Privacy Policy

Effective date: October 23, 2026

This policy explains what Chitti AI Assistant collects, why, who else handles it and how long it is kept. Chitti AI Assistant is the website at staging.chitti-ai-assistant.com, the Chitti AI Assistant desktop app for Windows and macOS, and our AI service at ai.staging.chitti-ai-assistant.com that the app uses for answers and transcription. Questions about this policy go to support@chitti-ai-assistant.com.

Chitti AI Assistant (staging.chitti-ai-assistant.com) decides why and how your personal data is processed. Under India's Digital Personal Data Protection Act, 2023 we are the "Data Fiduciary", and this policy is our notice to you under that Act. It also applies if you use Chitti AI Assistant from outside India. Chitti AI Assistant is only for people aged 18 or older.

1. What we collect, and why

Each item of personal data we process, and the purpose we use it for:

The rest of this section describes each of these in more detail.

Your account

• Your email address, which you sign in with. We send a link to confirm it.
• Your password, stored only as a one-way hash (Argon2). We cannot read it.
• If you choose Sign in with Google: your Google account's id and the details Google shares with us about your basic profile and email (such as your name, email address and the address of your profile picture), kept with the link to your Google account. We ask Google only for your basic profile and email, and we do not keep any access to your Google account.
• If you turn on two-factor authentication: its secret, stored encrypted, and your recovery codes. Two-factor authentication is optional for customers and required for our staff.
• When you agreed, at sign-up, to be 18 or older, to the Terms of Service and to having read this policy, and the version (effective date) of those pages.
• When you joined, your plan and minutes, your invite code and, if you joined through someone's invite link, that you did. A person who invites you sees only counts (how many joined and subscribed), never who you are.

Sign-in and security records

• Records of successful and failed sign-ins, with the email used, the IP address, the browser and the time, kept for 30 days (those made with your account's email addresses are deleted with your account). Too many failed attempts from one address lock that account and address out for an hour.
• Your IP address is also used to limit how often sign-ups, sign-ins and password resets can be tried, and appears in our security logs (where email addresses are partly masked).
• On the sign-up and password-reset pages, Cloudflare Turnstile checks that you are not a bot.
• When the desktop app signs in, it receives a sign-in token, which the app keeps in your computer's keychain. We record when it signed in, until when that sign-in is valid and whether it was signed out, and when the app was last seen.
• Signing out, in the desktop app or on the website, signs you out everywhere: the desktop app on every computer and the website in every browser, and a session that is running ends. We keep when you last signed out, so that every sign-in from before it stays signed out; it is deleted with your account.

Your sessions

For every session you run in the desktop app we record its title, whether it was an interview or a demo, when it started and ended, how long it lasted and how many minutes it used. This is your usage and billing history and it is kept while you have an account, whether or not the conversation was saved.

Saved conversations (on by default)

While saving is on (see section 3), we keep, for each session (except mock interviews, of which nothing is kept):

• the questions you had the app answer and the answers it suggested;
• the conversation as text, line by line, marked as said by the interviewer or by you, with the time into the session. When the app listens to your computer's sound, it also listens to your microphone so that your own side is saved. If it listens to one microphone that hears everyone, the lines are saved without telling the speakers apart.

Text only: no audio is ever sent to our website or kept by us.

Feedback on a session

After a session whose conversation was saved, the conversation is sent through our AI service to OpenAI to write feedback: an overall score (the average of five areas), a score for each area, a short summary, and detailed points on what went well and what to improve. The detailed points are deleted together with the saved text; the scores and the short summary stay, so you can see your progress.

AI usage figures

For each request to the AI we record which model was used, for which session and kind of session, how many tokens it took, how many seconds of audio were transcribed, how long it took, whether it succeeded and what it cost. Never the question, the answer or the audio. These figures let us keep spending limits and are part of your usage history.

Payments

Payments are handled by Stripe. Your card number is entered into Stripe's own form and never reaches our servers. Stripe keeps your billing name and address. We keep Stripe's references to you and your subscription, the card's brand, last four digits and expiry date, and a record of each invoice (plan, amount, tax, currency, status, the end of the period it paid for, the card's brand and last four digits, and a link to the invoice).

What stays on your computer

The desktop app keeps your profiles (resume, job description, instructions and any documents you add), its settings and its own logs on your computer. These files are not uploaded to our website. Parts of them are sent with your questions to write answers (see section 2). A session file you choose to save is saved on your computer.

Email

The only emails we send you are about your account: confirming your address, resetting your password and security notices. Messages you send to support@chitti-ai-assistant.com are forwarded to the owner's mailbox.

2. How the AI features handle your data

• Answers. When you ask for an answer, the app sends the question, any screenshots you added, the relevant parts of your resume, job description, instructions and documents, and your last few questions and answers to our AI service, which passes them to OpenAI and streams the answer back. Our AI service does not store or log the content (see what our AI service logs).
• Live transcription. The app listens only when you turn listening on (your computer's sound or your microphone), and it shows a notice that the audio is sent to OpenAI and that you should get consent. The audio is streamed through our AI service to OpenAI, which returns the text. While a conversation is being saved, listening to your computer's sound also transcribes your microphone in the same way, so that your side is saved too. Our AI service never records or logs the audio or the words; it counts only how many seconds were sent.
• Feedback. As described above, a saved conversation is sent through our AI service to OpenAI to write feedback.
• Mock interviews. In a mock interview the AI interviewer's questions are written from your resume and job description and the conversation so far, your microphone is transcribed as in live transcription, and any code you type goes with your answer; a suggested answer is written as any answer is. All of this goes through our AI service to OpenAI and is not kept by us: nothing of a mock interview is saved, and its speaking feedback (pace, filler words, answer length) is worked out in the app on your computer and is gone when you close it.

OpenAI processes this data for us as our AI provider, under its own API terms.

What our AI service logs

• The AI service itself writes one line per request: the time, a request number, the first characters of your account's random id, the session number, the model, the result (a status code), the token counts and how long it took. For listening it writes the seconds of audio sent, the seconds of silence not sent and how long the connection stayed open. If it cannot hand the usage figures to the website, it logs those figures with your account's full random id. Never a question, an answer, a document, audio or the words spoken. This log is replaced by newer lines as it grows.
• The web server in front of it logs each request to the AI service: the time, your IP address, the address asked for (such as /v1/realtime?language=en), the method and protocol, the result status, the size of the reply and how long it took. Request and response headers are removed before the line is written, so it holds no sign-in token, and it never holds any content. This log is kept in files of 20 MB: the newest 5 older files are kept, none for longer than 90 days.

3. Saved conversations

• On by default. Saving is on for every session except mock interviews (which are never saved), with no button and no question. When a session starts, the app's status line says that the conversation is being saved, that it is deleted after 3 days, that everyone in it should agree, and that you can switch it off in Response Settings.
• Switching it off. In the app, open Response Settings and turn off Save my conversations for feedback. From then on nothing of your sessions' content is kept: no questions and answers, no conversation and no feedback (the session's time and minutes are still recorded). Switching it off during a session stops saving from that moment; what was already saved stays until it is deleted.
• Automatic deletion. Saved questions and answers, conversations and the detailed feedback are deleted 3 days after they were recorded, by a job that runs once a day.
• Deleting sooner. In the app, a session's window has Delete saved text. On the website, Settings > Your data deletes all of your saved questions, answers and conversations at once.
• Who can see it. You, in the app, in your data download and in the session file you can save. Saved conversations are not shown to our staff in the site's administration pages and are never written to our logs.
• Other people's words. A saved conversation includes what the interviewer said. Make sure the people you talk to agree, and that recording or transcribing them is allowed where you are.

4. Who else handles your data

We share data only with the services that run Chitti AI Assistant for us:

• OpenAI: writes answers and feedback and transcribes audio (section 2).
• Stripe: takes payments and runs subscriptions, and works out sales tax from your billing address.
• Cloudflare: sends our emails, forwards email sent to support@chitti-ai-assistant.com, and runs the Turnstile bot check.
• Google: only if you choose to sign in with Google.
• DigitalOcean: hosts our server, which holds the website, the AI service and the database.

We do not sell your personal data.

5. Where your data is kept and how it is protected

• Our server is a DigitalOcean server in New York, in the United States. The database runs on that server and cannot be reached from outside it.
• Your personal data is processed outside India, mainly in the United States: on our server, and by the services listed in section 4, which may process it in other countries too. India's Digital Personal Data Protection Act allows this, except to countries the Government of India restricts. If a country we use is restricted, we will follow that restriction.
• The website and the AI service are served only over HTTPS. Passwords are hashed, two-factor secrets are encrypted, and our staff must use two-factor authentication.
• The database is backed up every night on the server, and each backup is kept for 14 days. Something you delete can therefore remain in a backup until that backup is removed.

6. How long we keep it

7. Your consent, and how to withdraw it

You give your consent when you create your account, by ticking the box to say that you are 18 or older, that you agree to the Terms of Service and that you have read this policy. You can withdraw it at any time, as easily as you gave it:

• Saved conversations: in the desktop app, open Response Settings and turn off Save my conversations for feedback. It takes effect straight away.
• Saved text you already have: delete it per session with Delete saved text in the app, or all of it at once in Settings > Your data on the website.
• Everything (your account): on the website, open Settings > Your data and use Delete account. You confirm it with your password (or by signing in with Google again, if your account uses Google), a two-factor code if you have two-factor authentication on, and by typing DELETE. It takes effect straight away and cannot be undone:
  • Deleted: your account (email addresses, name, password, two-factor secrets and recovery codes, Google sign-in link and details, consent record), your plan, minutes, minutes history and invite code, the desktop app's last-seen record, your sessions with their saved questions and answers, saved conversations and feedback, and the sign-in records made with your email addresses. If you joined through an invite link, that record goes too; people you invited keep their account and their discount.
  • Ended: a plan you pay for is cancelled straight away, without a refund for the rest of the period (Refund Policy); the desktop app is signed out on every computer, and you are signed out of the website everywhere. We send one last email to say the account has been deleted.
  • Kept:
    • The payment and invoice records (plan, amount, tax, currency, status, dates, card brand and last four digits, and Stripe's references), for our accounts and as tax and accounting rules require. They are no longer linked to an account. Stripe keeps its own record of your payments under its own policy.
    • The AI usage figures (model, tokens, seconds of audio, time taken, cost; never any words), no longer linked to an account, because they count toward our overall spending limits.
    • The site administration's history of changes our staff made to your account, with your email address replaced by "Deleted user" and the account's number.
    • The desktop app's revoked sign-in tokens, until they expire (at most 7 days). They hold only a random account number that no longer belongs to anyone, and their dates.
    • Our server logs, which name an account by its number (and, for sign-ins, a partly masked email address) and hold IP addresses, until newer logs replace them.
    • Copies in our database backups, until those backups are removed (14 days).
  If you cannot sign in, email support@chitti-ai-assistant.com from your account's email address and we will delete it for you within 30 days, in the same way.

Withdrawing consent does not undo what was lawfully done before, and without an account you can no longer use Chitti AI Assistant.

8. Your rights

You can ask us to:

• Give you a summary of the personal data we hold about you, what we do with it, and who we have shared it with (section 4). Settings > Your data > Download my data gives you a full copy straight away.
• Correct, complete or update your personal data. You can change your email address and password yourself in Settings.
• Erase your personal data: Settings > Your data > Delete account does it straight away (section 7).
• Nominate another person who may use these rights for you if you die or become unable to use them yourself. Email us the person's name and email address.

To use any of these rights, email support@chitti-ai-assistant.com from your account's email address and say what you would like. We may ask you to confirm that the account is yours. We answer within 30 days.

9. Complaints

• First, to us. Our grievance contact is the owner of Chitti AI Assistant, at support@chitti-ai-assistant.com. Tell us what happened and what you would like us to do. We answer within 30 days.
• Then, to the Data Protection Board of India. If you are not satisfied with our answer, or we do not answer in time, you can complain to the Data Protection Board of India, set up under the Digital Personal Data Protection Act, 2023.
• If you live outside India, you may also have the right to complain to the data protection authority where you live.

10. Children

Chitti AI Assistant is only for people aged 18 or older, and everyone who signs up confirms that they are. We do not knowingly process personal data of anyone younger. If we learn that an account belongs to someone under 18, we close it and delete its personal data. If you think a child has an account, please email support@chitti-ai-assistant.com.

11. Data breaches

If a breach of security affects your personal data, we will inform you and the Data Protection Board of India as the law requires, saying what happened, what it may mean for you, and what we and you can do about it.

12. Cookies

The website uses only these cookies (the Cookie Policy lists each one in full):

• a sign-in cookie (__Host-chitti_session): keeps you signed in;
• a desktop app link cookie (chitti_app_link): lets the desktop app show its sign-in page in a tab you already have open;
• a security (CSRF) cookie (__Host-chitti_csrf): protects forms;
• a notice cookie (messages): carries a one-time notice (such as "Password changed") to the next page you see;
• a time zone cookie (tz): so times are shown in your own time zone;
• a referral cookie (chitti_ref): only when you open someone's invite link, kept for 30 days so the discount applies if you sign up later.

There are no analytics or advertising cookies. The Turnstile check on the sign-up and password-reset pages, and Stripe's payment form on the payment page, are loaded from Cloudflare and Stripe and work under their own privacy policies.

13. Changes to this policy

When this policy changes, we will publish the new version on this page with a new effective date. If a change affects how your personal data is used, we will also tell you by email.

14. Contact

Chitti AI Assistant (staging.chitti-ai-assistant.com). Email support@chitti-ai-assistant.com, for questions about this policy, requests about your personal data and complaints. See also our Terms of Service, Cookie Policy and Refund Policy.