This policy explains what personal data ViralWise collects, why, how long we keep it and the rights you have. It follows India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. The app shows a shorter, itemised privacy notice (version n1); this policy says the same things in more detail.
1. Who is responsible
The Data Fiduciary is Ritesh Relwani, an individual based in India, who runs ViralWise. One address handles support, privacy requests and grievances: support@viralwise.app. We reply within 90 days.
2. Consent
- Your account runs on your consent. Before you use the app, we show the privacy notice. The sign-in button reads "Agree and continue with Google", with a statement below it that you are 18 or older and accept the Terms and the notice.
- Before you agree, we process only what is needed to show you the notice: the account record Google gives us (name, email, picture), a sign-in session and a sign-in log entry. If you don't agree, you can sign out, download your data or delete your account at once.
- Usage statistics are separate and optional. They are off unless you say yes.
- Withdrawing is one click in Settings → Privacy, for the account or for statistics. If you withdraw consent for the account, connected browsers and AI apps are disconnected at once and the account is erased after 30 days unless you agree again. "Delete my account" erases it at once. Withdrawal doesn't affect processing done before it.
3. What we collect, why, and for how long
| Data | Why | How long |
|---|---|---|
| Your Google account name, email address and profile picture | Sign you in and identify your account | Until you delete your account |
| Sign-in sessions: a session token, your browser (user agent) and a one-way hash of your IP address | Keep you signed in and secure | 30 days per session |
| Sign-in and account records (time, browser, IP hash): sign-ins, sign-outs, data exports, deletion | Security, and the 1-year log retention the DPDP Rules require | 1 year, also after account deletion |
| The creators, reels, bookmarks, tags, collections, notes and share links you save | Your library and research features | Until you delete them or your account |
| Scans you run (time, creator, reel counts) and a one-way hash of the Instagram account you scan from | Run scans, plan limits, and the daily safety cap that protects your Instagram account | Scans: 1 year. Instagram account hash: 1 year (the last 2 days are kept after deletion, so deleting cannot reset the safety cap) |
| Transcriptions and AI insights you request, credits used, and the days you used the app | Your usage history, credits and plan limits | Until you delete your account |
| Connected browsers (extension) and AI apps you connect | Let the extension and AI apps act for you | Until you disconnect them or delete your account |
| Subscription and payment records (via our payment provider; we never see your card) | Billing, invoices, tax and accounting | As long as tax and accounting law requires, also after account deletion |
| Invite links: who invited you, who you invited, and a check whether you signed up from the same network as your inviter (from IP hashes) | Referral rewards and preventing self-referral | Until you delete your account |
| If you join the affiliate program: payout details (UPI or bank, stored encrypted) and payout history | Paying your commissions | Payout details until you delete your account; payout history as accounting law requires |
| Your nominee's name and email, if you add one | Let them exercise your rights if you cannot | Until you remove them or delete your account |
| A record of the emails we send you (which kind, when, whether it was delivered; not the text) | Account and security emails (new browser connected, account deleted, collection invites, payouts) and proof they were sent | 1 year |
| Your consents and withdrawals (with this notice's version and an IP hash) | Prove what you agreed to | Until 1 year after your account is deleted |
| Where your account first came from (referring website, campaign tags, first page type), only if you allowed usage statistics | Understand which channels bring people | Until you delete your account |
Usage statistics, only if you allow them:
| Data | Why | How long |
|---|---|---|
| Page type visited (never which creator), referring website, campaign tags, country, device type, and a visitor key that changes every day | Count visits and improve the product | About 3 months, in anonymous aggregate form |
Emails we send are account and security emails, collection invites, payout notices and replies to removal requests. We don't send marketing email.
4. The Chrome extension
- It works only on
instagram.com/<handle>/reels/and reads only the Reels data Instagram has already loaded on that page. - It does not read your DMs, contacts, cookies, feed or stories, and never asks for your Instagram password.
- A device key stays in your browser; we store only its public half.
- Your own Instagram account id is stored only as a one-way hash, for the daily safety cap.
5. Public creator data (the catalogue)
When users browse or scan Reels tabs, we store public Instagram profile and reel data: handle, name, bio, follower counts, views, likes, comments, captions, posting time, audio and thumbnails, and transcripts of public reels.
- The DPDP Act does not apply to personal data that the person has made publicly available themselves (section 3(c)(ii)). We still keep this data minimal and honour removal requests.
- Creators can ask us to hide their profile, stop collecting it, or delete its data at Remove my profile. We verify requests with a code placed in the bio or sent by DM.
- Videos are stored for 15 days, then deleted. Thumbnails, profile pictures and transcripts are kept. Metric history is kept for 180 days.
6. Who can see what
Data from any user's scan can appear to other users as scores, transcripts and public creator profiles. Other users' private libraries, notes, collections and scans are never shown, unless their owner shares them. Shared collections and reports are visible to the people or link holders their owner chooses.
7. Processors and transfers outside India
We use these providers to run the service: Cloudflare (hosting, storage, AI models and sending email), Google (sign-in), Dodo Payments (payments, as merchant of record; we never see your card) and speech-to-text providers. Some of them process data outside India. The DPDP Rules allow this unless the Government of India restricts transfers to a country; we will follow any such restriction.
8. Your rights
- Access and a copy: Settings → Your account → Export my data (JSON, including consent and sign-in records).
- Correction: update your Google profile, or email us.
- Erasure: Settings → Your account → Delete my account. A paid plan must be cancelled first, and a recent sign-in is required. Payment records and the 1-year sign-in log are kept as the law requires. Catalogue entries remain, but your link to them is removed.
- Withdraw consent: Settings → Privacy, at any time.
- Nomination: name someone who may exercise these rights if you die or become unable to (Settings → Privacy).
- Grievances: email support@viralwise.app. We reply within 90 days. If we don't resolve it, you can complain to the Data Protection Board of India.
9. Children
ViralWise is only for people aged 18 or older. Users confirm they are 18 or older before using it. We don't knowingly process children's data, and we delete it if we learn of it.
10. Security and breaches
We use encryption in transit, encrypt sensitive fields such as payout details, limit access, and keep security logs for 1 year. If a personal data breach happens, we will tell affected users and the Data Protection Board of India without delay, and send the Board a detailed report within 72 hours.
11. Retention summary
- Videos: 15 days
- Sign-in logs and scan records: 1 year
- Backups: 30 days by default
- Usage statistics: about 3 months, anonymous
- Account data: until you delete it
12. Cookies and browser storage
This website sets no cookies. To show prices in rupees or dollars it checks which country you're visiting from (through Cloudflare, without storing it); if you pick a currency yourself, that choice is kept in your browser's local storage. It uses no analytics or trackers. If we add cookieless visit counting later, it will load only after you agree.
The app (app.viralwise.app):
- uses one sign-in cookie (essential);
- stores your usage-statistics choice in local storage (essential, to remember it);
- only if you allow statistics, also stores this tab's source (session storage) and where your browser first came from (local storage, sent only when you create an account). Saying no, or turning statistics off, deletes them.
There are no ad trackers. Browsers that send Global Privacy Control or Do Not Track are treated as "no".
13. Language
This policy is in English. Email us to receive it in any language listed in the Eighth Schedule of the Constitution of India.
14. Changes
When the privacy notice changes, it gets a new version and everyone is asked to agree again. We'll update this page at the same time.