither identifies you.
The security log	90 days, then deleted automatically. Entries are removed on a schedule while the service runs, not only when it restarts.

Your choices

You can export everything you have at any time — Full backup on the Houses page writes a single JSON file containing every house and every analysis, including the images. You do not need to ask us for a copy of your data; the button is there and it works offline.

To correct your address, to delete your account and everything in it, or to ask what is held about you, write to the contact address below. Deletion removes your account, your designs, your analyses, your version history and your share links; backups age out within a week as described above.

Security

Traffic is encrypted with TLS. Passwords are hashed with scrypt. Session tokens are stored hashed, so a copy of the database does not let anyone sign in as you. The application is only served to a signed-in session. No system is perfect, and this one is operated by one person — if you find a problem, please tell us and we will fix it rather than argue about it.

Not yet reviewed by a lawyer. This page describes what the software does, accurately and in plain language, and it is written by the person who wrote the software. It has not been through legal review, and it deliberately makes no claim about which country's law governs it or about a formal corporate identity, because Vastometry does not have one yet. If you need a contractual answer rather than a factual one, ask before you upload anything.

Terms of use

What this is

Vastometry is two tools that share an account: a design studio for drawing a home to real dimensions, and an analyzer that scores a floor plan against a versioned Vastu rulebook. Access is by invitation. Nothing is charged for at present; if that ever changes you will be told before it applies to you.

The limits of what it tells you

Vastometry is not architectural, structural or professional building advice. It does not replace an architect, a structural engineer, a surveyor or a licensed contractor, and nothing it produces should be relied on for construction, for a purchase decision, or for compliance with any building code or regulation. Measurements and areas are what you drew, not what was surveyed.

The Vastu analysis is an assessment against a traditional belief system, stated openly as such in every report. The rulebook is versioned and its version is printed on every result, so you can see exactly which set of rules produced a score. Scores are not comparable across rulebook versions, and reports say which version they used. No symbolic remedies are offered — only defensible physical corrections.

Your work is yours

You keep every right in the plans, designs and images you upload or draw. Using the product grants us no licence to them beyond what is technically needed to store them and show them back to you. We do not use your work to train anything.

Our work is ours

The application, its design, and in particular the Vastu knowledge base — the ratings, weights, criticality rules and remedies — remain the property of Nimish Mehrotra. The knowledge base is not distributed with the application and may not be extracted, copied or republished.

Using it reasonably

One account is for one person or one household. Do not share credentials.
Do not upload anything you do not have the right to upload.
Do not attempt to access another account's data, disrupt the service, or circumvent the rate limits — they exist so the service stays available for everyone.
Automated scraping of the analyzer is not permitted.

Availability, and the honest warning

This is a small product run by one person on one server. It is backed up nightly and off-site, and a restore has actually been performed and documented rather than merely planned — but it is provided as it is, with no guarantee of availability and no warranty. Keep your own backups. The Full backup button exists precisely so that you are never dependent on us, and using it occasionally is a sensible habit.

To the extent the law allows, liability for any loss arising from use of Vastometry is limited to what you have paid for it, which is currently nothing. Access may be withdrawn for a breach of these terms; you can stop using it and ask for deletion at any time.

Contact

Write to nimish@vastometry.com — privacy questions, data requests, account deletion, bugs, and anything that looks like a security problem. One person reads all of it. Security reports are welcome and will not be met with lawyers.

Or simply reply. Everything Vastometry sends you — a sign-up code, an invite, a password reset — comes from that same address, and a reply reaches a person rather than a machine. There is no noreply here.

Account deletion — say so and it will be done. If you want a copy of your work first, take one yourself rather than asking: Full backup on the Houses page writes every house and every analysis to one file, and it works without us.