Privacy Policy

0. The short version

We built this policy to be read, not to be survived. Here is the whole thing in ten lines. Every one of them is expanded below, and nothing below contradicts anything here.

1. We collect your phone number, your messages and photos, the record of your calls, and the things your AI agent does for you. That’s the product.
2. Your AI agent reads your conversations. It has to, in order to act for you. We say exactly what it reads and where that text goes.
3. Message content is processed by an AI provider outside India, and if you dictate, your voice is sent to a speech-to-text provider. We name every company that receives your data.
4. Calls are end-to-end encrypted. Messages are not — your agent has to be able to read them. We can’t listen to or watch your calls, and we never record them.
5. We never sell your data. Not to anyone, for any price, ever. There is no advertising in this app and no ad networks in our code.
6. Your address book is not stored. We check which of your contacts already use Jigi and throw the rest away. We never keep raw phone numbers of people who aren’t users.
7. Photo location data is stripped before anyone can see the photo. Not as a setting — the original is never servable.
8. You can switch your agent off completely, at any time, and it stops acting immediately.
9. You can delete your account. Almost everything is destroyed at once. A few things survive, and §15 lists every one of them and why — including the messages you sent to other people, which stay in their conversations with your name removed.
10. Your agent can make mistakes, and you are responsible for what it does in your name. §5.5 explains this, and the Terms of Service set out the legal terms that govern it.

If you only read one section beyond this, read §5 (the AI agent) and §15 (deletion). Those are the two where people’s assumptions are most often wrong.

---

1. Who we are

Jigi is built and operated by an independent developer based in India. Jigi is not operated by a company. Where this policy says “we”, “us” or “our”, it means the operator of Jigi.

For the purposes of the Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data described in this policy. You are the Data Principal.

Being a small, independent operator does not reduce what we owe you. Every obligation in this policy applies in full.

Contact for all privacy matters, including exercising your rights:

• Email: hello@jigi.chat — it reaches our Grievance Officer directly

Email is the fastest and most reliable way to reach us, and it is the official channel for privacy requests and complaints. We acknowledge your request within 24 hours and resolve it within 15 days — the timetable the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require, applied to privacy requests as well. §21 explains what to do if you are not satisfied with our answer, including how to escalate to the Data Protection Board of India.

---

2. What this policy covers

This policy covers the Jigi mobile application and the backend services behind it.

It does not cover:

• Your device. Your operating system, keyboard, backup service and gallery have their own policies. If your phone backs up your Jigi photos to a cloud service, that copy is governed by that service, not by us.
• The people you talk to. What another person does with a message you sent them, or with what they saw and heard on a call with you, is not something we control.
• Third-party services you reach from Jigi, if any.

This policy applies to everyone who uses Jigi. Where a specific law gives you additional rights, those rights apply on top of what is written here.

This policy is a notice, not a contract. It explains how we handle personal data. It gives no warranty and creates no obligation beyond those the law imposes. Our legal relationship with you — including what we are and are not liable for — is governed by the Terms of Service (§12 to §15).

---

3. The data we collect

We collect four kinds of data. We have deliberately listed the specific fields, not categories, because a category can hide anything.

3.1 Data you give us directly

We do not ask for and do not store: your name, your email address, your date of birth, your gender, your address, your payment details, your government identifiers, or your biometrics. We do not use your voice to identify you.

3.2 Data from your device

We use your microphone and camera only while you are on a call, taking or choosing a photo to send, or holding the button to dictate.

We do not collect: your location (we do not request location permission, and we do not work out where you are from your IP address), a stored copy of your device contacts list, your phone’s own call log, your SMS messages, your installed-app list, your browsing history, or your advertising identifier.

3.3 Data generated by your use of Jigi

About our telemetry, specifically: it carries identifiers, sizes, counts and status flags, and for each request to our servers, the IP address it came from and your app’s identifier (user agent). It is built so that message content and phone numbers cannot casually be attached to it — this is enforced in our code, not by a rule people are asked to remember. We do not use analytics SDKs that profile you, and we do not track you across other apps or websites.

3.4 Data about other people

Using Jigi means we process personal data about people who are not our users and have not agreed to anything. We think you should know exactly what this is:

• Phone numbers from your address book, checked against our users and then discarded (§7).
• Names you saved for contacts who are Jigi users.
• Facts your agent records about other people, drawn from your conversations — for example, that a person you mentioned prefers evening calls. These may describe people who do not use Jigi at all (§6).

Your obligation. When you share information about other people with us — including by turning on contact sync, or by discussing them with your agent — you confirm you are entitled to do so. This is also a duty of Data Principals under §15 of the DPDP Act. If a person asks us to remove information we hold about them because of you, we will act on it.

3.5 What we deliberately do not collect

Stated positively, because these are choices we made and can be held to:

• No advertising, no ad networks, no ad identifiers. There is no advertising code in this application.
• No sale of personal data. Ever, to anyone.
• No location tracking. We do not request location permission. Photos you send often contain GPS coordinates — we destroy those before the photo can be viewed by anyone (§8).
• No cross-app or cross-site tracking. No pixels, no fingerprinting.
• No storage of your address book. §7.
• No call recordings and no voice recordings. Calls are never recorded or transcribed (§9), and we keep no audio of your dictation (§10).
• No linked deletion survey. If you tell us why you are leaving, that reason is stored with no link to you, your account, or any identifier — not even a former account id. We designed it this way so that a reason cannot become personal data about someone we have just erased. It cannot be traced back to you even by us.

3.6 What other people can see about you

A messenger shows things about you to other people. Here is all of it, so nothing comes as a surprise:

• Your phone number — to everyone you chat with.
• Your profile photo — to any Jigi user who has your number, talks to you, or is on a call with you. There is no setting to restrict it yet; you can remove it at any time.
• Your online status, your last seen, and when you are typing — to everyone you have a chat with. Anyone who has your number can start a chat with you. There is no setting to hide these yet.
• Read receipts — the person who sent you a message sees when it was delivered to your phone and when you read it.
• That you added, changed or removed a phone — the people you chat with are told your encryption keys changed, so their app can tell them a security code changed. They also learn how many phones you use Jigi on.
• On a group call — everyone in the call sees who else is in it, including people you do not otherwise talk to.

Blocking hides most of this. Between you and a person you block — in both directions — online status, last seen, typing, read receipts and new-phone notices are not shown, messages are not delivered (they look sent on the sender’s side), and their calls do not ring you. A blocked person is never told they were blocked. Your phone number, profile photo and your earlier conversation remain visible to them.

---

4. Why we use your data

We use personal data only for the purposes below. We do not use it for anything else without asking you first.

Our lawful basis is your consent, given when you sign up and when you enable specific features, except where a legitimate use recognised by the DPDP Act applies — for example to comply with a legal obligation, or to protect security. Where we rely on consent, you can withdraw it (§16). Withdrawing consent for something essential to messaging means you can no longer use Jigi, and we will tell you that clearly before you do it.

---

5. The AI agent — full disclosure

This is the section most people would not guess at, so it is the longest and the plainest. Nothing here is buried elsewhere.

5.1 What the agent does

Jigi includes an AI agent that acts on your behalf. To do that:

• It reads the content of your conversations — your messages and the messages other people sent you. Text and photo captions.
• It can send messages as you, to people you have chosen, when you ask it to or when you have given it a standing approval for that contact.
• It can act later. It can schedule an action you approved to run at a set time, wait for someone to reply and then decide what to do next, and — if you approve a reply in advance — answer people who message you while it is watching, for up to 24 hours.
• It can stop contacting a person who has asked not to be contacted. Only you can lift that stop.
• It records memories — facts it judges worth keeping so it is useful later (§6).
• It creates tasks with a full, auditable history: what it was asked, what it decided, what it did, and what it asked you to approve.

What it cannot do:

• It cannot see the contents of images. A photo appears to it as the word [photo], plus your caption if you wrote one. It receives no image data and no image URL.
• It cannot send photos or any other media.
• It cannot place, hear or see calls. Calls are end-to-end encrypted and the agent has no part in them.
• It cannot grant itself permission. Standing approvals for a contact can only be created by you, from your own settings, and a reply it sends while watching can only be one you approved first. There is no path by which the agent gives itself authority — this is enforced structurally in our code, not by policy.

5.2 Where your content goes

To work, the agent sends text to AI providers outside India:

• Message content, memory text, and task context are sent to Anthropic PBC (United States), which provides the language model. This includes the messages other people sent you in conversations the agent reads, your timezone, and — when the agent needs to work out which person you mean — up to five candidates, each with the name you saved for them (or their phone number if you saved none), their phone number, and when you last talked.
• Memory text, and the searches your agent makes in its memories, are sent to Voyage AI (United States) to build the mathematical representations that let the agent recall relevant memories.

These providers process this text only to return a result to us.

Neither of them trains its models on your content. Anthropic’s commercial terms state that it may not train models on customer content, and for the memory provider we have taken their zero-retention option, so the text we send is not stored on their side at all.

How long the AI provider keeps it. Anthropic deletes the text we send, and the result it returns, within 30 days. It is not kept indefinitely and it is not used to build anything. Two exceptions Anthropic applies, which we are disclosing rather than leaving you to find: content flagged for a suspected violation of their usage policy may be kept for up to two years, and content may be kept longer where the law requires it.

Dictation goes to separate speech providers, covered in §10. §13 lists every recipient and §13.2 covers transfers outside India.

5.3 The agent makes mistakes

We are stating this as plainly as we can, because it matters more than any other sentence in this document:

The agent is an AI system. It can be wrong. It can misunderstand you, act on a misreading of a conversation, send a message you would not have sent, phrase something badly, contact the wrong person, or record a “fact” that is false. This is a known and unavoidable property of the technology, not a defect we have failed to fix.

Specifically, and without limitation, it may:

• misidentify which person you meant;
• misjudge tone, urgency or intent;
• act on information that was already out of date;
• record a memory that is incorrect, incomplete or unfair to someone;
• produce text that is inaccurate or inappropriate.

We work to reduce these errors. We do not claim to have eliminated them and you should not use Jigi on the assumption that we have. Do not rely on the agent for anything where an error would cause you harm — including medical, legal, financial, safety-critical or legally binding matters.

5.4 Your controls

You are never without a way to stop it:

• Turn the agent off entirely. A single switch. When you use it, everything the agent is currently doing stops, and it cannot act for you again until you turn it back on.
• Approve individually. By default the agent asks you before it messages someone on your behalf, and shows you the exact text.
• Grant standing approval per contact, and revoke it at any time.
• Stop the agent contacting a specific person.
• See everything it did. Every task keeps a full history.
• Read, edit and delete its memories, stop it learning new ones, or stop it using them (§6).

5.5 Who is responsible for what the agent sends

You are. When the agent sends a message on your behalf, that message is sent as you, at your direction, under permissions you granted. You are responsible for it as if you had written it yourself.

The agent may draw on its memories, and on your conversations, when it writes a message for you. When you approve a message individually, you see exactly what it says before it goes. Under a standing approval, or a reply you approved in advance, it is sent without you seeing it first.

We provide the agent as a tool, and we provide the controls in §5.4 so you can supervise it. We do not review or approve what it sends, and we are not a party to your conversations.

By using Jigi and enabling the agent, you accept that responsibility.

This section is a disclosure of how the product works, so you can decide whether to use it knowing that. The legal allocation of responsibility — including the fact that messages the agent sends are treated as your own, the warranties we do not give, the limits on our liability, and the indemnity you give us — is set out in the Terms of Service, which you accept in order to use Jigi. Please read §6 and §7 of that document; they are the binding agreement on this point and this policy does not replace or limit them.

---

6. Memories — your agent’s memory

Your agent records facts so it can be useful over time.

What it stores. Short statements — a preference, a recurring commitment, a relationship, something you said matters to you. Each is tagged with who or what it is about.

How memories are made. The agent records a memory when you ask it to, or when it judges that you have stated something lasting, such as a preference. It also learns automatically from its own work, without being asked:

• the answers you give to its questions;
• a short record of how each task turned out, including the start of what it was asked and the people involved;
• that a person asked not to be contacted;
• instructions you gave it while a task was running;
• actions you declined.

You can switch this automatic learning off with Auto-Learn, and stop the agent using memories at all with Use Memories. Both are in the app’s memory settings.

About other people. Memories can be about people who do not use Jigi. They are stored under a label local to your account.

Isolation. Memories are private to your account. Another user cannot read them. This is enforced by the structure of every query we run against them, not by a filter someone remembers to add. We deliberately do not maintain any index that would make “what do other people remember about me?” answerable. What the agent writes in a message for you can draw on your memories (§5.5) — the person receiving that message sees what it says, as with any message you send.

What we have not done, stated honestly. Memory content is not encrypted at the application layer. We considered it and decided against it, because it would break the agent’s ability to find a relevant memory at all. Instead, memory content is protected by access control, by transport and storage encryption, and by a rule that memory content is never written to our logs. We have built the storage so that stronger encryption can be added later without migrating your data.

Your control. You can see every memory, correct it, delete individual memories, or delete all of them, and you can export a copy of your memories from the app.

• Deleting gives you 30 days to undo. A memory you delete — one at a time or all at once — is hidden from the agent immediately and can be restored for 30 days. After that it is permanently destroyed.
• Replaced versions. When a newer memory replaces an older one, the older version is hidden, not destroyed. It is destroyed when you delete all memories (after the same 30 days) or your account.
• Copies in task history. When the agent recalls a memory during a task, what it recalled becomes part of that task’s history (§5.4). Deleting the memory does not rewrite past task histories.
• When you delete your account, memories are destroyed immediately — ahead of every other grace period in the system, including the 30-day undo.

Automatic extraction by the AI model. Our software can also use the AI model to read your conversations and pull facts out of them. This is switched off. If we ever enable it, we will tell you before it applies to you and you will be able to decline.

---

7. Contacts and finding people

To tell you which of your contacts use Jigi, your app sends us phone numbers from your address book. Here is precisely what happens to them:

1. Numbers are converted into an irreversible cryptographic fingerprint using a secret value held only on our servers.
2. Those fingerprints are compared with our users.
3. Matches are returned to your app.
4. Everything else is discarded in the same request.

What this means concretely:

• We never store the raw phone number of anyone who is not a Jigi user.
• We never store a copy of your address book. There is no mirror of it, no reverse index, and no relationship graph.
• If you also turn on contact sync, we store one record per contact who is already a Jigi user: which of your contacts they are, and the name you saved for them. Nothing else — no phone number column, no other field.
• To skip a sync when nothing has changed, your app sends us a summary value it computes from your address book. We store it as received and never use it to work out who your contacts are. It is deleted with your account.

The name you saved is private to you. The person it refers to can never see how you labelled them, and no other user can see your labels.

You are in control of it. You can view every label we hold for you and delete them, at any time, without deleting your account. If you delete them and then sync again, whatever is still on your phone is uploaded again — your device remains the source of truth.

Names you use for people. When your agent asks “who do you mean?” and you answer, it remembers the word you used — “Mum”, say — for that person, so it doesn’t have to ask again. These are private to you. You can see and delete them at any time; we keep at most 500, replacing the oldest.

When you join. If you sync your contacts within a day of joining, the people in your address book who already use Jigi are prompted to re-check their own contacts. The prompt carries only a short fragment of a one-way fingerprint of your number — shared by thousands of numbers, so it names nobody. Their phone checks it against their own address book: only someone who has your number saved learns that you joined, and they learn nothing that contact discovery would not have told them anyway. Anyone prompted can work out that someone with their number saved has just joined. We keep a record that a person was prompted, without any phone number, for up to 24 hours so nobody is prompted twice.

---

8. Photos

• Photos never pass through our application servers. Your app uploads them directly to our storage provider using a short-lived, single-purpose link.
• Location data is destroyed before anyone can view the photo. Our servers re-encode every image, which removes EXIF metadata including GPS coordinates. A photo only becomes viewable after that has happened — the original, unstripped file is never servable to anyone, including us.
• The storage is private. There are no public files. Every view requires a freshly issued, short-lived link, granted only after we check you are allowed to see that photo.
• We do not analyse the contents of your photos. No image recognition, no face detection, no labelling. Your agent never receives image data.
• We accept images only — JPEG, PNG and WebP. We refuse formats that can carry executable content.
• Deleting a photo message deletes the photo. Access stops immediately and the stored file is destroyed.
• Uploads you start but never send are automatically cleaned up.

Deleting a text message. You can delete a message you sent, for everyone. It disappears for both of you and for both agents, and its notification is withdrawn from the other person’s phone. The text itself is kept on our servers, hidden, with the conversation — including after you delete your account. We are telling you this rather than letting “delete” imply more than it does.

---

9. Calls

Jigi has voice and video calls, between Jigi users only. A call can include up to 8 people — anyone in a call can add someone they have a chat with — and you can share your screen.

End-to-end encrypted, always. Your voice, video and screen are encrypted on your phone with keys that only the phones in the call hold. Our call server forwards the encrypted media and cannot decrypt it. There is no setting that turns this off.

Never recorded, never transcribed. We do not record calls, we do not transcribe them, and no AI — including your agent — listens to or watches them.

Always through our own call server. Calls do not connect phone to phone, so the people you call are not shown your IP address. The call server is ours, running on DigitalOcean in Bangalore, India — not a third-party calling service.

What we keep about your calls:

• The call record — who called whom, voice or video, when, how long, how it ended, and the chat it started from. It appears in both people’s chat, like a message, and is kept for the same reason messages are (§15.2).
• Your call history — your own list of calls. You can hide entries; hidden entries are kept until you delete your account.
• Call quality statistics — connection type, delay, packet loss and jitter, with no content. Kept 30 days.
• Your device’s public keys (§3.2), which let other phones encrypt the call’s keys so only your phone can open them. While a call is ringing, our servers relay those encrypted key packages, which they cannot read, and delete them within minutes.
• Our call server’s connection logs — IP addresses and call and participant identifiers. Kept 14 days, then deleted automatically.

Ringing. An incoming call reaches a phone that is asleep through Google Firebase Cloud Messaging (§12). That notification carries the call’s identifier, the chat’s identifier, the caller’s internal identifier, whether it is voice or video, and timings. The caller’s phone number travels inside a sealed box only the receiving phone can open; an older app version that cannot open seals receives the caller’s number as plain text.

Not a phone service. Jigi calls connect only Jigi users. They cannot reach emergency services or any phone number. See the Terms of Service.

---

10. Voice dictation

You can talk instead of typing. While you hold the microphone button, your app streams your voice to a speech-recognition provider and shows the words as you speak. The text goes nowhere until you choose to send it, and then it is an ordinary message.

Who receives your voice. Your audio goes to Sarvam AI (India). If Sarvam is unavailable, it goes to ElevenLabs (United States) instead. They receive the audio and a language hint taken from your phone’s settings — no name, no phone number, no account identifier.

What we keep: nothing of what you said. We do not store your audio or the transcript — not on disk, not in our logs, not in our telemetry. We keep only a count of how many seconds you dictated today, to apply a fair-use limit, and it expires within 48 hours.

What the providers keep. We have opted out of both providers using your audio to train their models.

• Sarvam AI deletes it after 1 day.
• ElevenLabs keeps it under its own retention rules, which do not set a fixed period. We do not have its zero-retention option.

Dictation makes mistakes. Speech recognition can mishear you. Check the text before you send it — once sent, it is your message.

---

11. Feedback

When you send feedback, we store your message, any screenshots you attached, and the fact that you sent it.

We retain feedback for as long as it remains useful for improving Jigi, including after the issue it describes is resolved. We keep it because the words are the signal: patterns across time are what tell us what to fix. It is not used for advertising, is not sold, and is not shared beyond the recipients in §13.

Screenshots may contain anything that was on your screen — including other people’s messages. Please check before attaching one.

Feedback is linked to your account, so it is deleted when you delete your account, and you can ask us for a copy or for deletion at any time (§16).

---

12. Notifications

We send push notifications through Google Firebase Cloud Messaging.

Notifications carry pointers. A notification tells your app that something happened and which item it concerns; your app then fetches the content over an authenticated connection.

Where your app supports it, a notification can also carry a short preview — sealed. The sender’s phone number (so your phone can show the name you saved them under) and the first line of the message are encrypted so that only your device can open them, and signed by us so that your device shows nothing we did not send. Google, which delivers the notification, sees that a sealed box exists and cannot read it. You are told here plainly that our servers compose that preview: the seal protects it on its way to your phone and at Google — it is not end-to-end encryption of your messages.

Outside a seal, no message text ever travels in a notification. A notification sent to an app version that cannot open a seal carries the pointers and, as before, the sender’s phone number.

Incoming calls ring through the same channel (§9). When a contact joins, the prompt described in §7 also arrives this way.

Announcements. We send announcements about Jigi — product news and offers, and information about the service — to every installed app, through Firebase topics your app joins when it registers for notifications. They are about Jigi; they are not advertising for anyone else. There is no in-app switch to stop them yet; you can turn off Jigi’s notifications in your phone’s settings. When you tap one, we record that you did, so we know whether it was useful.

Your push token identifies your app installation. When you sign out, or sign in on another phone, that installation’s token is switched off and stops receiving notifications. Tokens are deleted when you delete your account, so a deleted account immediately stops being reachable.

---

13. Who we share your data with

We do not sell your personal data. We do not share it for advertising. We do not disclose it to data brokers.

We share data only with the service providers below, only for the purpose stated, and only to the extent needed. They act on our instructions, under their contracts with us and their own published terms, and they run their own systems and security, which we do not control. Where the DPDP Act makes us responsible for processing carried out on our behalf, we accept that responsibility; beyond what the law requires, a provider’s own acts and failures are its own, and our liability is limited as set out in the Terms of Service.

13.1 Our service providers

We keep this list current. If we add a provider that receives personal data, we update this policy and, where the law requires it, we notify you.

13.2 Transfers outside India

Our servers, databases and call server are in India. Some of the providers above process data outside India, as marked. The DPDP Act permits such transfers except to countries the Government of India restricts, and we do not transfer personal data to any restricted country.

For every transfer we rely on the provider’s contractual commitments covering confidentiality, security, and use limited to what we instruct. For the AI and speech providers this includes not training their models on your content, and for the memory provider we have taken their zero-retention option so the text is not stored on their side at all.

13.3 Legal and safety disclosures

We may disclose personal data where we are legally required to, or where it is necessary to:

• comply with a valid order of a court or a lawful demand from an authority with jurisdiction over us;
• establish, exercise or defend a legal claim;
• prevent or investigate fraud, abuse, or a threat to someone’s safety or to the security of Jigi.

We assess every request for validity and scope, disclose only what is required, and where we are legally permitted to tell you, we will. We cannot disclose the content of a call: we never have it (§9).

13.4 Business transfers

If Jigi is involved in a merger, acquisition or sale of assets, personal data may transfer as part of it. You will be notified before that happens, and the recipient will be bound by a policy no less protective than this one, or you will be given the opportunity to delete your account first.

---

14. How long we keep your data

We keep personal data only as long as the purpose requires, or as long as the law requires. The full schedule is in Annex B. The headline rules:

• Messages and photos are kept while your account exists, so your conversations work. They are not on a timer.
• Call records are kept like messages. Call quality statistics are kept 30 days, and our call server’s connection logs 14 days.
• Dictation audio and transcripts are never stored by us (§10).
• Memories are kept until you delete them or delete your account. A deleted memory can be restored for 30 days, then it is destroyed (§6).
• Feedback is kept for as long as it is useful for improving Jigi (§11).
• Photo view links expire in about 10 minutes; the files themselves live with the message.
• Uploads you never send are removed within about 48 hours.
• Records of what your agent recalled are removed after about 90 days.
• Failed background jobs, which can contain fragments of content, are removed after 30 days.
• Operational logs and telemetry are retained for 90 days.

When a retention period ends, data is deleted. Where deletion is not immediately possible — for example inside an encrypted database backup — it is put beyond use immediately and disappears when that backup expires on its own cycle, within 30 days.

---

15. Deleting your account

You can delete your account at any time. Deletion begins as soon as you confirm it. There is no reactivation window: it is not reversible.

15.1 Destroyed immediately

All of the following are permanently destroyed, ahead of every internal grace period:

• Every memory and all your memory settings, including memories you deleted within the last 30 days
• Every task and its complete history
• Your conversations with your agent
• All your photos and avatars — both the records and the stored files
• Your contact labels — both those you saved, and those other people saved about you — and the names you use for people
• Your contact sync summary
• Your call history, your call quality statistics, and your device keys; any call you are in ends for you
• Your feedback and its screenshots
• Your push tokens, so you immediately stop being reachable
• Your agent’s pending actions, stops and standing approvals
• Your usage counters and your taps on announcements

Your phone number is removed from your account record and released, so it can be used to register again.

15.2 What survives, and exactly why

We are listing all of it. This is the part a shorter policy would leave out.

1. The messages you sent to other people, and the conversations holding them. A conversation is shared with the person you had it with. Their record of it is theirs, and deleting your side would take away something they never agreed to lose. Your identity is severed — your name and number are gone, and you appear to them as a deleted user — but the text of your messages remains in their chat. This includes the hidden text of messages you deleted for everyone (§8).
2. Your membership record in those conversations, holding an internal identifier and nothing else. Without it, the other person’s chat could not even show that the account is gone.
3. The records of calls you were in, for the same reason as messages: the other people in the call keep them. Your device details are removed from them.
4. Blocks involving your account. These contain internal identifiers only and partly exist to protect the other person.
5. The time you were last online, on the deleted account’s record — which no longer carries your number or photo.
6. A deletion receipt, recording that the erasure happened, when, and what it destroyed. It is the proof we did what we said. It contains no readable identifier — a one-way fingerprint of your phone number is kept for about 180 days so we can answer “did this number once have an account?” without storing the number, and then that too is removed.
7. Failed background jobs for up to 30 days. These can contain fragments of content, and they carry no account identifier — which means they cannot be searched for yours. They are deleted on their own 30-day cycle. We are telling you this rather than claiming a completeness we cannot deliver.
8. Logs on their own timers. Our call server’s connection logs (14 days) and our operational logs and telemetry (90 days) are not searchable by account, so they expire on their own schedule.
9. Your anonymous departure reason, if you gave one. It was never linked to you (§3.5), so there is nothing in it to erase.

15.3 If we cannot complete a step

Deletion runs as independent parts. If one fails, the others still complete and the failure is recorded and retried — it is never silently dropped. If you ask, we will tell you the status of your deletion.

15.4 Your device

Deleting your account does not delete data your own device or your own cloud backup holds. Nor does it delete messages other people have already received.

---

16. Your rights

Under the DPDP Act you have the following rights. To use any of them, contact us at hello@jigi.chat. We will verify that the request is really yours, acknowledge it within 24 hours, and resolve it within 15 days.

You can also, without contacting us at all: switch your agent off, delete individual memories, stop your agent learning new memories, delete your contact labels and the names you use for people, hide calls from your call history, block someone, and delete your account.

Data portability. Indian law does not currently provide a right to receive your data in a portable format. You can export a copy of your memories from the app; we have not built an export for the rest of your data. We are telling you this instead of implying otherwise. If you need a copy of other data, ask us and we will do what we reasonably can.

Limits. We may decline a request where the law requires or permits us to — for example where it would erase something we must keep, or where it would reveal another person’s personal data. We will tell you why.

---

17. Children

You must be at least 13 years old to use Jigi. If you are under 13, you may not create an account, and we do not knowingly collect personal data from anyone under 13.

If you are between 13 and 18, you may use Jigi only with the permission of your parent or legal guardian. By creating an account you confirm that you meet the minimum age and, if you are under 18, that you have that permission.

For parents and guardians. If your child uses Jigi, please read this policy with them — particularly §5, which explains that an AI agent reads their conversations and can send messages in their name, and that it makes mistakes, and §3.6, which explains what other users can see about them. At any time you can contact us to see what data we hold about your child, correct it, or delete their account and its data entirely.

We do not profile or advertise to anyone. There is no advertising, no behavioural profiling, and no cross-app or cross-site tracking anywhere in Jigi, for users of any age. Nothing about a user’s age changes how we treat their data, because we do not treat anyone’s data that way.

If we learn that an account belongs to someone under 13, or to someone under 18 who does not have their parent’s or guardian’s permission, we will delete the account and its data. If you are a parent or guardian with a concern about an account, email hello@jigi.chat and we will act promptly.

---

18. How we protect your data

Concrete measures, all of which are in place:

• Encryption in transit. Every connection is encrypted — between your app and our servers, and between our servers and every provider in Annex A.
• End-to-end encryption for calls. Call audio, video and screen sharing are encrypted on your phone with keys only the phones in the call hold (§9).
• Encryption at rest for your photos. Our storage provider, Cloudflare R2, encrypts every stored object with AES-256 as standard. This is not something we can switch off.
• Encryption at rest for our database and queue, provided by our managed hosting provider. We do not run unencrypted production data stores.
• Private storage by default. No file is publicly accessible. Every view needs a freshly issued, expiring link granted after an authorisation check.
• Photo sanitisation is structural, not optional (§8).
• Content is excluded from logs and telemetry by design, in a way that makes accidental inclusion difficult rather than merely discouraged. This includes everything you dictate.
• Least-privilege separation. The servers that answer your requests do not hold the AI provider credentials; only the background workers do. The speech provider credentials are used only by a separate voice service.
• Access control on every read, applied at the query level, so one user’s data cannot be reached through another’s session.
• Non-disclosure by default. Where you are not entitled to see something, our answer is that it does not exist — we do not confirm that it exists and refuse, because that alone reveals information.
• Secrets are masked so they cannot appear in logs or error messages.
• Rate limiting and abuse controls on every sensitive operation.
• Deletion is proven, not assumed. Our erasure process is verified against a complete, machine-checked inventory of every table that can hold your data, and adding a new one that is not classified fails our build.

What we do not claim. Messages are not end-to-end encrypted — only calls are. We can access message content, and we must be able to, because your agent processes it. Memory content is not encrypted at the application layer (§6). No system is perfectly secure, and we do not promise that ours is.

What happens on a phone is outside our control. Calls and messages are protected on their way between phones and on our servers. Once they reach a device — yours or someone else’s — anyone with that device, and the software on it, can screenshot, record or forward them. Keeping your own phone and phone number secure is your responsibility. We cannot prevent what happens on a device and are not responsible for it.

---

19. If there is a data breach

If a personal data breach occurs, we will notify the Data Protection Board of India and every affected user, as required by §8(6) of the DPDP Act, and we will do it without undue delay.

Our notice to you will describe, as far as we know it: what happened, what data was involved, what we have done, what we recommend you do, and how to reach us about it. We will not delay telling you in order to complete our investigation.

---

20. Changes to this policy

We will update this policy when the product or the law changes.

• The effective date and version at the top always reflect the current document.
• For a material change — a new purpose, a new category of data, a new recipient, or a change in how long we keep something — we will notify you in the app and before the change takes effect, and where consent is required we will ask for it again.
• For clarifications and corrections we update the document and revise the date.
• We maintain a change log recording every version of this policy and the Terms of Service, and what changed in each, so you can see the history rather than take our word for it.

We will never apply a materially reduced standard of protection to data we already hold without asking you first.

---

21. Contact and grievances

For anything about your privacy, or to exercise a right:

• Email: hello@jigi.chat — the official channel for privacy requests and complaints, read by our Grievance Officer
• We acknowledge within 24 hours and resolve within 15 days — the timetable set by the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021

How a complaint works. Tell us what happened and what you want done. We will acknowledge it, investigate, and give you a written answer with our reasoning. If we cannot do what you asked, we will say why.

If you are not satisfied. You may complain to the Data Protection Board of India. Your right to do that does not depend on going through us first, though it usually resolves faster if you do.

---

Annex A — Recipients of personal data

The current, complete list of third parties that receive personal data, and what each one gets. Nothing outside this list receives your personal data.

---

Annex B — Retention schedule

---