Privacy Policy
This policy covers all websites and apps of Samvit AI Labs (OPC) Private Limited. It explains what we collect, why, who helps us process it, how long we keep it, and what you can ask us to do. Part A applies to every product. Part B adds what is specific to each product.
On this page: Part A — All products · Part B — jaala · Part B — thoga
The short version
- Your work stays on your machine. Our apps store your work on your own device. We do not receive it.
- We collect what we need to run your account and licence, your billing details if you pay us, usage events that tell us whether the apps work, and whatever you choose to send us as feedback.
- We do not sell data, show ads, or send marketing email. We only email you about your account, billing and security.
- You can ask us to see, correct or delete your data at any time.
Part A — All products
1. Who we are
The data controller (in India, the data fiduciary) is SAMVIT AI LABS (OPC) PRIVATE LIMITED (One Person Company), CIN U62099TN2026OPC196958 (registered office details). Contact: support@samvitlabs.ai.
2. What we collect
Your account
When you sign in with Google or GitHub, we receive your email address, display name, profile picture link, and the sign-in provider's account identifier. We create a user ID for you. We never see your Google or GitHub password.
Your licence and devices
To give you a trial or a paid licence, we keep your licence status for each product (trial, active, expiry date) and a record of each device you use it on: a hardware identifier, the operating system, and the date it was registered. Each licence covers up to five devices.
To stop the free trial being restarted again and again, we keep a record that a trial was used on a given device (product + hardware identifier). This record is kept even if you delete your account. It does not contain your name or email.
Requesting access
Some products open by approval first, for example an invite-only beta. To request access, you sign in with Google or GitHub on our sign-in website (id.samvitlabs.ai), which the product's website and the app link to, and answer one short question, such as how you can help us during the beta. We keep your answer, your request status (waiting or approved) and the dates, with your account. We use them only to decide who gets access and when. Our team reads the answers.
How you use the apps (usage data)
The apps send us short usage events — for example app opened, import finished, search used — with counts and durations, the app version, your operating system, your country (worked out from your IP address; the IP address is not stored with your usage data), and the time rounded to the hour.
- These events are stored under a random analytics code, not your name, email or user ID.
- The app also records when you sign in and sign out. From those two events we keep, separately, a record of which account was signed in on that analytics code and when. We use it only to count usage for the account that was signed in at the time, so on a shared computer each person's usage counts for them alone. Usage while nobody is signed in counts for no one. This record is the only link between your account and your analytics code, and it is deleted when you delete your account.
- They never include your work, file names, file contents or anything you type. The apps only send the kinds of events this policy lists.
- The analytics code is made when the app is first opened, so a few events from before your first sign-in (such as installed) carry it too. The app sends them only once you sign in. Usage from before anyone signs in counts for no one.
- The apps send usage data in small batches, about every 10 minutes while you use them.
- You can turn usage data off in the app's Settings. If you do, the app sends none, and we cannot count your usage toward any usage-based pricing offer described in Part B.
Feedback you send us
When you use the Support button in an app, or the feedback link on our websites, we receive what you write and anything you attach, your user ID, the app or page you sent it from, the app version and your operating system. A support message does not carry your analytics code. If usage data is on, we match your support messages with your usage data through your user ID and the sign-in record described above.
You can attach two kinds of things:
- Screenshots. Dropping a screenshot into a support message attaches it. Screenshots may show your work. Only attach what you are happy for us to see.
- Logs. Logs are never attached unless you add them from the menu. They contain only internal IDs, never the titles or text of your work.
Before you send, the app shows you exactly what will be sent, with this warning: "Support messages are stored by Samvit AI Labs and read by our team and an AI assistant. Don't include personal, confidential or classified information."
We use an AI assistant (Anthropic's Claude) to sort and summarise support messages, including any screenshots and logs. Our team reads them too. We never publish attachments. If you tick "OK to share publicly", we may post the text of your feedback on our public GitHub discussions, without your name and without attachments, after reviewing it.
Our websites
Our websites count page views, the page that referred you, your country and device type. They do not use tracking cookies. To count unique visitors without cookies, we use a code derived from your IP address and browser that changes every day; we do not store the IP address itself.
Signing in on a website (only needed to request access to a product or to send feedback) uses the browser storage that the sign-in needs to work.
Payments
Outside India, payments are handled by a merchant of record, a payment company that is the seller of record for your purchase. It collects your payment details under its own privacy policy, and its name is shown at checkout. We receive your name, email, country, what you bought and your subscription status. We never see your card details.
In India, you pay us directly by UPI or bank transfer. We collect your full legal name, email, billing address, GSTIN (if you have one) and state (the place of supply for GST). We keep the invoices we issue and the transaction details: amount, date, the UPI or bank reference, and the paying account's name and UPI ID or account number as they appear on our bank statement. We use them for invoicing, working out and paying GST, accounting and the reports the law requires.
Emails you send us
If you email us, we keep the message and your email address so we can reply and follow up.
Crash reports
If an app crashes or hits an unexpected error, it sends a crash report automatically, without asking first (after a crash there may be no screen to ask on). A crash report contains only technical details: the app version, your operating system, the kind of error, and where in the app's code it happened, with your home folder name removed. It never includes your work, file contents or your account — only your analytics code. You can turn crash reports off in the app's Settings, separately from usage data.
Update checks
The apps check our update server for new versions. Like any web server, it briefly sees your IP address to answer the request.
Security logs
When an app or our sign-in page calls our servers, our load balancer and firewall (Google Cloud) record each request: the IP address it came from, the time, the address it called and the result. We use these logs only to protect our services from abuse and to set and check rate limits. They do not contain what you sent us, and they are deleted after 30 days.
3. What we do not collect
- The work you create or store in our apps, or the files they read.
- Anything that passes between your machine and third-party services you connect, such as an AI provider. That traffic goes directly between you and them, under your agreement with them.
4. Why we use it
| Purpose | Data | Legal basis |
|---|---|---|
| Run your account, sign-in and licence | Account, licence and device data | Performing our contract with you |
| Decide who gets access while a product is by approval | Access requests (your answer, status, dates) | Steps you asked us to take before a contract |
| Prevent trial abuse and keep services secure | Device and trial records | Our legitimate interests |
| Protect our servers from abuse and set rate limits | Security logs (IP address, time, address called, result) | Our legitimate interests |
| Understand whether the apps and sites work, and improve them | Usage and website data | Our legitimate interests — you can turn app usage data off |
| Decide eligibility for pricing offers | Usage data, feedback records | Performing our contract with you |
| Answer feedback and support requests, including sorting them with an AI assistant | Feedback, emails | Performing our contract with you |
| Find and fix crashes | Crash reports | Our legitimate interests — you can turn crash reports off |
| Publish feedback text publicly | Feedback text | Your consent (the checkbox) |
| Take your payment and give you your licence | Payment and billing data | Performing our contract with you |
| Invoicing, GST and tax, accounting and statutory reporting | Billing data, invoices and transaction records | Legal obligation |
5. Who processes it for us
We do not sell or rent personal data. We use these service providers, who process data on our instructions:
| Provider | What for |
|---|---|
| Google (Firebase, Google Cloud) | Sign-in, database, file storage, website hosting, usage analytics, crash reports, support messages, data analysis (BigQuery) |
| Anthropic | Sorting and summarising support messages with its AI model (Claude). Anthropic does not use this data to train its models and deletes it within 30 days |
| Google Workspace | Our email |
| GitHub | Public feedback discussions — only text you allowed us to publish |
| A merchant of record (named in this policy before we start selling) | Payments outside India, as the seller of record |
| ICICI Bank | Receiving payments in India (UPI and bank transfer) |
We may also run some of this ourselves, on servers we own or control, instead of through a provider: usage analytics, crash reports and support messages. The same rules in this policy apply there, and we will update this policy before we do.
We may also disclose data where the law requires it.
6. Where it is stored
Our database, files and analytics are stored in Google Cloud's Mumbai region (India). If we run any of it on our own servers, they will also be in India. Sign-in is processed by Google in the United States. Where data leaves the European Economic Area or the UK, Google's standard contractual clauses protect it.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account, licence and device records | While your account exists. Deleted within 30 days of your request |
| Access requests | While your account exists. Deleted with your account |
| Trial-use record (product + hardware identifier) | While the product offers free trials. Contains no name or email |
| Usage data | Raw events up to 13 months, then only summaries. On account deletion, the link to you is removed and the remaining data no longer identifies you |
| Support emails | Up to 3 years, or until you ask us to delete them |
| In-app support messages | Up to 3 years. When you delete your account, see Support messages after you delete your account below |
| Crash reports | Up to 13 months. They are linked only to your analytics code, never your account |
| Billing, invoice, GST and transaction records | 8 years, as Indian law requires — including after you delete your account |
| Security logs (IP addresses) | 30 days |
| Backups | Deleted data disappears from backups within 7 days |
Support messages after you delete your account
When you delete your account, we delete your user ID and email address from your support messages at once. We keep the messages themselves, and our replies, only after removing anything that could identify you: first fixed rules (names, email addresses, user IDs, home folder paths, phone numbers), then an automated check for personal data, then a check by an AI model. This cleaning runs on Google Cloud in Mumbai, or on a computer we own and control. Screenshots are read the same way: if nothing in a screenshot identifies you, we keep it, unlinked from you; if anything does, we delete the screenshot and keep only its cleaned text.
Reports and exports
Our analysis tables (Google BigQuery) hold only the structured details of support messages and crash reports — type, status, dates and counts, and for crash reports the analytics code — never their text or screenshots. If we build training data from support messages, we use only cleaned text that no longer identifies anyone. Any other export that contains message text is deleted within 30 days.
8. Your rights
You can ask us to:
- see the personal data we hold about you,
- correct it,
- delete it (and your account),
- withdraw consent to publishing your feedback,
- object to our use of it for analytics — or simply turn usage data off in Settings.
Write to support@samvitlabs.ai from the email address you use to sign in to our products, so we can verify it is you. We will respond within the time the law requires.
If you are unhappy with our answer, you can complain to the Data Protection Board of India, or, if you live in the EU or UK, to your local data protection authority.
9. Emails from us
We only email you about your account, billing, security, and changes to our terms or this policy. Billing emails include receipts and a reminder before each yearly renewal. We do not send newsletters or marketing email. Product news lives on each product's changelog.
10. Children
Our products are not intended for anyone under 18, and we do not knowingly collect their data.
11. Security
Data is encrypted in transit and at rest. Access to our systems is limited to the people who need it — today, that is the founder. Our database cannot be read or written directly by any app or browser; every change goes through checked server functions.
12. Changes to this policy
We may update this policy at any time. The version on this page applies from the date shown at the top. For material changes, we will try to tell you in the apps or by email.
13. Grievance Officer
Ramki, Director
SAMVIT AI LABS (OPC) PRIVATE LIMITED
Registered office details
Email: support@samvitlabs.ai
Part B — jaala
B1. What stays on your machine
Your jaala graph, your AI coding sessions, your source code and your files are stored on your own device. jaala reads your Claude Code session history locally. We never receive any of it.
jaala encrypts all its data at rest on your device — your graph and the files you attach to it — with a key held in your operating system's keychain. We never have the key, so we cannot read or recover your data.
B2. AI features
jaala's AI features run through your own Claude Code installation and your own Anthropic account. That traffic goes directly between your machine and Anthropic under your agreement with them. It does not pass through us.
B3. Usage data in jaala
jaala's usage events include: installed, first run finished, first capture finished, a function run finished (only the name of the function, such as Organize or Consolidate), and the terminal was used (only that it was used, never the commands you type or their output), and signed in / signed out (only the time, so usage counts for the right account).
We use your usage data (the days you used jaala and the function runs you completed) and your reports (Support messages, and emails to us from the email address you use to sign in to jaala) to decide eligibility for the beta price described in Part B of our Terms. This needs usage data to stay on.
Part B — thoga
Coming soon. thoga is not yet released. Its privacy terms will be published here before release.