Privacy Policy
Last updated: 28 August 2026
Effective from: 28 August 2026
This Privacy Policy explains what personal data JuicyChat (juicychat.in, the “Service”) collects, why, who it is shared with, and what rights you have.
For the purposes of the Digital Personal Data Protection Act, 2023 (“DPDP Act”), the operator of JuicyChat is the Data Fiduciary and you are the Data Principal.
Please read Section 3 carefully. Your conversations are stored on our servers and are sent to a third-party AI provider in order to generate replies.
1. Definitions
1.1. “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
1.2. “Processing” means any operation performed on Personal Data, including collection, storage, use, sharing, and erasure.
1.3. “Guest” means a person using the Service without signing in.
1.4. “Device Identifier” means a randomly generated identifier stored in your browser that allows us to associate your activity across visits from the same device, without knowing who you are.
2. What we collect
2.1. Information you give us
| Data | When | Why |
|---|---|---|
| Messages you send to a Character | Whenever you chat | To generate a reply and to show you your conversation history |
| The mobile number you paid with, or a payment screenshot | When you claim a Paid Session | To match you to a payment we received, and to grant access |
| Payment details from Razorpay — the mobile number and UPI address used, the amount, and the transaction reference | When a payment completes. Sent to us by Razorpay, not by you | To confirm the payment is real before granting access, and to keep a record of money received |
| Correspondence | When you email us | To answer you |
2.2. Information from Google, if you sign in
If you choose to sign in, Google provides us with your name, email address, profile photograph URL, and a Google account identifier. We do not receive or store your Google password.
Signing in is optional. You may use the Service as a Guest.
2.3. Information collected automatically
| Data | Detail |
|---|---|
| Device Identifier | A random identifier stored in your browser |
| IP address | Recorded with sessions, activity events, and payment attempts |
| Approximate location | Country, region, and city, derived from your IP address. We do not collect GPS or precise location. |
| Device and browser information | Browser user-agent string, device type, platform, language, timezone |
| Usage activity | Pages visited, characters opened, messages sent, replies received, taps and clicks, session start and end, time active, errors encountered |
| Referral and campaign data | The page you arrived from, and any campaign parameters in the link you used (including utm_* parameters and Google and Meta advertising click identifiers) |
2.4. Information the Service derives
| Data | Detail |
|---|---|
| Memories | Short factual statements automatically extracted from your conversations — for example, a stated preference or a detail about your day — so that a Character can refer to them later. These are generated by an AI model reading your messages. |
| Conversation metadata | Which Character, how many messages, when last active |
| Message diagnostics | Which AI model produced a reply, how long it took, token counts, and any error |
2.5. What we do not collect
- We do not collect or store card numbers, bank account details, UPI PINs, or any payment credentials. Payment is made in your own UPI application and we never see those details.
- We do not use Google Analytics or any third-party analytics SDK. All usage analytics are first-party, recorded by our own servers. We do use one advertising measurement tool — the Meta pixel, described in full in Section 2.6.
- We do not collect precise or GPS location.
- We do not knowingly collect data from children. See Section 8.
2.6. Advertising measurement
We advertise this Service, and we measure whether those advertisements work. This is the only purpose for which we share data with a company that is not needed to run the Service itself, so it is set out here in full rather than left to a footnote.
2.6.1. What we use. We use the Meta pixel — a small script from Meta Platforms, Inc. that runs in your browser — together with Meta’s Conversions API, which sends the equivalent information from our own servers. The two describe the same events; the second exists because browsers increasingly block the first.
2.6.2. When it starts. Nothing is loaded or sent until you have confirmed you are 18 or older. On your first visit, no measurement happens until that point.
2.6.3. What is shared with Meta. Two cookies Meta sets in your browser (_fbp, and _fbc if you arrived from an advertisement), your IP address, your browser user-agent, the approximate city and country derived from that IP, the page you viewed, and a random device identifier that is not linked to your name. If you create an Account or make a payment, your email address and mobile number are also shared, but only after being irreversibly hashed — converted into a fixed string that cannot be turned back into the original.
2.6.4. What is never shared with Meta. Your messages, your memories, which Character you speak to, and anything you say in the Service are never shared with Meta — not in any form, hashed or otherwise. Nor is your email address or mobile number in readable form, your payment details, or any screenshot you upload.
2.6.5. Your choice. This measurement runs by default. If you do not want it, write to us at juicychat.in@gmail.com and we will stop sharing your data with advertising partners, with effect for the future. See Section 7.3.
3. How your conversations are processed
This section describes the single most significant processing activity in the Service. Please read it before using the Service.
3.1. Your messages leave your device. When you send a message, its text is transmitted to our servers, stored, and forwarded to our AI provider so that a reply can be generated.
3.2. Our AI provider is Google. Messages are processed by Google’s Gemini models through Google’s application programming interface, for the sole purpose of generating a reply to you.
3.3. Memory extraction. Your messages are also processed by the same AI provider in order to extract short “memories” as described in Section 2.4.
3.4. Payment screenshots are also sent to the AI provider. If you choose to claim your session with a screenshot, the image is transmitted to Google’s Gemini model, which reads the transaction references printed on it. The model does not decide whether you are granted access — that depends on whether one of those references matches a payment we have actually received. The image, and the references read from it, are stored by us.
3.5. Payments are processed by Razorpay. Payment takes place on a page operated by Razorpay Software Private Limited and inside your own UPI application. We never see or store your UPI PIN, card, or bank credentials. Razorpay sends us confirmation of each completed payment, which includes the mobile number and UPI address used and the transaction reference. Razorpay handles that payment under its own privacy policy, as a data controller in its own right.
3.6. What we do not do with your conversations. We do not sell your conversations. We do not use them for advertising. We do not publish them.
3.7. Your conversations are not used to train AI models. We use Google’s Gemini API on its paid tier. On that tier, Google does not use submitted content to train or improve its models. Your messages are sent to Google only to produce a reply to you, and are not retained by Google for model development.
3.8. Retention of conversations. Deleting a message in the application marks it as deleted and hides it from you. The underlying record remains in our database while your Account is active, and is erased when you delete your Account. See Section 6.2.
4. Why we process your data, and our legal basis
Under the DPDP Act we process Personal Data on the basis of your consent, given when you use the Service, and for certain legitimate uses permitted by the Act.
| Purpose | Data used | Basis |
|---|---|---|
| Providing the chat service and generating replies | Messages, memories, character selection | Consent |
| Maintaining your conversation history across devices | Messages, Account identifiers | Consent |
| Authenticating you | Google account data | Consent |
| Verifying payment and granting access | Mobile number or payment screenshot, payment details from Razorpay, Device Identifier, IP | Consent; performance of the service you requested |
| Preventing fraud, abuse, and duplicate claims | Transaction reference, payment screenshot fingerprint, IP, device data | Legitimate use — prevention of fraud |
| Keeping the Service secure and available | IP, error logs, usage events | Legitimate use — security |
| Understanding how the Service is used and improving it | Usage events, approximate location, campaign data | Consent |
| Measuring and optimising our advertising (Section 2.6) | Campaign data, advertising cookies, IP, approximate location, page views, and — after signup or payment — hashed email and mobile number | Consent |
| Responding to your queries and grievances | Correspondence | Consent; compliance with law |
You may withdraw consent at any time — see Section 7.
5. Who we share data with
We do not sell your Personal Data. We share it only with the recipients below. All but the last are processors acting on our instructions, and only so far as necessary to run the Service. The last — Meta — receives data for advertising measurement and acts as a controller in its own right; that sharing is described in Section 2.6 and you can opt out of it under Section 7.3.1.
| Recipient | What they receive | Purpose |
|---|---|---|
| Google (Gemini API) | Message text, extracted memories, payment screenshot images | Generating replies; extracting memories; reading transaction references off payment screenshots |
| Razorpay Software Private Limited | The payment you make on their page — and, from them to us, the mobile number and UPI address used, the amount, and the transaction reference | Taking the payment, and confirming to us that it completed |
| Google (Firebase Authentication) | Authentication data | Signing you in |
| Supabase | All stored application data, including messages, memories, usage events, and payment screenshots | Database and file storage hosting |
| Vercel | Requests to the Service, including IP address | Application hosting and delivery |
| Meta Platforms, Inc. | Advertising cookies, IP address, browser user-agent, approximate city and country, pages viewed, and a random device identifier — and, after signup or payment, email address and mobile number in irreversibly hashed form only. Never your messages or memories. See Section 2.6. | Measuring and optimising our advertising |
5.2. Where your data is hosted. Our Supabase database and storage bucket are hosted in the Asia Pacific (Mumbai) region, ap-south-1 — that is, within India. Requests to the Service may be served by Vercel’s global network, and message content is processed by Google’s Gemini API, which may involve processing outside India.
5.3. Other disclosures. We may disclose Personal Data where required by law, by a court, or by a governmental authority, or where necessary to establish, exercise, or defend a legal claim.
5.4. Business transfer. If the business is sold or transferred, Personal Data may be transferred as part of that transaction, subject to this Policy.
6. Storage, retention and security
6.1. Where data is stored. Application data is stored in a hosted Supabase PostgreSQL database. Payment screenshots are stored in a Supabase storage bucket. Some conversation data is also stored locally in your own browser so the application works quickly and offline; clearing your browser storage removes that local copy but does not remove the copy on our servers.
6.2. Retention. There are two cases, and which one applies depends entirely on whether you have asked us to delete your data.
(a) If you have not asked us to delete your data, we keep it for the following periods:
| Category | Retained for |
|---|---|
| Messages and memories | For as long as your Account is active |
| Usage and analytics events | 12 months from the date of the event |
| Payment screenshots and payment records | 12 months from the date of the payment attempt |
(b) If you ask us to delete your data, everything is erased. Deletion is not partial and it is not staged.
We erase your messages, your memories, your account details, your usage and analytics events, and your payment screenshots and payment records — all of it — within thirty (30) days of verifying your request.
The 12-month periods in the table above do not apply to you once you have made a deletion request. Those periods govern how long data is kept for people who have not asked for deletion. A deletion request overrides them; we do not hold an event or a screenshot for the remainder of its 12 months, and we do not wait for any clock to run out.
One exception, and only one. If there is an ongoing dispute about a particular payment — for example, you have claimed a refund and it is not yet settled — we may retain the screenshot and record of that single payment until the dispute is resolved. This is because that record is the evidence of the transaction being disputed, and erasing it would leave neither of us able to show what happened.
This exception is strictly limited:
- it covers only the specific payment under dispute, not your other payments, and not any other category of data;
- everything else is erased on the normal 30-day timeline;
- the retained record is erased once the dispute is resolved.
Where we are required by law to retain a record for longer, we will retain only what the law requires and for no longer than it requires.
6.3. Security. We apply reasonable security safeguards, including encrypted transport (HTTPS), access controls on the database, and restricted administrative access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
6.4. Breach notification. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act.
7. Your rights
Under the DPDP Act, you have the following rights in relation to your Personal Data:
7.1. Right to access — to obtain a summary of the Personal Data we process about you and the processing activities undertaken.
7.2. Right to correction and erasure — to have inaccurate or misleading data corrected or completed, and to have your Personal Data erased where it is no longer needed for the purpose for which it was collected, unless retention is required by law.
7.3. Right to withdraw consent — to withdraw your consent at any time, with effect for the future. Withdrawing consent may mean the Service can no longer be provided to you.
7.3.1. Withdrawing consent to advertising measurement only. You can opt out of the sharing described in Section 2.6 without giving up the Service. Write to us at juicychat.in@gmail.com, including the device identifier shown in the account menu if you have not signed in, and we will stop sharing your data with advertising partners. This is recorded against you rather than against one browser, so it continues to apply if you clear your browser storage or use another device you are signed in on.
7.4. Right of grievance redressal — to a readily available means of registering a grievance with us (Section 10).
7.5. Right to nominate — to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
7.6. How to exercise these rights. Write to us at juicychat.in@gmail.com from the email address associated with your Account.
There is no self-service control in the application for viewing, exporting, or deleting your data — each request is handled manually. We will acknowledge your request within seven (7) days. Where you have asked us to delete your data, we will complete the deletion within thirty (30) days of verifying your request.
7.7. Verification. We may ask you to verify your identity before acting on a request, in order to protect your data.
8. Children
8.1. The Service is not intended for children.
8.2. The Service is for users aged 18 and over. Our Terms require you to declare that you are at least 18. That declaration is accepted at face value and we do not currently verify age. We do not knowingly process the Personal Data of anyone under 18.
We do not carry out behavioural advertising or tracking directed at children.
8.3. If we become aware that we have collected Personal Data from a child without the required consent, we will delete it.
9. Changes to this Policy
We may update this Policy. The updated version takes effect when published on this page, and the “Last updated” date will change. Where a change is significant, we will take reasonable steps to bring it to your attention.
10. Contact and grievance redressal
For any question about this Policy, to exercise any right under Section 7, or to register a grievance:
Email: juicychat.in@gmail.com
Telephone: 6264263300
Location: Korba, Chhattisgarh, India
Working hours: Monday to Saturday, 10:00 to 18:00 IST
We will acknowledge grievances within seven (7) days and resolve them within thirty (30) days.
If you are not satisfied with our response, you may complain to the Data Protection Board of India.
JuicyChat is operated by Shahzeb Ansari.