Privacy policy

• Account: your Google account's email address, name, profile photo and account ID (you sign in with Google; we never see your Google password), and an optional display name and avatar URL you set.
• What you learn: what you tell the course interview (topic, goals, level, preferences), the courses and lessons built for you, your progress and study time, quiz answers and scores, flashcard reviews, personal rewrites, feedback ratings, and your conversations with the tutor and Ask.
• Plans and payments: your plan, credit usage, and the subscription and payment IDs and statuses Razorpay sends us. Card, UPI and bank details go to Razorpay directly; we never see or store them.
• Technical: server logs (request paths, times and errors), your IP address for rate limiting and security, and your approximate country (from your connection or your browser's time zone) to show the right price.
• On your device: a sign-in cookie and, during Google sign-in, a short-lived security cookie. Your theme, accent colour and panel layout are kept in your browser's local storage. There are no advertising or analytics cookies; the Cookie policy lists each one.

• To provide the service: research and write your courses, run the tutor, quizzes and flashcards, and track your progress (performance of our contract with you).
• To run your plan: measure AI credits, process subscriptions through Razorpay, and show you how many days are left before a course is deleted.
• To keep Crafyu secure and working: preventing abuse, fixing errors, and understanding costs.
• To meet legal obligations, such as tax and accounting records for payments.

We don't use your courses or conversations to train AI models, and we don't sell or rent personal data.

We share only what each service needs to do its job:

• DeepSeek (AI model provider, based in China) receives the text needed to write courses and answer you: your course brief and interview answers, lesson drafts and sources, and your tutor questions. It doesn't receive your email address or payment details.
• Web search and source sites (such as DuckDuckGo, Tavily or Brave) receive search queries based on your course topic, and the pages we read for research. Wikimedia Commons serves some lesson images, so your browser loads them from Wikimedia.
• Razorpay processes payments and subscriptions.
• Google, for sign-in.
• OVHcloud hosts our servers and backups in India.

Some of these providers process data outside India. We use them only as needed to provide Crafyu, and you can avoid sharing anything sensitive with the tutor or the course interview.

• Free courses are kept for 30 days. Pro courses are kept while you're subscribed, and for 60 days after Pro ends. Each course shows how many days it has left.
• Your account and learning data are kept until you delete your account (Settings → Account & security). Deleting your account removes your courses, progress, conversations and personal settings straight away. Records of AI usage costs are kept without any link to you, and payment records are kept as long as tax law requires.
• Encrypted database backups are kept for up to 70 days, so deleted data disappears from backups within that time.
• Server logs are rotated and kept for a short period for security and debugging.

You can ask to access, correct or erase your personal data, withdraw your consent (by deleting your account), and nominate someone to exercise these rights for you. You can change your profile and preferences in Settings, and delete your account there at any time. For anything else, email hello@crafyu.com. We aim to reply within 7 days, and to resolve requests within 30 days.

If you're not satisfied with our response, you can complain to the Data Protection Board of India.

Grievance Officer, reachable at hello@crafyu.com. We acknowledge grievances within 48 hours.

Connections are encrypted (HTTPS). You sign in with Google, so we hold no passwords. Sign-in cookies are HTTP-only, and the database is reachable only inside our private server network. Backups are encrypted before they leave the server. No system is perfectly secure; if a breach affects you, we'll notify you and the authorities as the law requires.

Crafyu is for people aged 18 and over. If you are under 18, use Crafyu only with a parent or guardian who agrees to these terms on your behalf. If you believe a child has given us data without that consent, email hello@crafyu.com and we will delete it.

We'll update this page when our practices change, and email you about significant changes. Using Crafyu after a change means you accept the updated policy. See also our Terms of service.