Privacy Policy

1. Information We Collect

We collect information that you provide directly, information generated by your use of the Service, and information received from third-party partners:

• Account & profile data: First name, last name, email address, phone number, date of birth, and country. Collected at sign-up and stored to create and maintain your account, determine your billing region (India = INR; international = USD), verify eligibility, and provide customer support.
• Authentication data: When you sign in with Google, we receive your name, email address, and profile picture from Google's OAuth service. We do not access your Google Drive, Gmail, Calendar, Contacts, or any other Google service.
• Payment & transaction data: Order IDs, Cashfree payment IDs, transaction amounts, currency, payment method, and timestamps. We do not store your card numbers, bank account details, or UPI credentials — those are handled exclusively by Cashfree.
• Entitlement & usage data: Credit balance, credit purchases and consumption, trial status, license key status, session events (start/stop/heartbeat), and device platform (macOS/Windows). Used to deliver and enforce your entitlement, detect abuse, and generate business reports.
• Device & session data: A stable per-device identifier (generated locally, not hardware-tied), the platform (macOS or Windows), app version, and last-seen timestamp. Used to enforce the single-active-device rule and for compatibility diagnostics.
• AI prompt & response data: The app supports Google Gemini, OpenRouter, NVIDIA NIM, and Groq as AI providers. You supply your own API key for the provider(s) you choose to use, and text you enter into the app is sent directly from your device to your selected provider's API to generate a response, returned to you in real time. We do not store your prompts, your API keys, or the content of AI responses on our servers. Your API keys are stored only locally on your device (never transmitted to us), and prompt/response data passes directly between your device and the provider you selected — it does not route through our servers. Please refer to each provider's own privacy policy for how they handle API data: Google, OpenRouter, NVIDIA, and Groq.
• Support communications: Any information you send us via email or the contact form (name, email, message content), retained for the purpose of responding to your enquiry.

2. How We Use Your Information

We use the information we collect for the following business purposes only:

• To create, authenticate, and maintain your account.
• To determine your billing region and display the correct currency and pricing (India → INR; all other countries → USD with surcharge).
• To process one-time payments and verify entitlement (trial, lifetime license, credit balance).
• To enforce the single-active-device rule and detect account abuse.
• To deliver AI-generated responses through the Google Gemini API.
• To send transactional communications (payment confirmations, receipt emails, security alerts). We do not send marketing emails unless you explicitly opt in.
• To provide customer support and resolve disputes.
• To operate internal reporting and analytics for business decision-making (e.g., revenue by region, usage trends). All analytics are aggregate and internal — not shared externally.
• To comply with applicable legal obligations.

We do not sell, rent, or trade your personal data to third parties under any circumstances. We do not use your data for advertising, behavioural profiling, or any purpose beyond what is described in this policy.

3. Data Storage & Security

Your account and transaction data is stored in Supabase, hosted on Amazon Web Services infrastructure with encryption in transit (TLS 1.2+) and encryption at rest. Access to your data is restricted by Row-Level Security policies: only you and our server-side admin functions can read your records. No one can access another user's data through the browser.

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the Internet or method of electronic storage is 100% secure.

4. Third-Party Services

We share data with third parties only to the extent necessary to operate the Service. Each is bound by their own privacy obligations:

• Supabase — authentication, database, and storage infrastructure. Supabase Privacy Policy
• Cashfree Payments — payment processing for customers billed in India (INR). We share your order amount and email with Cashfree to initiate a payment. We do not share unnecessary personal data. Cashfree Privacy Policy
• PayPal — payment processing for international customers billed in USD. We share your order amount, currency, and email with PayPal to initiate and verify a payment; PayPal returns the payer's name, email, and payment-instrument type (e.g. card brand and last 4 digits) which we store as part of your payment record. We never receive or store your full card number, CVV, or bank credentials — those are handled exclusively by PayPal. PayPal Privacy Policy
• Google Gemini API — AI response generation. Your prompt text is sent to Google for processing and the response is returned. We do not send identifying information alongside your prompts. Google Privacy Policy
• Google OAuth — sign-in authentication. We receive only your name, email, and profile picture via standard OAuth scopes. We do not access any other Google services.
• Vercel — website hosting and edge functions. Your requests are handled by Vercel's infrastructure. Vercel Privacy Policy

5. Cookies & Local Storage

We use browser session storage and cookies solely for authentication (to maintain your signed-in session) and for functional purposes (e.g., remembering your theme preference). We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. You may disable cookies in your browser settings, but doing so may prevent you from signing in.

6. Data Retention

We retain your personal data for as long as your account remains active or as necessary to provide the Service, resolve disputes, and comply with legal obligations. If you request account deletion:

• Your account and personal profile data will be deleted within 30 days of the deletion request.
• Financial transaction records may be retained for up to 7 years as required by applicable tax and accounting laws.
• Anonymised or aggregated data (e.g., aggregate usage statistics) that cannot be used to identify you may be retained indefinitely.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data via your Account page or by emailing us.
• Deletion: Request deletion of your account and associated personal data (subject to legal retention requirements).
• Portability: Request a machine-readable export of your personal data.
• Objection / Restriction: Object to or request restriction of certain processing activities.

To exercise any of these rights, contact us at support@sneakai.in. We will respond within 30 days. Note that exercising certain rights may affect your ability to use the Service.

8. Children's Privacy

SneakAI is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that a minor has provided personal information, we will delete it promptly. If you believe a minor has registered, contact us at support@sneakai.in.

9. International Data Transfers

Your data may be processed and stored on servers located outside your country of residence (including in the United States, through Supabase/AWS and Vercel infrastructure). By using the Service, you consent to such transfers. We take appropriate contractual measures to ensure your data is handled in accordance with this policy regardless of where it is stored.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. We may also notify you by email for significant changes. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

11. Legal Basis & Compliance (DPDP Act, GDPR)

India (DPDP Act, 2023): We process your personal data on the lawful basis of your consent (given at sign-up and by accepting this policy) and for the legitimate purposes of providing the Service, processing payments, and complying with law. You may withdraw your consent at any time by deleting your account or contacting us, though doing so may prevent you from using the Service. We process personal data only for the lawful, specified purposes described in this policy.

European Economic Area / United Kingdom (GDPR / UK GDPR): Where applicable, our legal bases for processing are: (a) performance of a contract (to provide the Service you purchased); (b) your consent; (c) compliance with legal obligations; and (d) our legitimate interests in operating, securing, and improving the Service. You have the right to lodge a complaint with your local data protection supervisory authority. You also have the rights of access, rectification, erasure, restriction, portability, and objection as set out in Section 7.

California (CCPA/CPRA): We do not sell or share your personal information as those terms are defined under California law. California residents may exercise their rights to know, delete, and correct by contacting us.

12. Grievance & Data Protection Contact

In accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, and the rules made thereunder, you may address any grievance regarding the handling of your personal data to our Grievance Officer:

• Grievance Officer: Samarjeet Singh
• Email: support@sneakai.in

We will acknowledge your grievance within 48 hours and aim to resolve it within one month, in accordance with applicable law.

13. Contact

For any privacy-related questions, requests, or concerns, please contact us at support@sneakai.in. We are committed to working with you to resolve any concerns you may have about our privacy practices.