Privacy Policy

Let Roast (sole proprietor: Saharsh Pamecha), HSR Layout, Bengaluru, Karnataka, India, is the data fiduciary for the personal data described here. For any question or request, write to Saharsh Pamecha at letroast@gmail.com. A real person reads it.

What you type into the form. Your first name, your sibling's first name, your relationship to them, a handful of habits or facts, your choice of language, tone, narrator and song style, and — if you write one — the private note about what you secretly love about them. We call this your brief.

What we generate from it. The roast script, song lyrics, spoken audio, song audio, cover art and share video.

Your account, if you make one. Your email address, and a password we never see in readable form. If you sign in with Google, see clause 8.

Technical data. Your IP address, kept briefly and used only to rate-limit abuse, because each generation costs us real money. Standard server logs.

Payment data. Handled entirely by Razorpay. We receive a payment reference and its success or failure. We never see, receive or store your card number, UPI PIN, CVV or bank credentials.

Product analytics — on by default, and you can turn it off.Anonymous usage events: which steps people finish, which stages fail, what a generation costs us. It never contains your names, your facts or your note. If you would rather not be counted, say so at letroast@gmail.com and we will switch it off for you — the product works exactly the same either way.

We do not ask for, and do not want, your date of birth, postal address, government ID, contact list or precise location.

This changed, and it changed in your favour, so we want to be blunt about it. We used to throw your brief away and we now keep it, because people kept asking for the two things it makes possible: reading back what they wrote, and making a new roast from it without typing everything again.

The finished gift — the audio, the song, the artwork — lives behind an unguessable link so you can send it. Those files are deleted about 90 days after the last activity on a roast, which is why an old link eventually stops working. If you want a gift pulled sooner than that, write to letroast@gmail.com with the link and we will remove it.

One honest exception, and it is about money. If you paid, the record of that payment — what was bought, when, for how much, and the invoice — is kept separately for about six years. Indian tax law requires it and we are not allowed to delete it on request. So deleting your brief erases what you wrote; it does not erase the fact that a purchase happened. Nothing in that record contains your facts or your note.

Filling in the form needs no account. Paying does, and here is the honest reason: money creates obligations we cannot honour to an anonymous browser.

• Your ₹151 payment is recorded against your account, so you can always point us at it.
• Your gift lands in your library, so you can resend it if the link gets lost.
• If a payment fails, double-charges, or the gift never arrives, we can find your purchase and refund or fix it. Without an account we genuinely cannot.

We ask for it at the pay gate and not before, so you can see exactly what you are buying first. The account gets you an email address and a password. That is all.

If you are the person who was roasted, you can have the whole thing deleted by writing to letroast@gmail.com with the link. We will not ask the sender for permission and we will not ask you to justify the request.

• To create and deliver your gift — performance of our contract with you, on the consent you give when you submit the form.
• To keep your briefs for you — the consent you give by using an account, which you withdraw by deleting them.
• To take payment and issue refunds — contractual necessity and our legal obligations.
• To keep tax records — a legal obligation under Indian law, which outlives your consent.
• To prevent abuse and runaway cost — our legitimate interest in not being bankrupted by a bot.
• To keep the product working — aggregate analytics and error reporting, on our legitimate interest in knowing which step is broken, which you can object to at any time by writing to us.

We do not use your data for advertising, we do not sell it, and we do not use your brief or your generated roast to train AI models.

Making your gift means sending your brief to specialist providers who do the work we cannot do ourselves. We use them in these categories:

• AI model providers — for writing the roast, performing it as speech, composing the song, and producing the artwork.
• Hosting and file storage — for running this site and holding your finished gift so its link works when you send it.
• Our database provider — for your account and your saved briefs.
• Our payment gateway — an Indian, RBI-regulated processor. They handle the card or UPI details; we never see them.
• Product analytics — usage statistics only, never your brief.

Some of these process data outside India, including in the United States and the European Union. By submitting a brief you consent to that transfer. We use every one of them under commercial API terms on which content we send is not used to train their models, and we do not sell your data or use it for advertising with any of them.

If you want to know exactly who processes your own data — you are entitled to ask — write to letroast@gmail.com and we will tell you, naming names.

You can sign in with Google instead of a password. If you do, Google tells us your email address, your Google account id, and — if your profile has them — your name and profile picture. That is all we receive, and we use it for one thing: knowing which library is yours.

We do not get access to your Gmail, your contacts, your Drive or anything else, and we never post anything anywhere. Google will know you signed in to a service called Rakhi Roast; it learns nothing about who you roasted. You can revoke our access from your Google account at any time, and you can use email and a password instead if you would rather Google were not involved.

Strictly necessary, always on. If you sign in, a session cookie keeps you signed in — take it away and an account cannot work. One browser storage entry remembers whether you chose light or dark mode. There is nothing to consent to here, and neither one tracks you anywhere else.

Analytics, on by default. Product analytics and session recording are how we find out which step people get stuck on. They are on unless you ask us to turn them off, and they carry no names, no facts and no note — only which screens were used and what a generation cost us. Ask at letroast@gmail.com and we will switch it off for your browser; nothing about the product changes either way.

When analytics are on, what you type into the form is still hidden from session recordings, and your facts, your note and both names are never sent as event data. Analytics tells us that a step was completed, not what was written in it.

We use no advertising cookies and no cross-site tracking, whether you consent or not.

Under the Digital Personal Data Protection Act, 2023 you can ask us to give you a copy of your data, correct it, delete it, or tell you who we shared it with. You can withdraw your consent, and you can nominate somebody to exercise these rights if you are unable to.

The fastest route needs no email at all: your briefs are visible and deletable by you in your roasts. For anything else — a copy of your data, deleting your whole account, a gift taken down — write to letroast@gmail.com and we will respond within 30 days. The one thing we will say no to is deleting a payment record, for the tax reason in clause 3.

If you are unhappy with our response you may complain to the Data Protection Board of India.

Everything travels over HTTPS. Your saved briefs sit behind row-level security in our database, which means the rule “only the owner may read this row” is enforced by the database itself rather than by us remembering to check. Your generated audio, song and artwork sit behind unguessable links, and the paid files are served only after we have verified your payment on our own servers — the check is not done in your browser, so it cannot be skipped. Access to production credentials is limited to the operator.

No system is perfect. If a breach ever affects your data we will notify you and the Data Protection Board as required.

The service is not directed at children under 18, and we do not knowingly collect data from them. If you believe a child has submitted data, write to letroast@gmail.com and we will delete it.

If we change this policy the date at the top changes with it. If a change materially affects how we use data you have already given us — as the change in clause 3 does — we will ask for your consent again rather than assume it.