Version 2026-10-10
PRIVACY NOTICE
In force from . This is the notice required by the Digital Personal Data Protection Act, 2023.
The short version
You can use every tool without an account. If you choose to create one, we hold your name, email address and mobile number — encrypted — so that you can sign in and we can reach you, and a record of which tools you opened for 15 days. We never record what you put into a tool — not the document, not the prompt, not the text. Nothing is sold, and nothing is shared with anyone for their own purposes.
Who is responsible
FreeYantra is the data fiduciary for the purposes of the DPDP Act. Questions about anything on this page, requests to see or correct what is held, and requests for erasure all go to the contact page, and reach a person.
What is collected, and why
| What | Why | Basis |
|---|---|---|
| Name | So pages can address you | Your consent at sign-up |
| Email address | Signing in, and notices about your account | Your consent at sign-up |
| Mobile number | Recovering your account if you lose access to the address | Your consent at sign-up |
| Password | Proving it is you | Your consent at sign-up |
| Consent record | Showing what you agreed to and when | Required of us by law |
| Which tools you open | Showing you your own recent activity, and keeping the service working | Your consent at sign-up |
| A message you send us | Reading it and replying to you | You asked us to |
| Server logs | Keeping the site working | Our legitimate operation of the service |
What is not collected
- Anything you type into a tool. The Prompt Generator, the Prompt Testing Kit and the syntax highlighting all run in your browser and send nothing anywhere. The Document Summarizer runs on our server and keeps nothing after the response.
- Anything that says who an anonymous visitor is. Pages served are counted — one running tally for the site, and one for each tool, recipe, Claude Kit template and blog post, of the form "this page, this day, this many". Nothing is attached to it: no account, no IP address, no hash of one, no cookie, no session, no browser fingerprint. Two visits cannot be told apart from one visitor arriving twice, by us or by anybody holding the database. Copies of each Claude Kit template are counted the same way, a number per template with nobody attached. The site's total number of visits and each template's copy count are shown to everyone; the per-page counts are seen only by an administrator.
- Analytics and advertising. No tracking scripts, no pixels, no third-party cookies, and nothing sent to anybody else's analytics service — the counters above are a number in our own database and go nowhere. The only cookies this site sets are the one that keeps you signed in and a short-lived one during a Google or Microsoft sign-in.
- Your IP address. It is used to serve the request and then it is gone. The consent record keeps a one-way hash of it, which can confirm a guess and cannot be turned back into an address.
The activity record
When you are signed in we record four kinds of thing: that you signed in, that you opened a tool, that you ran one, and that you downloaded a file. Each entry is the action, the tool and the time — four columns and nothing else.
What a tool is given is never part of it. That the summariser ran is recorded; the document is not, and never has been. The same goes for the text you turn into speech and every prompt you write. That boundary is the one thing on this page we would not move.
Entries are deleted after 15 days, automatically — not when somebody remembers. You can see your own at any time on your profile; it is the complete list, not a summary of it.
How it is protected
Your name, email address and mobile number are encrypted with AES-256-GCM before they reach the database. There is no column anywhere holding a readable email address, so a copy of the database — a backup, a restore onto a laptop, a leak — is not a list of anyone's contact details. To find your account at sign-in without decrypting everyone else's, we store a keyed one-way fingerprint of your address alongside it.
Your password is hashed, not encrypted. The difference matters: encryption can be undone by whoever holds the key, and hashing cannot be undone by anybody. Nobody here can tell you what your password is, which is the point.
If you write to us
The contact form needs no account. Your name, your address and the message itself are encrypted the same way everything else is, and used only to reply. A message is not attached to your account, even if you have one with the same address — a support request is not part of your profile.
We send one automatic email to the address you give, confirming the message arrived. It repeats nothing you wrote — not your name, not your message. When we answer, the reply is emailed to the same address with your original message quoted, and a copy of our reply is kept with your message, encrypted the same way, so whoever picks it up next can see what was already said.
It is not added to any mailing list. If you would rather we did not keep it once the matter is closed, say so in the message and we will delete it, replies included.
If you join the newsletter
You can subscribe without an account. We keep your email address, encrypted, the date, which form you used, and the version of this notice in force — nothing else, and it is not linked to an account even if you have one.
Nothing is sent until you confirm: we email once with a link, and an address that is not confirmed within seven days is deleted. Every email has an unsubscribe link, and unsubscribing deletes your address — it is not kept on a "do not mail" list. The emails go out through our email provider (Hostinger).
If you use the chat assistant
The chat assistant answers questions about FreeYantra. To produce an answer, your question is sent to an AI service provider, which processes it and returns a reply; we ask it not to store the conversation, and it does not use it to train its models. FreeYantra does not save your questions or the answers. The conversation stays in your browser tab and is cleared when you close it.
Please do not type personal details — names, email addresses, phone numbers, passwords — into the chat. For anything about your account or your data, use the contact form instead.
Who at FreeYantra can see your details
A small number of named administrators, through an internal portal. Being honest about the limit of encryption here: it protects your data against a stolen database, not against this application, which necessarily holds the keys.
So the portal is built to make that access deliberate and accountable. Lists show masked addresses; the full value appears only on your own record and in an export. Every time an administrator opens your record, looks you up or downloads data, it is written to an audit log — before the data is shown, not after. Who may do this is set in the deployment's configuration, not by a button anybody can press.
Who else sees it
Nobody buys it, and nobody is sent it for their own purposes. Two third parties are involved only if you choose them:
- Google or Microsoft, if you sign in with them. They tell us your name, email address and an account identifier. They are not told what you do here.
- The hosting provider running the servers, which can necessarily see traffic reaching them.
- An AI service provider, only if you use the chat assistant: it receives your question to produce the answer, as described above.
- Our email provider (Hostinger), only if you write to us: it carries the confirmation and our replies to your address, as any mail service must.
How long it is kept
Closing your account disables it and keeps your details. Your name, email address and mobile number stay in our records, encrypted, with your name marked as closed and the date. You are signed out everywhere, you cannot sign in again, and you stop receiving anything from us — but this is not erasure, and we would rather say so than call it one.
If you want your details erased rather than kept, ask us. That is a right the DPDP Act gives you, it is permanent, and there is a button for it — it removes the name, address, number, sign-ins, consent record and activity history with nothing left to restore from. All that survives is a line in our internal audit log saying an administrator did it, carrying an account identifier and no personal detail.
Activity entries are deleted after 15 days whether or not you close your account. Messages sent through the contact form are kept separately, because they were not part of your account — ask and we will delete those too. Server logs are short-lived and contain account identifiers rather than personal details.
What you can do
- See what is held — all of it is on your profile.
- Withdraw consent to emails — one button on the same page, effective immediately.
- See your activity — the full 15-day record, on the same page.
- Close your account — on that page. It disables it and keeps your details.
- Have your details erased — ask us. Permanent, and free.
- Correct something — not self-service yet; ask us and we will do it.
- Complain — to us first, and to the Data Protection Board of India if we have not fixed it.
Children
Accounts are for adults. The DPDP Act requires verifiable parental consent for a child's data and this site has no way to obtain it, so please do not create an account for anyone under 18. The tools themselves currently need no account, and using one collects nothing about whoever is using it — so there is an age-free route through this site, and it is the one to take.
If this notice changes
The version at the top changes with it, and the version you agreed to is stored with your consent record — so what you accepted stays answerable even after this page has moved on. A change that affects what we do with your data will be put in front of you rather than quietly published.