Privacy Policy

This Privacy Policy explains how Meri Janu ("Platform", "we", "us", "our") collects, uses, stores, shares, and protects personal data when you use our website and Service. It applies to visitors, registered users, and anyone who contacts us, and should be read together with our Terms & Conditions.

Meri Janu is owned and operated by Harshpreet Singh, trading as XCodie Technologies (Udyam Registration No. UDYAM-PB-17-0132054), a sole proprietorship based in Patiala, Punjab, India, acting as the "Data Fiduciary" under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the personal data described in this Policy. Our registered business address is Main road, Ambika Enclave, Sanaur, Patiala, Punjab 147103.

We collect:

• Account data — name, email address, password (stored as an irreversible hash, never in plain text), your Google account identifier if you sign in with Google, and your language preference.
• Conversation data — the messages you exchange with companion personas. See Your Conversations With Companions below — we treat this category with extra care.
• Payment data — handled directly by our payment gateway (Razorpay); we receive only the transaction status, amount, and a reference ID, never your full card or bank details.
• Usage & device data — pages visited, approximate location derived from IP address, browser/device type, and timestamps, collected for security, rate-limiting, and diagnosing problems.
• Cookies — see Cookies below.
• Anything you send us directly — for example a contact-form message, or a message you flag for review.

Your conversations with AI companions are the most sensitive data we hold, and we handle them differently from ordinary account data:

• Messages are stored in our database, linked to your account, so your chat history is available to you across sessions — this is a core feature, not incidental logging.
• To generate a reply, your message and a capped window of recent conversation history (roughly the last 15–20 messages, by design) is sent server-side to the AI provider handling that conversation — see AI Providers We Use. This call happens only from our servers; your messages are never sent to an AI provider directly from your browser.
• We do not sell your conversations, and other users can never see them.
• We run an automated safety filter over AI replies before they reach you; if you use the in-chat "report" action, that specific message — and a small amount of surrounding context — is retained separately for our safety review, even after the original conversation would otherwise be deleted.
• Employees do not read individual conversations as a matter of routine. Access is restricted to what's needed to investigate a safety report, a support request you raise, or a legal obligation.
• Deleting your account deletes your conversation history — see Account Deletion.

We use third-party large language model providers to generate companion replies — currently DeepSeek for our free tier, and a paid-tier provider selected from Sarvam AI or Kimi (Moonshot AI) based on ongoing evaluation. These providers process the message content we send them (your message plus recent conversation context) strictly to generate a reply for you; they act as our data processors for this purpose, not as independent controllers of your data. We choose providers whose API terms state that customer data isn't used to train their models, and we review this before switching or adding a provider.

Under the DPDP Act, our processing of your personal data is based on your consent, which you give when you create an account and agree to this Policy — including for chat content, which is inherent to using a chat product. You may withdraw consent at any time by deleting your account (see Account Deletion), though this will end your ability to use the Service, and withdrawal doesn't affect processing already lawfully carried out before you withdrew.

We use strictly necessary cookies to keep you signed in and remember your language preference, and basic analytics cookies to understand aggregate usage of the site. We do not use third-party advertising cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent sign-in from working.

We do not sell your personal data. We share it only with:

• Service providers who process data on our behalf under contract — our database/hosting infrastructure, the AI providers described above, our payment gateway (Razorpay), and our email delivery provider for transactional emails.
• Law enforcement or regulators, where required by a valid legal process under Indian law.
• A successor entity, in the event of a merger, acquisition, or sale of the business — with the same privacy commitments carried forward.

We keep account and conversation data for as long as your account is active, so your chat history remains available to you. Payment records are retained as long as required under Indian tax and accounting law. If you delete your account, we delete or irreversibly anonymise your personal data and chat history within a reasonable period (see Account Deletion), except data we're legally required to retain longer — for example certain financial records, or content retained for an active safety investigation.

We use industry-standard safeguards: encrypted connections (HTTPS) everywhere, hashed passwords, access controls limiting who inside the Company can reach production data, and secure session cookies (httpOnly, secure, sameSite). No system is perfectly secure and we can't guarantee absolute security, but we take reasonable steps appropriate to the sensitivity of the data involved — particularly conversation data.

As a Data Principal under the DPDP Act, you have the right to:

• Access a summary of the personal data we hold about you and how it's processed.
• Correct or update inaccurate or incomplete data, directly from your account settings where possible.
• Erase your personal data by deleting your account (see below).
• Withdraw consent at any time, with the effects described in Legal Basis for Processing.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Grievance redressal — raise a complaint with our Grievance Officer (see the Grievance & Contact section below) and, if unresolved, approach the Data Protection Board of India.

You can permanently delete your account from Dashboard → Settings, with an explicit confirmation step since this action is irreversible. Deleting your account removes your profile, credit/subscription records (subject to the tax-record retention noted above), and your entire conversation history from our production database. We process deletion requests within 30 days, and any residual copies in encrypted backups are purged on our normal backup rotation schedule (up to 90 days).

The Service is not intended for anyone under 18, and we do not knowingly collect personal data from minors. If we become aware that we've collected data from someone under 18, we will delete it and terminate the account, as described in our Terms & Conditions — Eligibility.

Some of our service providers — including certain AI providers and cloud infrastructure — may process data on servers located outside India. Where this happens, we rely on the provider's contractual data-protection commitments and choose providers consistent with the DPDP Act's cross-border transfer rules as they apply from time to time.

We may update this Policy as our practices or the law change. We'll post the revised version here with a new "last updated" date, and for material changes affecting how chat content is handled, we'll make reasonable efforts to notify active users directly.