Privacy policy

• Both services are run by Vibencode Private Limited, a company registered in India.
• The website has no accounts. It runs Google Analytics, and that is all it collects.
• Swadhin Chat holds your account, your conversations and files, and your credit and payment records.
• What you send to a model goes to the company that runs that model. Section 6 names every one.
• Swadhin Chat runs on servers in India, and so do its AI models. The few services that take data outside India are named in section 8.
• We do not sell your data, show you advertising, or train models on what you write.
• You can see, correct and delete your data. Section 10 says how.

Vibencode Private Limited, incorporated under the Companies Act, 2013 and recognised by Startup India, runs two services under the Swadhin name: the website at swadhin.ai, covered in Part A, and Swadhin Chat at chat.swadhin.ai, covered in Part B. Part C applies to both. “We” and “us” mean Vibencode Private Limited. “You” means anyone who uses either service.

Under the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data this policy describes. Under the Information Technology Act, 2000 we are the body corporate that holds it.

Our registered office is at Plot No. 5, Rose Enclave, Shastri Ward, Sagar, Madhya Pradesh 470002, India. Write to legal@vibencode.com about your personal data, and to team@swadhin.ai about anything else.

This policy is written to meet the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which apply today, and the Digital Personal Data Protection Rules, 2025, most of which apply from 13 May 2027. We already follow both, and where they differ we follow the stricter. If the GDPR applies to you, section 14 adds what it requires.

It does not cover the sites we link to, or the websites of the model providers named in section 6. Their own policies apply there.

The website is the public site at swadhin.ai: the landing page, the leaderboards and the calculator. There is no account, no sign-up, no form and no newsletter, and no server of ours that could receive one.

The website runs Google Analytics 4. Everything it collects is listed here.

• Analytics: every page loads gtag.js from googletagmanager.com, which is Google's server and not ours. It records the page you opened, the page you arrived from, the page title, your language, your screen size, and your browser and device. It also records a click through to Swadhin Chat, and which button it came from. Google derives an approximate location from your IP address, and states that it does not log or store the address itself.
• Cookies: two, _ga and _ga_<id>. They hold a random number so that several page views in one visit are counted as one visit rather than several. They last two years unless you clear them.
• Google signals: on. If you are signed in to a Google account and have ad personalisation turned on in it, Google adds a rough age group, gender and interests to your visit, and can link your visits from different devices. We see these only as totals across many visitors, never for one person.
• What we switched off: ad personalisation. What this site sends to Google is not used to target advertising at you.
• No user ID: the website sets no identifier of its own and sends no name, email or account. If you also use Swadhin Chat in the same browser, Google Analytics may link your visits here to the account ID Swadhin Chat sends, described in section 4.
• Browser storage: one value, your light or dark theme choice, saved in localStorage under the key theme. It never leaves your device and we cannot read it.
• Hosting: the site is served from Amazon S3 through Amazon CloudFront. Delivering a page requires your IP address and request headers to reach that infrastructure, and Amazon Web Services may keep standard server logs under its own terms.

You can refuse all of it. Any tracker blocker stops the script loading, as does Google's own opt-out add-on. You can turn off Google signals for your own account in your Google ad settings. The site works the same without any of it, and nothing on these pages waits on analytics to render.

The calculator runs entirely in your browser. What you type into it is never sent anywhere, to us or to Google. A configuration you share is encoded in the URL you copy, so it travels only where you send it.

We read the analytics to see which pages are read, where readers arrive from, and how many go on to Swadhin Chat. That is the whole use. We do not advertise and we do not build a profile of you.

Google Analytics keeps this data for 14 months, then deletes it. The cookies last two years unless you clear them.

If you only use the website, nothing we hold points at you, so we cannot find your analytics on request. If you also use Swadhin Chat in the same browser, your visits here may be linked to your account ID, and we can then find them through your account. Blocking the script is the fastest way to stop the collection, and it takes effect at once.

Swadhin Chat lets you sign in and use AI models for text, speech and images, paid for with prepaid credits. To do that it holds personal data the website does not. This part lists all of it.

Your account

• Your email address. It is how you sign in and how we reach you.
• Your password, stored only as a one-way hash. Nobody can read it back, us included.
• Your first and last name, if you add them.
• An account ID: a random string that identifies your account in our systems.
• When you joined, when you last signed in, and whether your email is verified.

What you create

• The messages you send and the replies you receive, kept as your conversation history. A conversation's title is taken from your first message.
• Files you attach to a message, including images and voice recordings you make in the app.
• Images and audio a model makes for you.
• A thumbs up or down you give a reply, and which model it was about.

Credits and payments

• Your credit balance, and a record of every credit added and spent.
• For each request: the model, how much text went in and came out, what it cost, and when. Never the text itself.
• For each top-up: the amount, any GST, Razorpay's order and payment references, its status, and any refund.
• Your automatic top-up setting, if you set one.

We never see your card number, UPI ID or bank details. You enter them into Razorpay's checkout, not ours. We pass Razorpay your email so the checkout is filled in for you.

Security and abuse prevention

• When you sign up or ask for a new code, Cloudflare Turnstile checks that a person is using the browser. Cloudflare receives your IP address and browser details to do this.
• Failed sign-in attempts are counted against your email and IP address for five minutes, to stop password guessing.
• Our web server logs each request: your IP address, the time, the address you asked for, and your browser.
• Technical logs record the time, the account, the model, the outcome and any error. They never contain the text of a message or a reply.

Voice input

If you speak into the message box instead of typing, your browser turns your speech into text with its own speech service. In Chrome that service is Google's, so the audio goes to Google, not to us, and we receive only the text. Where a task uses one of our speech models instead, the audio goes through our server to that model's provider, as section 6 describes.

Analytics in Swadhin Chat

Swadhin Chat uses Google Analytics with the same settings as the website: Google signals on, ad personalisation off. Unlike the website, it sends your account ID to Google as a user ID, so that your visits from different devices count as one person.

It records the pages you open, with any one-time key removed from the address, and what you do there: signing up, choosing a task or a model, sending a message, a reply failing and the reason, copying or regenerating a reply, giving feedback, and starting and completing a top-up. For a message it records the task and the model, never the text. Each top-up carries a unique transaction reference, the amount and the currency.

It never sends your email, name, phone number, or the text of anything you write or receive. Because we hold the account ID, we can connect these analytics to your account. Google cannot, because it never learns who the ID belongs to.

Emails

We email you a code to verify your address, a link when you reset your password, and notices about your account and your credits. We send no marketing email.

Cookies and browser storage

• sessionid keeps you signed in. It lasts two weeks.
• csrftoken protects your account against forged requests from other sites. It lasts a year.
• sidebar_state remembers whether the sidebar is open. It lasts a week.
• _ga and _ga_<id> are Google Analytics's, as in section 2.
• Razorpay's checkout and Cloudflare's check run in frames served by those companies, and may set their own cookies under their own policies.

The short-lived token the chat uses to reach our server is held in memory and never stored.

Everything in section 4 is used only for these purposes:

• to create your account, sign you in, and keep the account secure;
• to run your request: send what you write to the model you chose, return the answer, and keep your history so you can come back to it;
• to keep your credit balance and take and record your payments;
• to stop abuse, such as fake sign-ups, password guessing, and use beyond your credits;
• to meet the law, including tax and accounting duties and lawful requests from authorities;
• to answer you when you write to us; and
• to understand, in totals, how Swadhin Chat is used, so we can improve it.

We process this data because you gave it to us to use Swadhin Chat, and, for tax and accounting records, because the law requires us to keep them.

What we do not do

• We do not sell your data or share it for advertising.
• We do not use your conversations, files or outputs to train any model.
• We do not read your conversations as a matter of course. The people who run Swadhin Chat can open stored conversations through our admin tools. They do so only to answer a request from you, to investigate abuse or a security incident, or where the law requires it.

When you send a message, a file or text to a model, it passes through our gateway to the company that runs that model, and the answer comes back the same way. That company receives the content of your request. We do not send it your name or your email.

Swadhin Chat uses these providers today. Each model in Swadhin Chat names the one behind it.

• Sarvam AI, run by Axonwise Private Limited, in India, for text and speech.
• Yotta, run by Yotta Data Services Private Limited, in India.
• NeevCloud, run by NeevAI SuperCloud Private Limited, in India.
• Cyfuture AI, run by Cyfuture India Private Limited, in India.
• Krutrim, run by Krutrim SI Designs Private Limited, in India.
• Amazon Bedrock, run by Amazon Web Services, Inc., in its Mumbai region.
• Google Vertex AI, run by Google LLC, in its Mumbai region.

Each provider handles what it receives under its own terms for its service. When we add or remove a provider, this list changes in the same release.

• Utho, an Indian cloud company, hosts Swadhin Chat's servers in India.
• Razorpay Software Private Limited takes payments.
• Cloudflare, Inc. runs the sign-up check.
• Zoho Corporation Private Limited sends our email, through its ZeptoMail service.
• Google LLC runs Google Analytics, under its terms for that service, and receives the events and the account ID described in section 4.
• Google LLC also serves the typefaces Swadhin Chat uses, through Google Fonts, and so receives your IP address and browser details when a page loads. The website does not use Google Fonts; its typefaces are served from our own hosting.

Each handles the data only to provide its service to us. Our gateway, which we run ourselves, stores your email and account ID with the key that meters your credits.

We disclose personal data to anyone else only where Indian law requires it, such as a lawful order from a court or a government agency, or where it is needed to protect someone's safety or our legal rights. If the business passes to another company through a merger or sale, your data would pass under this policy, and we would tell you first.

Swadhin Chat's servers run on Utho's cloud in India. The AI providers in section 6 run their models in India.

These services take data outside India:

• Google Analytics, on the website and in Swadhin Chat;
• Cloudflare's sign-up check;
• Google Fonts, in Swadhin Chat; and
• your browser's speech service, if you use voice input in Chrome.

We transfer personal data out of India only as section 16 of the Digital Personal Data Protection Act, 2023 permits, and never to a country the Government of India has restricted.

• Your account: while it is open. After you close it we erase it within 30 days, except what the law requires us to keep.
• Conversations: until you delete the conversation, which removes it from our database at once, or until you close your account.
• Files: until you close your account. Deleting a conversation does not yet delete the files attached to it or made in it. Ask us and we will delete them.
• Payment and credit records: eight years from the end of the financial year they belong to, as the Companies Act, 2013 and India's GST law require. Once your account is closed they are kept apart from everything else and used only to meet those laws.
• Technical and security logs: for 180 days, kept in India, as CERT-In's directions require. From 13 May 2027, when rule 6 of the Digital Personal Data Protection Rules, 2025 applies, for one year. Then deleted.
• Analytics: 14 months, in Google Analytics.

Copies held in backups for disaster recovery are deleted when those backups expire.

The rest of this policy applies to the website and to Swadhin Chat.

Under Indian law you have the right to:

• a summary of the personal data we hold about you, what we do with it, and every company we have shared it with;
• have it corrected, completed or updated;
• have it erased, except what the law requires us to keep;
• withdraw your consent at any time, as easily as you gave it. Withdrawing stops what we do next, not what was lawful before, and without an account we cannot provide Swadhin Chat;
• nominate someone to use these rights for you if you die or cannot act yourself; and
• have a grievance answered by us, and then complain to the Data Protection Board of India if our answer does not settle it.

In Swadhin Chat you can change your name and delete any conversation yourself. There is no button to close your account yet. To close it, or for any other right on this list, write to the Grievance Officer in section 13 from the email address on your account, or tell us that address, so we can confirm the account is yours. We acknowledge a request within 24 hours and answer it within 7 days.

If you only use the website, there is nothing to look up, because nothing we hold identifies you. Section 2 says how to stop the collection yourself.

Neither service is meant for children. Under the Digital Personal Data Protection Act, 2023 a child is anyone under 18.

You must be 18 or older to create a Swadhin Chat account. If we learn that an account belongs to a child, we will close it and erase its data. We do not track or monitor the behaviour of children, or direct advertising at them.

• Both services are served only over HTTPS.
• Passwords are stored as one-way hashes.
• Swadhin Chat's server and database have no public web address of their own. Requests reach them only through the Swadhin Chat web app, over an internal connection.
• Files are never public. Each one is fetched through a route that first checks it is yours.
• Each account has its own key to our gateway, with its own spending limit and rate limit.
• Sign-in attempts are limited, and sign-up is checked by Cloudflare Turnstile.
• Only the people who run Swadhin Chat can reach it in production, and its logs never hold message text.

If a breach puts your data at risk, we will tell you by email without delay: what happened, what it means for you, what we are doing about it, and what you can do. We will report it to CERT-In within six hours of noticing it, as its directions require. From 13 May 2027, when rule 7 of the Digital Personal Data Protection Rules, 2025 applies, we will also report it to the Data Protection Board of India at once, with a full report within 72 hours.

Questions, requests and complaints about personal data go to our Grievance Officer, the same person the Swadhin Chat terms name. We acknowledge a complaint within 24 hours and resolve it within 7 days.

Samyak Jain, Co-founder and Grievance Officer
legal@vibencode.com
Vibencode Private Limited, Plot No. 5, Rose Enclave, Shastri Ward, Sagar, Madhya Pradesh 470002, India

If our answer does not settle it, you may complain to the Data Protection Board of India. Anything else about the site, including a correction to a board, goes to team@swadhin.ai.

The GDPR and the UK GDPR give you the rights in section 10, and also the right to object to processing, to restrict it, and to receive your data in a portable form. You may complain to your local data protection authority.

We rely on performing our contract with you for your Swadhin Chat account, requests and payments; on legal obligation for tax and accounting records; and on our legitimate interests for security and abuse prevention. For analytics cookies your law may require consent, and you can refuse them at any time as section 2 describes. Your data is processed in India, and outside it by the services section 8 names.

When this policy changes, the date at the top moves. If a change affects how Swadhin Chat uses your data, we will tell account holders by email or in Swadhin Chat before it takes effect, as the Swadhin Chat terms promise. Analytics were added to the website on 23 September 2026, and this policy has covered Swadhin Chat since the same day.