Privacy Policy

Effective date: 28 September 2026

Operator: Vachix, a sole proprietorship operated by Alok Kashyap (“Vachix”, “we”, “us”).

This policy covers both the Vachix website at vachix.com and the Vachix Android app (com.vachix.vachix_app), together with the backend service they connect to. One policy governs both so they cannot drift apart.

1. What we collect

• Account data: your email address, your name if you provide one, and a hashed password. Your password is never stored in readable form.
• Voice recordings: when you use a speaking or interview feature, we record short audio clips from your microphone. This happens only after you grant microphone permission and start a practice turn. See Section 3.
• Practice content and activity: text transcripts of your sessions, scores, feedback, streaks, usage counts, and which features you use.
• Push notification token: in the Android app, if you allow notifications, the Firebase Cloud Messaging token for your device. It is removed when you sign out or delete your account.
• Crash and diagnostic data: in the Android app, if it crashes, Firebase Crashlytics collects a stack trace, device model, OS version, and a pseudonymous app-instance identifier. On the website and backend, if an error occurs, Sentry collects diagnostic details about it — such as the error message, a stack trace, and technical context — so we can fix it.
• Usage analytics: on the website, with your consent, we collect product-usage events such as page views and which features you interact with, through PostHog, to understand and improve the product. You can decline analytics cookies and the product continues to work.
• Payment data: order IDs and plan status only. For subscriptions bought in the Android app through Google Play, we also store the Google Play order ID, purchase token, and subscription state so we can confirm and renew your plan. Card and payment-instrument details are handled entirely by our payment providers (Razorpay, Dodo Payments, or Google Play) — we never see or store them.
• IP address and approximate location: when you sign in, we record the IP address of the request and, from it, an approximate city-level location and network provider. The lookup is done on our own servers and your IP is never sent to a third-party location service. We use this to protect accounts against abuse and to understand, in aggregate, where our users are. This is coarse, city-level information — not your precise or GPS location.

We do not collect your contacts, precise location, photos, files, calendar, SMS, or call logs. The Android app requests exactly three permissions: Internet, Microphone, and Notifications.

2. How we use your data

• Provide and personalise interview practice and English coaching
• Transcribe your speech and generate the coach’s written and spoken replies
• Track your progress, streaks, and weak areas over time
• Send transactional and reminder messages (verification, password reset, receipts)
• Process payments and manage your plan
• Diagnose crashes and improve stability
• Understand how the product is used, with your consent, to improve it

We do not use your data for advertising and we do not sell it. We do not train any AI model on your data — the coaching is produced by third-party model providers listed in Section 5, and we build no models of our own.

3. Voice recordings — how they are processed and stored

1. When you start a practice turn, a short audio clip is recorded.
2. It is uploaded over an encrypted connection to our backend, which forwards it to a speech-to-text provider to convert it into text.
3. The transcript is used to generate feedback and a spoken reply, and is saved as part of your practice history so you can review your progress.
4. If you use the avatar video feature, audio is also sent to our avatar provider to render a lip-synced video for the duration of the call.

Our servers do not store your audio. Uploaded audio is held in memory only for as long as transcription takes and is never written to disk or object storage. The resulting text transcript is retained as part of your account history (Section 8). Audio is transmitted to the providers named in Section 5, whose own handling is governed by their terms.

4. Cookies and local storage

The website uses strictly necessary cookies to keep you signed in and to protect sign-in from abuse. With your consent, we also set analytics cookies (PostHog) to understand how the product is used and to improve it; you can decline them and the product continues to work. We use no advertising or cross-site tracking cookies. The Android app uses no cookies; it stores your access tokens in Android Keystore-backed secure storage on your device.

5. Who we share data with

We do not sell your personal data and we do not share it for advertising. We send the minimum necessary to service providers that process it on our behalf so the product can work. Each provider’s handling of that data is governed by its own terms and privacy policy, which we link where available:

• Groq — AI language-model inference and speech-to-text. Your practice text and audio are sent to generate coaching responses and transcripts.
• OpenAI — fallback language model and text embeddings.
• Sarvam AI — text-to-speech and Indian-language voice. The text of the coach’s replies is sent to synthesise spoken audio.
• Google (Gemini) — live voice conversations in English and other supported languages. During a live voice session your microphone audio is streamed to Google to produce the spoken reply.
• Simli — AI avatar video. When you use the avatar feature, audio is sent to render a lip-synced video call.
• Razorpay — payment processing. Card details go directly to Razorpay and never reach us.
• Dodo Payments — payment processing for purchases made outside India on the website. Payment details go directly to Dodo Payments and never reach us.
• Google Play — subscriptions bought in the Android app are billed by Google Play. We receive the order ID, purchase token, and subscription status from Google to grant and renew your plan; your payment details stay with Google.
• Google Firebase — push notifications, crash diagnostics, and sign-in abuse protection for the Android app.
• PostHog — product analytics. With your consent, usage and interaction events on the website (page views and which features you use) are sent to help us understand and improve the product.
• Sentry — error monitoring. When something goes wrong on the website or backend, diagnostic details about the error (error message, stack trace, and technical context) are sent so we can find and fix it.
• Supabase — database and authentication infrastructure.
• Railway and Cloudflare — backend hosting and website delivery.

We may also disclose data where required by law, or to protect the rights, safety, and security of our users and the service.

6. Data storage and security

• Account and practice data is stored on Supabase infrastructure in secure data centres.
• All data in transit is encrypted with TLS. The Android app disables cleartext traffic, so it only communicates over HTTPS and WSS.
• Passwords are hashed and never stored in readable form.
• Access tokens are held in Android Keystore-backed secure storage on the device.
• We do not log full request bodies or coaching conversation content in production logs.

7. Your rights

Whatever the law requires of us at a given time, these are rights we give you now:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your account and associated data;
• export your practice history;
• control permissions — you can revoke microphone or notification access in your device settings at any time. The affected features stop working; the rest of the product continues.

To exercise access, correction, or export, email support@vachix.in.

8. Data retention

• Account and practice data is retained while your account is active, and permanently erased within 30 days of you deleting your account.
• Voice recordings are processed transiently and never stored by us (Section 3).
• Push token is removed when you sign out or delete your account.
• Crash diagnostics are retained by Firebase for a limited period (up to 90 days by default) and then deleted automatically.
• Payment records are retained for as long as Indian tax and accounting law requires, with the account link removed. These records contain no name or email.

9. Deleting your account and data

You can delete your account in two ways:

• In the app: Profile → Delete account, then confirm.
• On the web: follow the steps at vachix.com/account-deletion, or email support@vachix.in from your registered address.

Deletion removes your account, transcripts, scores, usage data, and stored push token. It cannot be undone. See Section 8 for timing.

10. Children and age

Vachix is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact support@vachix.in and we will delete it promptly.

11. Changes to this policy

If we make a material change we will update the effective date above and, where required, notify registered users by email before it takes effect.

12. Contact and grievances

We handle personal data under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. The Digital Personal Data Protection Act, 2023 has been enacted but its substantive obligations are not yet in force; we will meet them when they commence. For privacy questions, data requests, or grievances, contact our Grievance Officer:

• Name: Alok Kashyap
• Email: support@vachix.in

We acknowledge grievances within 48 hours and respond within 30 days.