Privacy Policy

Yuga is made and run by Hriday Vanka, an individual developer living in India, not a company. In this policy “I”, “me” and “we” mean that developer, and “you” means anyone who uses Yuga. When the policy says “we”, it is one person, sometimes helped by the service providers listed in section 16.

I decide why and how the personal data described here is used. That makes me the Data Fiduciary under India’s Digital Personal Data Protection Act 2023 (the “DPDP Act”), the controller under the EU and UK General Data Protection Regulation (the “GDPR”), and the equivalent under other laws.

How to reach me

• Email, for everything (privacy questions, requests about your data, complaints, help): support@foundationalcreations.com. I read every message myself.
• Post: Hriday Vanka, Hyderabad, Telangana, India, India.
• Grievance Officer (India’s IT Rules 2021 and DPDP Rules 2025, but open to anyone, anywhere): Pranay Vanka, support@foundationalcreations.com. See Grievance Redressal and Contact.
• Representative in the European Union (GDPR article 27): none is appointed.
• Representative in the United Kingdom (UK GDPR article 27): none is appointed.

I have not appointed a Data Protection Officer: the DPDP Act requires one only of “Significant Data Fiduciaries” (see section 22), and the GDPR only of organisations whose core work is large-scale monitoring or special categories of data, which Yuga is not.

This policy covers the personal data handled when you:

• visit the Yuga website, including its figure pages and its account page;
• use the Yuga app for iPhone and iPad, or for Android, which is where you talk to the figures;
• create or use a Yuga account;
• make and share a clip, quote card or badge in the app; or
• write to me.

Yuga lets you hold voice and text conversations with AI recreations of historical figures, and watch two figures debate. The conversations take place only in the apps; the website describes the figures and has an account page, but you cannot talk to a figure on it.

It does not cover other companies’ services, even when you reach them through Yuga: Google and Apple when you sign in, the speech service on your phone, the App Store and Google Play, and the apps you share a clip to. Their own privacy policies apply. This policy works with the Privacy Notice for India, the Cookie Policy, the list of Service Providers and the Young People and Parents page.

Everything Yuga handles about you, in one table. The sections after it explain each row.

Yuga is built to keep as little about you as possible. You can talk to every figure without an account (except the one “examined” figure, who needs a signed-in adult), and your conversations are not stored.

On the website

The website has no conversations and never uses your microphone. A visit sends my server only the technical data every website receives (below). If you use the account page to sign in, see your voice minutes, give your year of birth or delete your account, it also handles the account data described below.

When you talk to a figure or watch a debate, in the apps

• What you say, as text. When you speak, your phone turns your words into text (see section 10); when you type, the app sends what you type. Each time, the app sends my server your message and the conversation so far, which is passed to the AI model to write the reply. In a debate, the app sends the debate so far, including your questions as moderator. Figures ask your name at the start of a call and may use it; it is just part of the conversation text, comes only from what you say, and is never taken from your account.
• Your conversation settings. Which figure, the year you chose, the app’s language and the language the figures speak, and whether teen mode is on. These shape the reply and are not stored.
• The figure’s words to be spoken. With a figure’s voice switched on, the app sends each sentence the figure is about to say, and the one before it, to be voiced (section 12).
• Debate counts. When you open a debate, my server adds one to a counter for that debate room or that pair of figures. The counter is a single number. Nothing about you is stored with it: no account, IP address, time, language or question.

When you have an account

An account is optional. You sign in with Google or Apple, in the app or on the website’s account page; Yuga never sees or stores a password. When you sign in, I keep:

• an account id, made from a one-way code (a hash) of the provider’s name and its id for you;
• which provider you used and the provider’s id for your account, to recognise you next time;
• your email address, if the provider shares it (with Apple’s “Hide My Email” I only see a relay address);
• your name, if the provider shares it (Apple shares it only on the first sign-in);
• your year of birth, if you give it (the year only), to apply the age rules in section 19;
• when you created the account, when you last signed in, the date the account will be deleted if unused, the date of any warning email about that, and whether you turned on memory of past calls;
• your usage counts: seconds of the figures’ AI voices used (per week on the free plan, per billing month on Plus), how many messages you sent each day, and how many debates of your own you started each week. Numbers only, never the words or the figures, used only to apply your plan’s allowances.

Each sign-in updates your email and name from what the provider sends. Having an account doesn’t change how conversations are handled: they are still not stored.

From Google and Apple when you sign in

The provider asks you to confirm, then sends a signed “ID token”, which I check against the provider’s public keys. Only the basic sign-in scopes are requested (Google: openid, email, profile; Apple: name, email). Google’s token may also carry a profile picture link and language, which I don’t keep. I get no other access to your Google or Apple account: not your contacts, files or mail, and I cannot act in your account.

Technical data

• Request logs. The servers run on Google Cloud Run, which records for every request the time, the address requested, the response, your IP address and your device’s “user agent” (the kind of app or browser and system). Messages travel in the body of requests, not the address, so logs don’t contain what you say.
• Error and timing logs. When something goes wrong, or to measure speed, the server records which figure, which AI model, timings and the error, never the text of the conversation, your account id or your email.
• Rate limits. To stop abuse and runaway costs, the server limits how much each device can send (30 turns in 10 minutes, and 10 reports in 10 minutes), counted by IP address in the server’s memory and never written down.

Emails from me

If you have an account with an email address, I may email you about your account: a warning about 30 days before an unused account is deleted, and notices of important changes to these terms or this policy. Never marketing. They are sent through Resend (see section 16), which receives your email address, name and the message. This email service is built but not yet switched on; until it is, no such emails are sent.

When you write to me

I get your email address, your name if you give it, and whatever you write, and use them to answer you and keep a record.

Yuga Plus and minute packs are being prepared and are not on sale yet; this section describes what will happen when they are (see Subscription Terms). You will buy them in the app, through the App Store or Google Play, with a Yuga account.

• Apple or Google takes the payment, as an independent company under its own privacy policy. Yuga never receives your card or bank details, billing address or payment history.
• RevenueCat (RevenueCat, Inc., United States), my service provider, checks purchases with both stores and tells my server what you bought. The app gives RevenueCat your Yuga account id (a one-way code, not your name or email); RevenueCat’s software in the app also sends it the purchase receipts and basic device and app information, as any in-app purchase does.
• What I keep with your account: your plan (free or Plus), monthly or yearly, which store, the product, when the current period started and ends, whether it will renew, whether it is a free trial, in a billing grace period or paused, whether it was a test purchase, the country of your store account and the price band it falls in (to apply the right allowance), your minute-pack balance, the store ids of packs already credited, how much of the 15 sign-up minutes you have used, and when the last billing update arrived. I also keep the id and time of each billing update from RevenueCat for 90 days, so that none is applied twice.
• This is kept as long as your account, and deleted with it. Apple and Google keep their own purchase records, under their own rules, after you delete your Yuga account.

Plus will include memory of past calls. It is off until you turn it on, and it is the only time Yuga keeps anything from your conversations. (It is built on the server but not yet offered in the apps.) When it is on:

• During a call (after your 2nd message, then every 3rd), your own messages from that call (not the figure’s replies), with what the figure already remembers, are sent to the same AI model (Google Gemini on Vertex AI) with an instruction to write at most six short facts you said about yourself, such as your name, what you study or do, where you live (town or country), your interests, what you asked about, and your plans and opinions.
• The instruction forbids anything about other people, contact details, addresses, identity numbers or passwords, anything said in distress, and anything about health, religion or beliefs, politics, sexuality, ethnicity, money, immigration status or crime unless you plainly said it about yourself. Memory is only for adults: it can't be turned on in teen mode (anyone under 18, or whose age we don't know), and nothing is kept for them. The AI can make mistakes in following this; check what is kept.
• The facts are stored with your account id and the figure’s id, and given to that figure at the start of your next call with them. They are not used for anything else: not for advertising, not to profile you, not shared, not used to train AI.
• You control it: see what each figure remembers, turn memory off (nothing more is added or used; what is kept stays until it expires or you delete it), and delete one figure’s memories or all of them, at any time. Deleting your account deletes them all.
• Kept 12 months after your last call with that figure, then deleted automatically. Figures use memories only while you have Plus and memory is on. The examined figure never remembers.

The legal basis is your consent (GDPR article 6(1)(a); DPDP Act section 6), which you give by turning memory on and withdraw by turning it off and deleting what is kept.

If a figure says something offensive, wrong or unsafe during a call or debate in the app, you can choose Report this reply in the transcript. Sending one is always your choice. A report stores the figure, the reply, your message just before it (check it before sending: it is whatever you said), the reason you pick (offensive, inaccurate, unsafe or other), an optional note of up to 1,000 characters, whether you used the iPhone or Android app (reports sent from the website before 17 October 2026 say “web”), and the time.

A report holds no account id, email address or IP address, so it is not linked to you. It is stored in Google Cloud Firestore in the United States and deleted automatically 12 months after it was sent. Only I read reports, to fix the figures. Because it isn’t linked to your account, deleting your account doesn’t delete a report; to have one deleted sooner, email support@foundationalcreations.com describing it (the figure, roughly when, some of the text).

The apps and the website keep a few things on your own device. They are never sent to me, except as noted:

• Sign-in: a session token and your account details. The token is sent with requests to prove you are signed in. Signing out removes it.
• Settings: your voice choice, your character’s look, your languages (sent with each request so the figure answers in them, not stored), your answer to “Are you 13 or older?”, and whether you’ve seen the welcome screens.
• Call history: for each call, the figure, the year, when it started and ended, how many times you spoke, how many sources you opened, and the figure’s last line (up to 140 characters). Never the whole conversation.
• Saved debates: the two figures, the question, the debate’s turns (including your questions as moderator) and your vote, so you can continue a debate later. When you continue one, the app sends the debate so far with the next turn, as in any debate; the server keeps nothing.
• Titles, level, badges and passport: worked out on the phone from the call history. I never receive them.
• The last few replies’ voice audio, in memory during a call, so you can make a clip; dropped when the call closes.

“Clear call history” on the You tab deletes calls, debates and votes; you can also delete them one by one, or delete the app. On iPhone they can be part of your iCloud or computer backup (except the sign-in token); the Android app is excluded from backups. The full list of items and how long each lasts is in the Cookie Policy.

In the app you can share a quote card or a short video clip of a moment from a conversation, or a badge you earned. They are made on your phone, and shared through your phone’s share sheet to whatever app you choose. Nothing is uploaded to me, and I keep no record of what you share or where.

• A card or clip can include your question (“I asked: …”); you can switch this off in the share preview. On a clip, if you are signed in, your question shows with your name (“Maya asked: …”). Your voice is never in a clip: Yuga never records you.
• Every card and clip says plainly that it is an AI recreation, and the file is marked as AI-made in its metadata. This metadata says nothing about you.
• Once you share something, it is in the hands of the app and the people you shared it with, under their terms. I can’t delete it for you.
• The temporary file is deleted from the app when you close the share screen or make the next one.

When you tap the microphone in a call, the app asks your phone to listen and turn your words into text. The microphone is on only while the app is listening, until you tap again to send or the phone decides you’ve finished. The listening is done by your phone’s own speech service; the audio never reaches Yuga. I only receive the text.

• iPhone and iPad: Apple’s Speech framework, which may process audio on the device or on Apple’s servers under the Apple Privacy Policy. Turn access off in Settings, Privacy & Security, Microphone and Speech Recognition.
• Android: the phone’s system speech service, usually Google’s, which may process audio on the device or on Google’s servers under the Google Privacy Policy. Turn access off in Settings, Apps, Yuga, Permissions.
• The website never listens and never asks for your microphone.

You never have to speak: you can type every message, and then no audio is processed by anyone.

Each time you send a message, in a few seconds:

1. the app sends my server your message and the conversation so far;
2. the server runs a safety check on your message (section 13);
3. it adds instructions describing the figure, built from my notes and from historical sources, and passages from the figure’s own writing that match what you asked;
4. it sends all of this to Google’s Gemini models through Google Cloud Vertex AI, which writes the reply;
5. it streams the reply back to your app, and forgets the conversation.

Conversations are not stored. The server holds the text in memory only while it handles your message; the next message brings the conversation with it again from your device. That is why I can’t show, send or restore a past conversation. The only exception is a reply you choose to report.

What Google does with the text

Google processes the text as my service provider under the Google Cloud terms and data processing terms. Google’s terms for these AI services say it will not use customer data to train or fine-tune its models without permission, and I have given none. Google describes limited short-term storage in some cases, such as caching recent inputs to speed up replies, and keeping data where needed to detect abuse of its service; its terms set how long. See Google’s Vertex AI data governance page and the Cloud Data Processing Addendum. Yuga uses Gemini through Google’s “global” endpoint, so Google may process the text in any region where it offers Gemini.

The code can also run the figures on Anthropic’s Claude models through Google Cloud. This is not switched on; if it ever is, I will update the Service Providers page first.

Please take care with what you share

You don’t need to tell a figure anything personal. If you mention your health, beliefs or other sensitive matters, that text goes to the AI model with the rest of your message. It is not kept (unless it is in a message you include in a report), not used for anything but the reply and the safety check (and, only if you turned on memory, the short facts described in memory of past calls), and never used to profile you. If you’d rather something never left your phone, please don’t say it.

No training on your conversations

I don’t use your conversations or reports to train AI models, and I choose providers whose terms say they won’t either. I test the figures with conversations I write myself.

In a call you choose how the figures sound. Each choice sends different data to different places:

• Google voices (Google Cloud Text-to-Speech, including Chirp and Gemini voices): the server sends Google the sentence to be spoken, the sentence before it, and the voice settings for that figure. The audio comes straight back to your app. Nothing is stored.
• Designed voices from ElevenLabs: prepared but not switched on. If they are, the sentence to be spoken will go to ElevenLabs in the same way, and I will add ElevenLabs to the Service Providers page first.
• Your phone’s voice: the phone reads the words itself. Nothing is sent for voicing.
• Captions only: no voice at all.

The figures’ own voices (Google or designed) need a Yuga account, and count against your plan’s voice minutes.

The figures’ voices are designed for characters. They are not recordings or clones of the real people, and Yuga never clones anyone’s voice, including yours. The examined figure has no AI voice.

Before the AI sees your message, the server checks it for words about suicide or self-harm. If it finds them, the app shows a card with ways to get help now (your local emergency number, and free, confidential helplines at findahelpline.com), and the figure steps out of character. The AI is told to do the same if it sees signs of crisis.

The check runs in memory on the message about to be answered. It stores nothing, doesn’t record that the card was shown and tells no one. Yuga is not a crisis service and no one reads your messages. If you are in danger, call your local emergency number.

Laws like the GDPR require a legal reason (“legal basis”) for each use of personal data. Here they are, with the GDPR article 6 basis. India’s DPDP Act works differently: see section 22.

Where I rely on legitimate interests, I have weighed them against your rights: the data is minimal, short-lived and never used for advertising or profiling. You can object (section 21).

Sensitive information. I don’t ask for it. If you choose to mention it in a conversation it is processed only for the moment it takes to answer and check safety, and not kept unless it is in a report you send.

Consent. Memory of past calls relies on your consent; nothing else does under the GDPR. You can withdraw it at any time, as easily as you gave it, without affecting what was done before.

Permissions on your phone. Your phone asks before Yuga can use the microphone or speech recognition; you can withdraw that in your settings at any time.

If you don’t give data. You never have to give your name or email: an account is optional. A figure can’t answer without your message. Without a year of birth, figures use teen mode, and the examined figure is not available.

Unused accounts. An account not signed in to for 2 years is deleted automatically with everything kept with it. Every sign-in moves the date on. Once email is switched on, accounts with an email address get a warning about 30 days before.

Backups. No scheduled backups of the account database are kept at present. If backups are turned on, this policy will say first how long deleted data can remain in them; deleted accounts will never be restored from them.

Changes the law may require. From 13 May 2027, India’s DPDP Rules 2025 (rules 6 and 8) require data fiduciaries to keep certain personal data, traffic data and logs of processing for at least one year. I am working out with legal advice what that means for Yuga; if it requires keeping anything longer than this table says, I will update this policy and tell account holders before the change.

Service providers (processors)

These companies process data on my behalf, under contracts that let them use it only to provide their service to me and require them to keep it secure:

• Google Cloud (Google LLC, or Google Cloud India Private Limited or Google Cloud EMEA Limited where they are the contracting entity): hosting (Cloud Run), the database (Firestore, United States), logs, secrets.
• Google Cloud Vertex AI, running Gemini: writes the replies from your message text.
• Google Cloud Text-to-Speech: the figures’ voices.
• Resend (Resend, Inc., United States): sends account emails, once switched on.
• RevenueCat (RevenueCat, Inc., United States): checks in-app purchases with the stores and tells my server what you bought, once purchases are switched on (details).

The Service Providers page lists each one, what it gets and where, and is updated before a new one is added.

Sign-in providers and app stores

Google or Apple knows you signed in to Yuga, under its own policy; I send them nothing about how you use Yuga. Apple and Google run the stores you download the app from, under their own policies, and may give me summary statistics and crash reports from people who chose to share them, which don’t identify you.

The apps you share to

When you share a clip, card or badge, it goes to the app and people you choose, not through me.

Legal requests and safety

I may disclose data if the law requires it, for example a valid court order or a lawful request from an Indian or other authority, after checking it and disclosing only what is required; or to protect someone from serious harm. Where the law allows, I will tell you first. In practice there is little to disclose: conversations are never kept.

If Yuga changes hands

If I transfer Yuga to another person or to a company (including one I set up), personal data may pass to them. They would have to respect this policy, or tell you first and let you delete your account before anything changes.

Never sold, never for advertising

I do not sell personal data, share it for targeted or “cross-context behavioural” advertising, or give it to data brokers, and have not in the past 12 months. There is nothing to opt out of; a Global Privacy Control signal is honoured anyway.

• Servers, database and logs: United States (Google Cloud us-central1; Firestore multi-region “nam5”).
• The AI model: Google’s global endpoint, so any region where Google offers Gemini.
• Voices: Google Cloud (United States or other regions Google uses).
• Emails (once on): Resend, United States. Purchase records (once on): RevenueCat, United States.
• Me: I work from India, and may access account data from there to run Yuga or answer your requests.

These countries’ laws may differ from yours. The safeguards:

• From India: the DPDP Act allows transfers except to countries the Government restricts; none is used. I follow any conditions the Government sets under section 16 and rule 15.
• From the EU/EEA: when you use Yuga, you send data directly to me in India, under the GDPR (which applies to me directly). For providers outside the EU: the EU–US Data Privacy Framework (Google is certified) and the European Commission’s Standard Contractual Clauses in Google Cloud’s and Resend’s data processing terms.
• From the UK: the UK Extension to the Data Privacy Framework, or the UK Addendum to the Standard Contractual Clauses.
• From Switzerland: the Swiss–US Data Privacy Framework or Standard Contractual Clauses adapted for Swiss law.
• Elsewhere: contractual safeguards and the mechanisms your law recognises.

You can ask for a copy of these safeguards at support@foundationalcreations.com.

The best protection is not to have the data, which is why so little is kept. For what is:

• all traffic is encrypted with HTTPS (TLS), and Google Cloud encrypts the database and logs at rest;
• no passwords: sign-in tokens from Google and Apple are checked against their public keys;
• session tokens are signed, expire after 90 days and fail if tampered with; on iPhone they live in the Keychain on that device only, on Android in the app’s private storage, excluded from backups;
• secrets are kept in Google Cloud Secret Manager, not in code; only I can reach the production systems;
• logs never contain conversation text, account ids or email addresses;
• rate limits protect against abuse.

If there is a breach

No system is perfectly secure. If a personal data breach happens I will act at once to contain it, and notify as the law requires: under India’s DPDP Rules, each affected person without delay (what happened, the likely consequences, what I’m doing, what you can do, and who to contact) and the Data Protection Board of India without delay, with a detailed report within 72 hours; under the GDPR, the supervisory authority within 72 hours and you without undue delay if the risk is high; and others as their laws require.

Found a security weakness? Please tell me at support@foundationalcreations.com, and don’t access other people’s data while testing.

• Yuga is for ages 13 and up. It is not designed or marketed for children under 13, and the apps are rated 13+. The app asks “Are you 13 or older?” on first launch; answering “under 13” stops the app. An account whose year of birth shows under 13 is refused. If I learn that a child under 13 has given me personal data, I delete it (keeping at most the year of birth on a refused account, so the refusal sticks, until the account is deleted). Parents can write to support@foundationalcreations.com.
• Teen mode is the default. Unless you are signed in with a year of birth showing 18 or over, the figures are told to keep violence brief and without gore, leave romance out and steer away from adult themes.
• The examined figure (Adolf Hitler, questioned to understand how atrocity happened) is only for signed-in adults with a year of birth showing 18 or over.
• Nothing designed to keep you hooked: no streaks, no pressure to come back, no profiling, no advertising, no tracking, for anyone.
• India: under-18s. The DPDP Act treats everyone under 18 as a child and, from 13 May 2027, requires verifiable consent from a parent before their personal data is processed. Before that date, Yuga will either ask for a parent’s verifiable consent for users in India under 18, or not be available to them. See Young People and Parents.

Accounts whose year of birth shows someone is under 13 can’t buy anything; under-18s need a parent’s permission to buy, and Apple’s Ask to Buy and Google Play’s family controls let parents approve purchases. Memory of past calls keeps nothing from the sensitive categories for anyone in teen mode. The Young People and Parents page explains all of this, including the UK Children’s Code and what parents can ask for.

The figures’ replies are written by AI, but no decision with legal or similarly significant effects on you is made by automated means. The automatic steps are: teen mode or adult mode from your year of birth, the crisis check, rate limits and voice minutes. None of them profiles you. If you think one got something wrong (for example, teen mode after you gave an adult year of birth), write to support@foundationalcreations.com and I will look at it myself.

Wherever you live, you can ask me to:

• tell you what personal data I hold about you, how it’s used and who processes it, and give you a copy;
• correct, complete or update it (your name and email come from Google or Apple: change them there and sign in again; your year of birth I can correct on request);
• delete it (do it yourself: Delete Your Account);
• give it to you in a portable format (a JSON file of your account record, usage, plan and memories);
• stop or limit a use, or object to uses based on legitimate interests;
• withdraw consent where something relies on it, as easily as you gave it;
• nominate someone to act for you if you die or become unable to (India);
• complain to me, to the Grievance Officer, and to your data protection authority.

I won’t treat you differently for using your rights. Because conversations aren’t stored, there are none to give you or delete; for reports, which aren’t linked to you, describe the report and I will find it.

The Privacy Notice for India is the standalone notice the DPDP Act and Rules require: what personal data is processed, for what, and how to withdraw consent, use your rights and complain to the Board. It can be read in English or, on request, in any language in the Eighth Schedule to the Constitution. In addition:

• Data Fiduciary: Hriday Vanka, Hyderabad, Telangana, India. Contact for questions about processing (DPDP Rules, rule 9): support@foundationalcreations.com. This contact is given in every reply to a rights request.
• Basis: your consent, given when you start using Yuga and when you sign in, and for data you voluntarily provide for a specified purpose, the “legitimate use” in section 7(a) of the Act. You can withdraw consent at any time (how); processing before withdrawal stays lawful, and after it Yuga may not be able to answer you. Memory of past calls relies on separate consent, given by turning it on; and purchases on your contract with me and the store.
• Consent Managers: you may give, manage and withdraw consent through a Consent Manager registered with the Data Protection Board once registration opens (from 13 November 2026). Yuga doesn’t yet work with one; email me instead.
• Your rights (sections 11 to 14): a summary of your personal data and its processing and of who it was shared with; correction, completion, updating and erasure; grievance redressal; nomination. Your duties (section 15) include not giving false information and not making false or frivolous complaints.
• Time to respond: I acknowledge within 24 hours and answer rights requests within 30 days, grievances within 7 days (the IT Rules’ limit), and in any case within the 90-day maximum the DPDP Rules allow. You must use this grievance route before complaining to the Data Protection Board of India (section 13(3)).
• Children: see section 19. No tracking, behavioural monitoring or targeted advertising of anyone, and nothing likely to harm a child’s well-being.
• Not a Significant Data Fiduciary: only those the Government notifies are, based on the volume and sensitivity of data and the risks. Yuga has not been notified, holds little data, stores no conversations and is run by one person. If that ever changes, I will appoint a Data Protection Officer in India and meet the extra duties.
• Dates: most of the DPDP Act’s duties to individuals apply from 13 May 2027 (DPDP Rules 2025, rule 1). This policy already follows them where it can.
• IT Act: the Grievance Officer under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 is named in section 1.

• Controller: Hriday Vanka (section 1). I have no establishment in the EU or UK; the GDPR applies because Yuga is offered to people there (GDPR article 3(2)). Representative in the EU: none is appointed. Representative in the UK: none is appointed.
• Legal bases: section 14. Only memory of past calls relies on consent; you can withdraw it at any time.
• Your rights (articles 15 to 22): access, rectification, erasure, restriction, portability, objection, and not to be subject to solely automated decisions with legal or similar effects (none are made). I answer within one month, extendable by two months for complex requests, and will tell you if so.
• Complaints: you can complain to the data protection authority where you live or work, or where an infringement happened (in the UK, the Information Commissioner’s Office, ico.org.uk). I would appreciate the chance to fix things first: support@foundationalcreations.com. UK users: complaints to me are acknowledged within 30 days, as the Data (Use and Access) Act 2025 requires, and in practice within 24 hours.
• Transfers: section 17.
• AI transparency: you are always told you are talking to an AI, and shared clips and cards are labelled and machine-marked as AI-generated (EU AI Act, article 50). See AI and Content Policy.

• State privacy laws: laws such as the California Consumer Privacy Act apply to businesses above certain thresholds (for California, for example, annual revenue above US$26.6 million or data of 100,000 or more consumers bought, sold or shared). Yuga is a free app run by one person and does not meet them. I nonetheless give everyone the rights in section 21, and I don’t sell or share personal data or use it for targeted advertising.
• Categories (as California law describes them), collected in the last 12 months: identifiers (account id, email, IP address); personal records (name); characteristics (year of birth); internet activity (request logs; usage counts); commercial information (your plan and purchases, once on sale); short facts about you that a figure remembers, only if you turn memory on; and the content of messages you send to figures (processed, not kept). Sources, purposes and retention are in section 3. None sold or shared; no sensitive personal information used to infer characteristics.
• Children (COPPA): Yuga is not directed to children under 13 and doesn’t knowingly collect their data; see section 19.
• AI disclosure: the figures are always presented as AI recreations, never as people. Crisis support is described in AI and Content Policy.
• Do Not Track and Global Privacy Control: there is no tracking to turn off; a GPC signal is treated as an opt-out of sale or sharing anyway.

Your local law may give you more rights, for example under Brazil’s LGPD, Canada’s PIPEDA or Quebec’s Law 25, or Australia’s Privacy Act. Write to support@foundationalcreations.com and I will honour them. You can also complain to your local data protection authority (such as Brazil’s ANPD, the Office of the Privacy Commissioner of Canada or the Office of the Australian Information Commissioner).

1. For deletion, use the app or the website: Delete Your Account.
2. For anything else, email support@foundationalcreations.com, from the address on your account if you have one, saying what you’d like. If you used Apple’s “Hide My Email”, say so and I’ll write to your relay address.
3. I may ask you to confirm the request from the account’s email address. I will never ask for a password, an identity document or payment details just to verify you. Someone you authorise, or a parent for a child, can ask for you with proof of authority.
4. I acknowledge within 24 hours and answer within 30 days (one month in the EU and UK; less where the law sets a shorter time). It’s free, unless a request is clearly unfounded or excessive.
5. Not satisfied? Use the grievance process, then your regulator: in India the Data Protection Board of India; elsewhere your data protection authority.

The privacy information on the App Store and Google Play pages for Yuga is based on this policy. In short: name, email and user id (with an account), year of birth (if given), usage counts, purchases (once on sale), memories (if you turn them on) and the text of conversations are collected for the app to work; nothing is used to track you or for advertising; audio is never collected by Yuga. If the labels and this policy ever disagree, this policy is what applies, and please tell me so I can fix the label.

Plus, minute packs and memory of past calls are built on the server but not yet offered in the apps; this policy already describes them (plans and purchases, memory). Other features are planned but not built: downloadable transcripts, school accounts, parental controls and analytics. None of them collects anything today. Before any goes live I will update this policy, and where the law requires (for example for analytics cookies, or under the DPDP Act), ask for your consent first.

I update this policy when Yuga or the law changes, and change the date at the top. For important changes I will tell you in advance in the app or on the website, and by email if you have an account with an email address, at least 30 days before they take effect where possible. If a change needs your consent, I will ask for it. Earlier versions are available on request.

Hriday Vanka, Hyderabad, Telangana, India, India. Email: support@foundationalcreations.com. Grievance Officer: Pranay Vanka, support@foundationalcreations.com.