Legal

Privacy Policy

Last updated: 15 October 2026
Applies to: the Vyomara Voice Windows app (the "App"), the website https://voice.vyomara.com (including its sign-in page), and the download page https://voice.vyomara.com/#download. Installer files are served from releases.voice.vyomara.com.

Summary

• Who we are. Vyomara Voice is made by Ajoy Chetri, a sole proprietor trading as Vyomara™, based in Assam, India. In this policy, "we", "us" and "Vyomara" mean Ajoy Chetri trading as Vyomara.

• What we keep on our server.

  • your email address, and, if you sign in with Google, your Google name, profile picture link and Google account ID
  • your plan and quota
  • usage numbers for each dictation: how long it was, how fast it was processed, how many words, whether it worked, and what it cost us
  • a scrambled (hashed) ID of your PC
  • the IP address and browser or app details of each signed-in session.

  We do not save your audio or your text on our server.

• Where your voice goes. On the free plan, each recording passes through our server to Groq (USA), which turns speech into text. If Groq is busy or unavailable, it goes to OpenRouter (USA) instead. Cleanup goes to OpenRouter, with Groq as a backup if OpenRouter is slow. Groq has zero data retention switched on for our account, and we have set OpenRouter to use only providers that don't keep or train on your audio or text. If you use your own OpenRouter key (Pro plans only), your audio goes from your PC straight to OpenRouter under your own OpenRouter account, and never touches our server.

• What stays on your PC.

  • your last 50 cleaned-up dictations (not encrypted), which you can clear in the App
  • any recording that failed, until a retry works
  • your settings, and your own OpenRouter key if you added one (encrypted where Windows allows)
  • local log files with numbers about each dictation. Older versions of the App also kept the text of dictations in log files (see section 9).

  Uninstalling the App does not delete these files.

• No ads, no selling. We don't sell your data, show ads, send marketing emails, use analytics, or use marketing cookies.

• Your rights. You can see, correct or delete your data, and withdraw consent, by emailing hello@vyomara.com. We acknowledge within 48 hours and resolve within 30 days.

1. Who is responsible for your data

• Who decides. We decide why and how your personal data is used. Under India's DPDP Act this makes us the "Data Fiduciary". Under the GDPR it makes us the "controller".
• No DPO. We are a one-person business. We haven't appointed a Data Protection Officer, because the law doesn't currently require one for a business of our type and size.
• What this policy covers. It covers the App, the website and our server. It doesn't cover Google, Groq, OpenRouter, AI providers or payment providers when they use data for their own purposes. Their own privacy policies apply to that.
• One Vyomara login. Vyomara Voice and Vyomara Portal share one sign-in system and database. If you use both with the same email address, you have one shared Vyomara login. Your Vyomara Voice data is kept separately from your Vyomara Portal data, and this policy covers the Voice data. Vyomara Portal's own policy covers the data Portal uses. Deleting your Vyomara Voice account doesn't delete your Portal data (see section 8).

2. What personal data we collect

2.1 When you sign in

You sign in on our website, in your browser, and the website then hands the sign-in back to the App. You can sign in in two ways:

• With Google. Google shares your email address, your name, a link to your profile picture, your Google account ID, and whether Google has verified your email. We ask Google only for this basic profile and email information. We don't ask for any other permissions.
• With an email link. You type your email address and we email you a one-time sign-in link. We store your email address and whether it has been confirmed.

Our sign-in provider, Supabase, also records:

• when your account was created and when you last signed in
• for each signed-in session, the IP address and the browser or app details (the "user agent") it was started from
• the sign-in tokens that keep you signed in.

What we never get. We never get your Google password, contacts, files, calendar or anything else from your Google account.

2.2 When you dictate

• Your audio and the text made from it.
  • Free plan: each recording is sent from the App to our server (Supabase Edge Functions), which passes it on to Groq, OpenRouter and the AI providers listed in section 5. The App also sends the cleanup instructions, which include any project instructions you've written in the App's settings. The cleaned-up text comes back the same way.
  • Our server only relays your audio and text and never saves them. Our server code never writes audio, text, prompts, API keys or sign-in tokens to its logs. It logs only short, fixed error codes (for example "the AI service didn't respond").
• Usage data we do store, for each dictation:
  • a session ID and the time
  • how long the recording was
  • how long processing took (latency)
  • word count
  • whether it worked or failed, and a short reason code if it failed
  • what the AI processing cost us
  • which AI provider handled it, and whether a backup was used
  • your language and output setting
  • the App version.
• Plan and quota data: your plan, how much of your free allowance you've used in the current period, your limit, and any limit we've set for your account by hand. We also record events such as reaching 80% or 100% of your allowance.

2.3 To stop abuse of free minutes

When the App talks to our server, it sends a hash (a one-way scrambled code) made from your PC's Windows machine ID. We store that hash next to your account, with the first and last time we saw it. This lets us spot when one PC is used to create many accounts to get extra free minutes.

• We cannot turn the hash back into your machine ID.
• The machine ID itself never leaves your PC.
• Today we only use the hash to detect abuse. We don't block anyone because of it. If we start using it to block repeat sign-ups, we will update this policy first.

2.4 Technical and security logs

Our hosting and sign-in providers, Supabase and Cloudflare, keep short-term technical logs to run the service and keep it secure, as all web services do. These logs can include:

• your IP address
• the time of the request
• the type of request
• error codes.

Our own server code adds only the fixed error codes described in 2.2. The small piece of code that works out your price region (2.6) writes no logs at all.

2.5 App updates

The App checks our download server (releases.voice.vyomara.com) for new versions shortly after it starts, and when you click "Check for updates". If there is a new version, the App downloads it and installs it when you quit the App.

• What the check sends. It's an ordinary web request for a small file that lists the latest version. Like any web request, it reveals your IP address and basic technical details of the request to Cloudflare, which runs that server.
• What it doesn't send. It doesn't send your account details, your email or your device hash.
• The App writes a note about each update check to a log file on your PC (see section 9).

2.6 When you visit our website

• Hosting and downloads. The website is hosted on Cloudflare Pages, and the installer is downloaded from Cloudflare R2. To deliver and protect the site, Cloudflare processes technical data about each visit, such as your IP address, browser type and the pages you request.
• Price region. To show prices in the right currency, the site asks our server which region you are in. Cloudflare works out your country from your IP address. We use only "India" or "international", and our server doesn't store or log it. Your browser remembers the result (see section 12).
• Sign-in page. The sign-in page loads the Supabase sign-in code from jsDelivr, a public code-delivery network. Your browser connects to jsDelivr to fetch it, so jsDelivr receives your IP address. The page then talks directly to Supabase to sign you in.
• Fonts. At the moment, our website, sign-in page and App load their fonts from Google Fonts, so your browser or the App connects to Google, and Google receives your IP address. We plan to host the fonts ourselves, and will remove this point when we do.
• No analytics, no marketing cookies. We don't use website analytics, and we use no marketing or advertising cookies or pixels.

2.7 When you contact us

If you email us, we keep your email address, your message and our reply, so we can help you and keep a record.

2.8 When you buy Pro

This section applies once Pro can be bought. Payments are handled by our payment provider, which is named at checkout.

• What the payment provider collects. It collects your card, UPI or bank details directly. We never see your full card number or UPI PIN.
• What we receive:
  • your name and email
  • the amount, currency, date and status of the payment
  • a payment or subscription ID
  • possibly your billing country, state or address, for tax invoices.

2.9 Voice recordings and sensitive information

Your voice recordings are personal data.

• We don't identify you by your voice. We use your voice only to turn speech into text. We do not create a voiceprint or use your voice to recognise who you are.
• The law may still treat voice as sensitive. Some laws treat voice as sensitive even so. For example, India's IT Rules 2011 list "voice patterns" as biometric data. So we ask for your express consent before we process recordings (see section 13.2).
• What you say is up to you. Your dictations may contain anything you choose to say, including health, financial or other sensitive details. Please think about this before dictating highly sensitive material, especially on the free plan, where it passes through third-party AI providers.

2.10 What we don't collect

• We don't collect your contacts, files, precise location or browsing history.
• We don't use advertising IDs.
• No crash reporting, analytics or telemetry. The App contains no crash-reporting, analytics or tracking tools. When something goes wrong, the App writes it only to log files on your PC (section 9). Those files are never sent to us automatically. If you choose to send us one to help fix a problem, we treat it like a support email (section 8).

3. Why we use your data

We do not:

• sell your data
• use it for advertising
• build marketing profiles
• use your audio or text to train AI models, or let our AI providers train on it (see section 5).

Emails. We send only service emails, such as sign-in links, security notices, receipts and policy changes. We don't send marketing or newsletters. If we ever do, we will ask you first, and every marketing email will include an unsubscribe link. We may occasionally ask for feedback about the App. Replying is always optional.

If we want to use your data for a purpose not listed here, we will update this policy and, where the law requires, ask for your consent first.

4. How dictation works: your two options

Free plan:
Your PC → our server (Supabase Edge Functions) → Groq (USA) or OpenRouter (USA) → AI provider → back to your PC.
Our server keeps the usage data listed in 2.2, but never the audio or text.

Bring your own key (BYOK), available on Pro plans:
If you add your own OpenRouter API key, the App sends audio, text and your project instructions directly from your PC to OpenRouter, using your own OpenRouter account. It skips our server. In that case:

• your own agreement with OpenRouter, and OpenRouter's privacy policy, apply to that data
• your own OpenRouter privacy settings decide which AI providers are used and whether they may keep or train on your data. Our zero-data-retention setting (section 5) applies only to our account, not yours
• we don't receive your audio, your text, or usage numbers for those dictations. The App still contacts our server to keep you signed in and to check your plan
• your key is stored on your PC, encrypted where Windows allows (see section 9), and is never sent to us.

5. Who we share data with

We share only what each service needs to do its job:

Sign-in emails are sent by our login provider, Supabase.

How these providers handle data. We use these providers under their standard business terms, which include data-protection commitments (see section 7).

• Payments. The payment provider acts as an independent company for the payment data it collects, under its own privacy policy and banking rules.
• No keeping or training by AI providers. Groq: we have switched on Groq's zero data retention for our whole account, so Groq doesn't keep our audio or text, not even for its usual reliability and abuse checks, and its terms don't allow it to train on our requests. OpenRouter: we have set OpenRouter to use only providers that don't keep or train on prompts and outputs (zero data retention), and OpenRouter doesn't store the content of our requests. So your audio and text are processed only to return your result, then discarded. OpenRouter keeps basic details of each request, such as the time, model used and cost, for billing.
  • Groq's data policy: https://console.groq.com/docs/your-data
  • OpenRouter's provider data policies: https://openrouter.ai/docs/features/privacy-and-logging

Other cases. We may also share data:

• if the law requires it, for example a valid order from a court, government agency or the Data Protection Board
• to protect our rights, users or the public, for example to stop fraud or prevent harm to someone
• with a buyer or successor if the business is ever sold, merged or transferred. We will tell you before your data is transferred and becomes subject to a different privacy policy.

We don't share your data with anyone else for their own marketing.

6. Google user data

Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements:
https://developers.google.com/terms/api-services-user-data-policy

In practice, this means:

• Purpose. We use your Google name, email, profile picture link and account ID only to sign you in, run your account and contact you about the service.
• No ads or selling. We don't use them for advertising, sell them, or let people read them except as needed for security, legal reasons or support you ask for.
• No AI training. We don't use them to train AI models.

Google's own use of your data is covered by Google's privacy policy.

7. International transfers

We are based in India, and our database is in Mumbai, India.

• Free-plan dictation. Your audio and text are sent outside India, mainly to the United States, to Groq, OpenRouter and the AI providers above. Our relay may also run in a Supabase region outside India that is closer to you.
• Global networks. Cloudflare, jsDelivr and Google run global networks, so website and sign-in data may be handled in many countries.

India. Indian law currently allows these transfers. We will follow any restrictions the Government sets on transfers to particular countries under section 16 of the DPDP Act.

EU, EEA, UK and Switzerland. The laws there don't treat India or the US as giving "adequate" protection in general. When your data moves to our providers, we rely on recognised safeguards, such as:

• the European Commission's Standard Contractual Clauses
• the UK International Data Transfer Addendum
• the EU-US Data Privacy Framework (and its UK and Swiss extensions), where the recipient is certified.

You can ask us for a copy of the relevant safeguards.

8. How long we keep data

When you delete your Vyomara Voice account (email hello@vyomara.com from your account email), we do it within 30 days:

• All your Vyomara Voice data is deleted from our live database. This covers your Voice profile, your usage and quota data, and your device-hash records.
• If you don't use Vyomara Portal, we also delete your shared Vyomara login (your email, name and profile details, and sign-in details).
• If you have Vyomara Portal data, we keep your Vyomara login so Portal keeps working, and delete only your Vyomara Voice data. To delete your Portal data and the login too, ask us to delete your Vyomara Portal account as well.

Backups. Our database provider keeps daily backups for up to 7 days, so deleted data can stay in a backup for up to 7 days after deletion. While it does, we don't use it for anything, and it is replaced in the normal backup cycle.

Kept by law. We may keep data longer only where the law requires it, for example tax records, or to deal with an ongoing legal claim.

Data on your PC is not affected by deleting your account. See section 9 to remove it.

9. Data stored on your PC

The App keeps some data in its folder on your computer. We cannot see or access it, and none of it is sent to us automatically.

Where it is. In the App's data folder in your Windows user profile: %APPDATA%\Vyomara Voice (paste this into File Explorer's address bar to open it).

What's there:

• Recent dictations. Your last 50 cleaned-up dictations and when you made them, saved without encryption in config.json. Some older versions kept up to 100. The list is trimmed to 50 the next time you dictate.
• Settings. Your App settings, hotkeys, and any projects and project instructions you've written, also in config.json.
• Your own OpenRouter key (BYOK only), in config.json. It is encrypted with Windows' built-in data protection. If that protection isn't available on your PC, the key is saved without encryption, and the App notes this in its log.
• Sign-in session, so you stay signed in. It is encrypted in the same way, with the same exception.
• A failed recording. If a transcription fails, the App keeps that one recording until a retry succeeds, then deletes it.
• Log files. The App writes logs to help diagnose problems:
  • usage-metrics.csv: one line per dictation with numbers and setting labels (for example session and project IDs, providers, App version and language). Never dictation text.
  • vyomara-silence-log.txt, a debug log and a logs folder: technical events such as update checks, errors and hotkey changes. No dictation text.
• Older log files with dictation text. If you used a version of the App released before 11 September 2026, the folder may also contain usage-analytics.csv and a historical-logs folder. These older logs include the full raw and cleaned text of past dictations. Current versions no longer write to them.

Clearing and removing it:

• Clear history. In the App, open Settings → History to delete a single dictation, or click Clear all to delete every saved dictation.
• Log files are separate. "Clear all" doesn't remove the log files, including the older ones with dictation text. To remove them, close the App and delete them from the folder above.
• Uninstalling doesn't delete this folder. To remove everything, uninstall the App and then delete the folder.

Anyone who can use your Windows account could read these files. Protect your PC with a password, and delete history and logs you don't want kept.

10. Security and data breaches

What we do to protect your data:

• encrypt data in transit (HTTPS)
• restrict access to our database and provider dashboards to Ajoy, with strong sign-in
• store a one-way hash instead of your machine ID
• check that every sign-in returning to the App was started by that App, to block fake sign-in links
• encrypt your BYOK key and sign-in session on your PC, where Windows allows
• never store audio or text on our server, and never write them to our server logs.

We protect our admin accounts with strong passwords and two-step sign-in where available.

No system is perfectly secure, and sending data over the internet always carries some risk.

If a breach affects your personal data, we will tell you without delay, by email or in the App. We will explain:

• what happened and when
• what it may mean for you
• what we are doing about it
• what you can do to protect yourself
• who to contact.

We will also report the breach to the Data Protection Board of India and to any other authority where the law requires it.

11. Children

Vyomara Voice is not meant for children.

• Minimum age. You must be at least 18 years old to use it.
• No children's data. We don't knowingly collect data from anyone under 18.
• No tracking. We don't track children, monitor their behaviour, or target ads at them.
• If we find out. If we learn that someone under 18 has an account, we will close it and delete its data. Parents or guardians can contact hello@vyomara.com.

12. Cookies, local storage and "Do Not Track"

• Cookies.
  • Our website doesn't set cookies of its own, and uses no marketing, advertising, analytics or tracking cookies.
  • Cloudflare may set a strictly necessary security cookie if it needs to protect the site from bots and attacks.

• Local storage. The website saves a few small items in your browser:

  • whether you paused the page animations
  • your price region (India or international)
  • on the sign-in page only: a one-time code that links the sign-in to your App, and your sign-in session, so the sign-in can finish and be handed to the App.

  These stay in your browser. The sign-in items are used only to complete sign-in with Supabase. You can clear any of them from your browser settings.

• The App doesn't use cookies for tracking.

• No cookie banner. Everything above is strictly necessary to run the site and sign you in, or remembers a choice you made. None of it tracks you, so we don't show a cookie banner. If we ever add optional cookies, such as analytics, we will ask you first.
• Links to other websites. Our website and App may link to other sites, such as Google or OpenRouter. Their own privacy policies apply there.
• Do Not Track and Global Privacy Control. We don't track you across other websites or sell or share your data for advertising. So there is nothing for these browser signals to switch off. We would treat them as an opt-out if that ever changed.

13. India: your rights under the DPDP Act 2023

This section is our notice to you under the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025. It also meets the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, which apply until 13 May 2027.

13.1 Notice: what we process and why

• Personal data:
  • email, name and profile details (if you sign in with Google), and sign-in and session details (including IP address)
  • plan and quota
  • dictation usage data (duration, latency, word count, success, AI cost, session ID, which AI provider handled it and whether a backup was used, your language and output setting, App version)
  • a hash of your machine ID
  • your voice recordings, the resulting text and your project instructions, relayed only and never stored on our server
  • technical logs and website request data (IP address, country)
  • support emails
  • payment records (when you buy Pro).
• Purposes: to give you the Vyomara Voice dictation service, run your account, apply free and Pro limits, prevent abuse and fraud, keep the service secure and working, support you, and keep billing and tax records.
• What it enables: speech-to-text dictation on your Windows PC, with AI cleanup.
• Who receives it: the providers in section 5, some of them outside India (section 7).

13.2 Consent

We process your data on the basis of the consent you give when you sign in. Some processing is also allowed by law without consent, for example keeping tax records or responding to legal orders.

• How you consent. The sign-in page tells you, next to the sign-in buttons, that by continuing you agree to our Terms and this Privacy Policy, and links to both. By choosing to continue and sign in, you give that consent.
• Limited to these purposes. Your consent covers only the purposes above. If we want to use your data for anything new, we will ask again.
• Voice recordings. Because voice recordings can be treated as sensitive, by continuing and signing in you also expressly consent to your voice recordings being sent to the AI providers in section 5, outside India, so they can be transcribed.
• You can choose not to give some data, but without signing in and sending audio we can't provide the service.

13.3 Withdrawing consent

You can withdraw consent at any time, as easily as you gave it, by emailing hello@vyomara.com from your account email with the subject "Withdraw consent" or "Delete my account".

Once you withdraw, we stop processing and delete your Vyomara Voice data within 30 days, in the way described in section 8 (your shared Vyomara login is kept only if you have Vyomara Portal data), except what the law requires us to keep. Withdrawing doesn't affect processing that happened before. Without consent we can't provide the service, so your account will be closed.

13.4 Your rights

You have the right to:

1. Access: get a summary of your personal data, what we do with it, and who we have shared it with.
2. Correction, completion and updating: fix wrong or incomplete data.
3. Erasure: have your data deleted, unless we need to keep it by law.
4. Grievance redress: complain to us and get a response.
5. Nominate: name someone to exercise your rights if you die or become unable to act.

How to ask:

• Email hello@vyomara.com from the email address linked to your Vyomara Voice account. That email address is the identifier we use to find your data.
• Tell us which right you want to use.
• We may ask for more details to confirm it's you.
• Every reply about your rights will include our contact details.

13.5 Language

You can ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India, for example Assamese, Hindi or Bengali. Email hello@vyomara.com and we will send you a translation.

13.6 Grievance Officer

Ajoy Chetri, Founder and Grievance Officer
Email: hello@vyomara.com
Phone: +91 7005175548
Address: H/No 150 Gautam Bosti, Khatkhati, Bokajan, Karbi Anglong, Assam 782480, India

Response time: we acknowledge every grievance within 48 hours and resolve it within 30 days of receipt. This is within the 90-day maximum the DPDP Rules allow and the one-month limit under the IT Rules 2011.

13.7 Complaining to the Data Protection Board of India

If you're not satisfied with how we handled your grievance, you can complain to the Data Protection Board of India. Under the law, you should contact our Grievance Officer first.

13.8 Your duties

The DPDP Act also asks users to:

• give true and accurate information
• not impersonate anyone
• not hide important information
• not file false or frivolous complaints.

13.9 Users who joined before this policy

If you joined Vyomara Voice during early access, before this policy was published, we will email you this policy when we publish it. If you keep using Vyomara Voice after that, you agree to this policy. If you don't agree, you can ask us to delete your account (section 13.3).

14. EU, EEA, UK and Swiss users

If you're in the EU, EEA, UK or Switzerland, the GDPR, UK GDPR or Swiss data protection law gives you extra rights.

Our legal bases:

• Voice data. We use your voice only to turn speech into text, not to identify you. So it is personal data, but not "special category" biometric data.

• Your rights:

  • access, correction, erasure, restriction and data portability
  • to object to processing based on legitimate interests
  • to withdraw consent at any time, without affecting earlier processing.

  We reply within one month. This can be extended by two more months for complex requests, and we will tell you if so.

• Automated decisions. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

• Complaints. You can complain to your local data protection authority: the authority in your EU/EEA country, the UK Information Commissioner's Office (ico.org.uk), or Switzerland's Federal Data Protection and Information Commissioner (edoeb.admin.ch).
• Transfers. See section 7.
• Representative. During early access, we haven't appointed a representative in the EU or the UK. Please contact us directly at hello@vyomara.com. If we appoint one, we will add their details here.
• Do you have to give us data? Your email is needed to create an account, and audio is needed to dictate. Without them we can't provide the service.
• Where your data comes from. We get it from you, from Google (if you sign in with Google), and from Cloudflare (your country, for pricing).

15. United States users

US state privacy laws, including California's CCPA, apply to businesses above certain size thresholds. Vyomara is currently below them, but we explain our practices here and honour the requests below anyway.

Categories of personal information we have collected in the last 12 months:

• Sources and uses. Sources are listed in section 14, uses in section 3, and how long we keep each category in section 8.
• No selling or sharing. We don't sell personal information, or "share" it for cross-context behavioural advertising. We haven't done either in the last 12 months.
• Sensitive information. We don't use sensitive personal information to infer things about you.
• Children. We don't knowingly collect data from children under 13, or anyone under 18 (see section 11).

Your rights. Depending on your state, you may ask to:

• know what we collect and get a copy
• correct or delete it
• opt out of sale, sharing, targeted advertising or profiling (we do none of these)
• limit the use of sensitive information.

We won't treat you differently for using these rights.

How to ask:

• Email hello@vyomara.com from your account email. We will verify your identity using the details we already hold.
• Authorised agents. You may use an authorised agent. They need your signed permission, and we may still ask you to confirm your identity.
• Response time. We reply within 45 days.
• Appeals. If we refuse your request, you can appeal by replying with "Appeal" in the subject line. We will answer the appeal in writing within 45 days, with our reasons. If you're still unhappy, you can contact your state Attorney General.

California "Shine the Light". We don't share personal information with third parties for their direct marketing.

16. Users in other countries

If you live elsewhere, for example in Canada or Australia, your local law may give you similar rights to access, correct or delete your data, or to complain to a regulator. Email hello@vyomara.com and we will help, in line with that law.

17. Quick guide: how to review, update or delete your data

18. Changes to this policy

We will update this policy when our practices or the law change, and the "Last updated" date will change too.

• Important changes. We'll tell you by email or in the App before they take effect.
• Consent. If a change needs your consent, we'll ask for it.
• Old versions. Earlier versions are available on request.
• 15 October 2026: added Groq as a speech-to-text and backup cleanup provider for the free plan.

19. Contact

Questions, requests or complaints: hello@vyomara.com
Ajoy Chetri (trading as Vyomara™), H/No 150 Gautam Bosti, Khatkhati, Bokajan, Karbi Anglong, Assam 782480, India