Privacy Policy

We collect the minimum information needed to run your account, bill you correctly, and operate transcription and AI features. We do not sell your data. We do not retain raw audio. Transcripts and AI chats are stored on your own device by default.

• Account data: Email address, password (stored as a salted bcrypt hash — we never see your plaintext password).
• Billing data: Order IDs, amount, pack purchased, payment method type (UPI / card / net-banking) returned by the payment gateway. We do not store full card numbers, CVV, or bank credentials.
• Usage metering: Per-feature credit consumption (transcription minutes used, AI requests made) for billing reconciliation.
• Technical logs: Backend access logs (IP, timestamp, endpoint, response code) retained for 30 days for abuse prevention and debugging.

When you enable transcription, audio captured on your device is streamed live over an encrypted WebSocket to our backend, which forwards it to our speech-to-text provider (Deepgram). We do not persist raw audio on our servers — it is relayed in real time and discarded.

Final transcripts and AI conversations are stored locally on your device in the application's database (IndexedDB). They are not uploaded to our servers unless you explicitly export and send them.

When you send a question to the in-app AI assistant, the prompt (and any image you attach) is sent to our backend and processed by our AI provider (Anthropic Claude). We retain the prompt only for the duration of the request. Our AI provider may retain the request briefly per their own policies for safety and abuse detection.

• Deepgram — speech-to-text provider (audio streamed in real time, not retained by us).
• Anthropic — AI assistant provider for the side-panel.
• Razorpay / Instamojo — payment gateways. Card and bank details are entered on their secure pages; we receive only an order status and payment method type.
• AWS — hosting infrastructure (servers in ap-south-1, Mumbai region) and installer file storage.

Our website uses localStorage to keep you signed in between visits. We do not use third-party analytics or advertising cookies on crackfy.com today. If we add analytics in the future, this policy will be updated and you will see a banner on first visit.

• All traffic between your device and our servers is encrypted (TLS 1.2+).
• Passwords are stored only as bcrypt hashes, never in plaintext.
• Database access is restricted to our backend service over a private network.
• Authentication uses signed JWT access and refresh tokens, with short expiry on access tokens.

You can:

• Access your account data and billing history through the in-app dashboard.
• Export local transcripts and AI conversations from the app.
• Delete your account and associated data by emailing hi@crackfy.com. We process deletions within 7 business days, except for billing records we are required by Indian tax law to retain.

Crackfy is not directed at children under 18. If you believe a minor has created an account, please notify us and we will delete the account.

We will update the "Last updated" date at the top of this page when we make changes. Material changes will be communicated by email or in-app notice.

Privacy questions: hi@crackfy.com