Privacy Policy

Effective date: 19 October 2026

1. Who we are

Aakalan CSC AI (this website and app at csc-doc-assistant.pages.dev) is made and run by Aaklan Infra Consultancy (“we”, “us”), website aakalaninfra.com. It helps Common Service Centre (CSC) operators and citizens with documents for Haryana SARAL services: checklists, forms, and resizing, compressing or merging scans.

Aakalan CSC AI is an independent private tool. It is not an official app and is not affiliated with, endorsed by or connected to CSC e-Governance Services India Ltd (CSC SPV), MeitY, the Government of Haryana or Antyodaya-SARAL. Always check official information on the SARAL portal or with the department.

2. Google sign-in

To chat with the assistant you sign in with your Google account (“Google sign-in”). Google tells us your:

• name,
• email address,
• Google account id (a number that identifies your account), and
• a link to your profile picture, if you have one. We store this link but do not show the picture in the app.

We use these to sign you in, show your name, keep your usage bill and protect the service from misuse. We never receive your Google password.

How sign-in works. Google sign-in is handled by Firebase Authentication, a Google service, in a project run by Aaklan Infra Consultancy. (While we move to it, some devices may still see Google's older sign-in button, which gives us the same details.) When you sign in:

• Firebase keeps a user record for our app: your Google account id, a Firebase user id, your name, email, profile-picture link, and when you first and last signed in. This lets us see who uses the app in the Firebase console.
• Google says that Firebase Authentication runs only in US data centres, keeps logged IP addresses for a few weeks, and keeps the user record until we delete it. After deletion, Google removes it from its systems within 180 days. See Privacy and Security in Firebase.
• Your browser loads Google's sign-in code (from apis.google.com and our own address, which passes sign-in pages through to Google's Firebase servers). Google may set its own cookies, and Firebase leaves a small entry in your browser storage (“firebase-heartbeat-database”) that records which days the sign-in code was used.

Google's own Privacy Policy applies to Google sign-in and Firebase.

3. Staying signed in (session and cookie)

After you sign in once, our server checks the Google sign-in and creates a session, so you do not have to sign in every time you open the app.

• Your browser keeps one cookie named __Host-aak_sess. It holds a random code and nothing else. It is HttpOnly, so web pages cannot read it, and it is sent only to this website.
• On our server (a Cloudflare D1 database) the session record holds a scrambled form (a hash) of that code, your Google account id, email, name, profile-picture link, when the session started, when it was last used, when it ends, and your browser's “user agent” text (browser and device type, up to 200 characters).
• We do not keep the Google or Firebase sign-in token after this check, either on the server or in your browser. The app also signs out of Firebase in your browser right after this step.
• Sign out (Settings → Account) deletes the session from our server and removes the cookie.

We use no advertising or tracking cookies.

4. Usage bill

Each AI reply and each voice transcription has a cost. To show you your Bill, our D1 database keeps, for your Google account id:

• your email and running totals (cost in US dollars and rupees, number of requests, AI “tokens” used, seconds of voice);
• one line per chargeable request: date and time, the AI model that answered, token counts or audio seconds, cost, and the dollar-to-rupee rate used.

We also keep a small setting with your Google account id that records which AI you use. The bill records do not contain your messages, files or recordings.

5. Data stored on your device

These stay in your browser's storage (IndexedDB and local storage) on your device. They are not uploaded to our server:

• your chats (messages and replies);
• your files: documents you add with 📎, pages you scan with 📷, and files the assistant makes (PDFs, Word files, images);
• your custom instructions for each service;
• small settings, such as your voice language, which file lists are open, whether you closed the “Install app” banner, and your Google account id (so your custom instructions show up even offline).

The app also keeps a copy of its own program files on your device so it opens offline. You can delete chats and files in the app. You can also remove everything by clearing this site's data in your browser settings, or by uninstalling the app. Back up (.zip) saves a copy to a file you choose. That file is your responsibility.

Some file work happens only on your device and nothing is sent: resizing, compressing, cropping, converting and merging. Reading text from a scan (OCR) also happens on your device.

6. AI replies (DeepSeek or Anthropic Claude)

You pick which AI writes the replies. New accounts use DeepSeek. You can switch in Settings → AI model. We save your choice with your account and use it from your next message.

• DeepSeek Flash, through the DeepSeek API. DeepSeek is run by Hangzhou DeepSeek Artificial Intelligence Co., Ltd., a company in China.
• Claude Haiku 5.5, through the Claude API of Anthropic.

Both read your messages and your photos or scans.

Each time you send a message, our server passes these to the AI you picked:

• your message and the earlier messages in that chat;
• your custom instruction for the service, if you set one;
• the names, types and sizes of files you attach;
• your documents: photos, scans and pages of PDFs when the AI needs to look at them, and text read from scans or Word files;
• the results of the file tools the assistant uses.

We do not send your name, email or Google account id to the AI. Whatever is written in your messages and documents is sent as it is, so the AI can read it.

What each company says about this data

DeepSeek. The DeepSeek Open Platform Terms of Service (effective 29 April 2026) apply to the DeepSeek API and follow the laws of mainland China. These terms do not say in which country API data is stored, or whether it is used to improve DeepSeek's models.

Anthropic Claude. Anthropic says that by default it does not use inputs or outputs from the Anthropic API to train its models (Is my data used for model training?). It says it deletes API inputs and outputs within 30 days, except when it must keep them longer to enforce its Usage Policy, when the law requires it, or under a separate agreement (How long do you store my organization's data?).

AI replies can be wrong. Check fees, documents and rules on the official SARAL portal before you apply.

7. Voice input (Cloudflare Workers AI)

When you press 🎤 and stop, your recording (up to about 2 minutes) is sent to our server and then to Cloudflare Workers AI, which runs the Whisper speech-to-text model. The text comes back into the message box. Nothing is sent to the chat until you press Send.

We do not store your recording; we only record its length in seconds for the bill. Cloudflare says it does not keep Workers AI inputs or outputs after a request is finished, does not use them to train AI models, and does not share them with other customers. The processing may happen in a Cloudflare data centre outside India.

8. Hosting and other services

• Cloudflare hosts the website, our server code (Cloudflare Pages Functions) and the D1 database. Like any web host, Cloudflare handles your IP address and request details to deliver and protect the site; see the Cloudflare Privacy Policy. Our data may be stored in Cloudflare data centres outside India.
• Google provides Google sign-in and Firebase Authentication, which keeps a user record for our app in the US (see section 2).
• jsDelivr, a public content network, delivers the text-reading (OCR) program and its language files, and an image helper. Your browser downloads these the first time you use those features. jsDelivr sees your IP address but not your documents.
• If something fails on our server, an error note may be written to Cloudflare's logs, and it may include your Google account id.

We do not use analytics or advertising services. We do not show ads, and we do not sell or rent your personal data. We share data only as described here, or when the law requires it.

9. Other people's documents

CSC operators often handle documents of other people. Please add someone else's ID cards, certificates or other personal documents only when they have asked you to help them with a service. Let them know the chat sends documents to the AI you chose (section 6). Delete their files from the app when you no longer need them.

10. How long we keep data

11. Your rights

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act) you have the right to:

• get a summary of the personal data we process about you, and the names of the companies we shared it with (section 11 of the Act);
• have your data corrected, completed, updated or erased (section 12). We will erase it unless we must keep it by law;
• withdraw your consent at any time (section 6). After that we stop processing your data, and you may no longer be able to use the chat;
• grievance redressal: complain to us and get a reply (section 13). If you are not satisfied after using our process, you can approach the Data Protection Board of India;
• nominate another person to use these rights if you die or cannot act yourself (section 14).

To use these rights, email us from the Google account you use in the app (see section 15). Data on your device is under your control: you can delete it in the app at any time. Under the Act you also have duties, for example not to impersonate anyone and not to file false complaints (section 15 of the Act).

12. Children

Aakalan CSC AI is meant for adults (18 years and older), such as CSC operators. Do not use it if you are under 18. If you believe a child has signed in, contact us and we will delete their account data.

13. Security

The site uses HTTPS. Sign-in sessions use random codes, and only a scrambled form (hash) of each code is stored. Strict browser security settings limit which outside sites the app can contact. Your device data is as safe as your device. Use a screen lock, and do not use the app on shared computers without signing out and clearing its data. No system is perfectly secure.

14. Changes to this policy

We may update this policy when the app or the law changes. We will change the effective date at the top of this page, and for important changes we may also show a notice in the app. If you keep using the app after a change, the new policy applies.

15. Contact and grievances

Aaklan Infra Consultancy
Email (privacy requests and grievances): [email protected]
Website: aakalaninfra.com

Please write “Privacy” in the subject line. We will reply to grievances within 90 days at the latest. See also our Terms of Use.