Privacy Notice

Version 2026-10-10.2 · Effective 10 October 2026

This notice explains what personal data Shamaaya processes, why, who receives it, and the rights you have. It is written to meet the requirements of India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it.

In short

No accounts. We don’t ask for your name, email or phone number.
Your chats are saved only on your own device, not on our server.
To write a reply, your conversation is sent securely to our server and on to Anthropic (USA), the AI provider. They do not use it to train AI models.
No advertising, no cross-site tracking, no selling of data. We keep anonymous usage statistics, such as how many messages are sent each day, but never what you write.
You can delete your chats, or withdraw consent and erase everything, at any time from the Shamaaya menu.

1. Who we are

Shamaaya is a non-commercial project operated from India. For the purposes of the DPDP Act, we are the “Data Fiduciary” for personal data processed through Shamaaya. You can contact us, and our Grievance Officer, at contact@setu.com.

2. What personal data we process

Your conversations: the messages you write and Shamaaya’s replies. What people share with Shamaaya can reveal sensitive matters such as religious beliefs, emotional wellbeing or health. Please share only what you are comfortable with, and avoid identifying details like full names, phone numbers, addresses or ID numbers.
Technical data: your IP address, browser and device type, and the times of your requests. These are processed automatically when your device connects to our server and to the providers that deliver fonts and page scripts.
Usage statistics: each time you send a message, we record the date and time, a random identifier your browser creates for this purpose, a random identifier for the chat, whether the reply succeeded and how long it took, and its length in tokens (to estimate our costs). These identifiers are not linked to your name, phone number or IP address. We never record the text of your messages or of Shamaaya’s replies.
Voice input (optional): if you tap the microphone button, your browser’s built-in speech recognition turns your speech into text. Depending on your browser, the audio is processed by Google (Chrome) or Apple (Safari) under their own privacy policies. Shamaaya never receives or stores audio; only the text you choose to send reaches us, as a normal message.
Read aloud (optional): if you tap “Read aloud”, a voice built into your device reads the reply. Shamaaya prefers voices that run on your device; if your browser only offers online voices (for example, some Google voices in Chrome), the reply text is sent to the browser maker to create the audio. Shamaaya never receives any audio.
Stored on your device only: your saved chats, the access passcode, the random identifier and a record of the consent you gave. These are kept in your browser’s storage. Only your conversation (when you ask for a reply) and the random identifiers are ever sent to us.

3. Why we process it

to generate Shamaaya’s replies to your messages;
to keep the Service secure and working, for example passcode checks, rate limits to prevent abuse, and error diagnosis;
to understand, in aggregate, how Shamaaya is used (for example, how many messages are sent each day and how often people return) so we can improve it and manage its costs.

We do not use your data for advertising, profiling or marketing, and we do not sell it.

4. Consent

We process your personal data on the basis of your consent, which you give on the “Before you begin” screen. Your consent is voluntary, but Shamaaya cannot reply to you without processing your messages. You can withdraw consent at any time using “Withdraw consent & erase data” in the Shamaaya menu. That erases your chats, passcode, random identifier and consent record from your device, deletes the usage statistics linked to that identifier from our database, and stops further processing. Withdrawal does not affect processing that happened before it.

5. Who receives your data

We share your data only with service providers who process it on our behalf to run Shamaaya:

Anthropic, PBC (USA), which provides the Claude AI model that writes the replies. Your conversation is sent to Anthropic each time you send a message. Under its commercial terms, Anthropic does not train its models on this data. It may keep it for a limited period for safety and abuse monitoring, as described in Anthropic’s Privacy Center.
Render Services, Inc. (USA), which hosts our server. Your conversation passes through our server, which does not store it. Our server logs record technical data (such as IP address and request times, never message text), and our host keeps these logs for a limited period.
Neon (database hosting), which stores the usage statistics described above. It never receives your messages.
Google or Apple (voice input only), through your browser’s speech recognition, if you choose to use the microphone button. They receive the audio of what you dictate, never your other messages.
Google Fonts and jsDelivr, which deliver the fonts and page scripts Shamaaya uses. When your browser loads them, these providers receive your IP address and browser details. They never receive your messages.

We may also disclose data where required by law, for example to comply with a lawful order of a court or government authority.

6. Transfers outside India

Our providers process data outside India, mainly in the United States. The DPDP Act permits such transfers except to countries restricted by the Government of India. We will stop any transfer that becomes restricted.

7. How long we keep it

Chats: on your device until you delete them, clear your browser data, or withdraw consent. We keep no copy on our server.
Usage statistics: kept for up to 12 months, then deleted automatically.
Server logs: kept by our host for a limited period, then deleted automatically.
Data held by Anthropic: kept for the limited period described in its policies, then deleted.

8. Your rights

Under the DPDP Act you have the right to:

get a summary of the personal data we process about you and the processing we do;
have your personal data corrected, completed, updated or erased;
have a readily available way to raise grievances with us;
nominate another person to exercise your rights if you die or become unable to.

Because your chats are stored only on your device, you can erase them yourself at any time from the Shamaaya menu. To exercise any other right, email contact@setu.com. We do not hold your name or contact details, so we may ask for information, such as the approximate time you used Shamaaya, to locate data our providers hold.

9. Grievances and complaints

If you have a concern about how your personal data is handled, contact our Grievance Officer at contact@setu.com. We will acknowledge your complaint within 24 hours and respond within the time required by law. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

10. Children

Shamaaya is only for people aged 18 or over. We do not knowingly process the personal data of children. If you believe a child has used Shamaaya, please contact us.

11. Security

Connections to Shamaaya are encrypted (HTTPS), access requires a passcode, and our server does not store conversations. Your saved chats live in your browser, so anyone who can use your device and browser may be able to read them. Please use a device lock, and delete your chats if you use a shared device. If a personal data breach affects you, we will notify the Data Protection Board of India and, where we can, inform you, as the law requires.

12. Changes to this notice

If we change this notice in a material way, we will update the version and date above and ask for your consent again before you continue using Shamaaya.