Privacy policy

Who we are

Grantha is run by [To fill in: the operator's legal name and address] (“we”). We decide how your personal data is used here, so we are its Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Questions go to support@mygrantha.com.

What we keep, and why

• Your Google account details: your name, email address and profile picture, from Google when you sign in. We use them to sign you in and show whose library it is.
• Your library: papers and their details, notes, tags, collections, highlights, PDFs you upload and the text taken from them, your settings, and AI answers written for you. We keep them so Grantha can show them back to you.
• Your own AI key, if you add one: stored encrypted, used only for your requests, and shown to you only as its last four characters.
• Usage records: when you used AI, which model answered, how much text it used and whether it worked. We use them to run the free trial, keep limits fair and fix problems.

We don't sell your data, show advertising or use analytics or tracking cookies. The app keeps your sign-in and small preferences (such as light or dark) in your browser's own storage; this website keeps nothing.

Who else handles it

We use these services to run Grantha. They handle your data only to do that job:

• Supabase: our database, sign-in and file storage, in [To fill in: the region where the project is hosted].
• Google: sign-in, and Gemini, which writes AI answers.
• Groq and OpenRouter: backup AI services, used when Gemini is busy.
• Cloudflare: hosts this website and the app.
• Crossref, OpenAlex, Semantic Scholar, arXiv and Europe PMC: public catalogues we ask for a paper's details. We send them only what identifies the paper (a DOI, an arXiv id or a title), never anything about you.

When you use AI on a paper, its text (taken from the PDF, never the file itself) or its abstract, and any question or passage you choose, is sent to the AI service. Those services keep and use it under their own terms; on Google's free tier, Google may use it to improve its products. If a paper mustn't leave your hands, don't use AI on it.

AI answers built only from a paper's public text (an arXiv paper or a published abstract) may be shown to the next person who asks about the same paper. They contain nothing about you. Answers from your own PDFs, notes or questions stay yours.

Some of these services are outside India, so your data may be processed in other countries, as the Act allows.

How long we keep it

Until you delete it. Removing a paper removes its files; deleting your account (in Settings → Account) removes your account and everything in your library, including your saved key and usage records. Copies in our service's backups are gone within [To fill in: the backup retention period]. Files from uploads that never finished are cleared out the next time you upload. You can export everything first, at any time.

Keeping it safe

Connections are encrypted, each account can reach only its own data (enforced by the database itself), and saved AI keys are encrypted with AES-256. PDFs are limited to 25 MB each and checked before they're kept.

Your rights

Under the DPDP Act you can:

• ask what personal data we hold about you and how we use it;
• have it corrected, completed or brought up to date;
• have it erased (deleting your account does this);
• withdraw your consent, which means we stop and delete your data;
• name someone to act for you if you die or become unable to;
• complain to us, and then to the Data Protection Board of India.

Our Grievance Officer is [To fill in: a name], at support@mygrantha.com. We reply within [To fill in: a response time, at most what the rules require].

Children

Grantha is for adults. If you're under 18, please don't use it.

Changes

If this policy changes in a way that matters, we'll say so in the app before it takes effect. The terms of use are on the terms page.