Privacy Policy

DevLune (“we”, “us”) is a software studio run by Sidharth from Hyderabad, India. This one policy applies to the DevLune website, the client portal and client rooms, and every application we publish or operate: Android apps on Google Play, desktop apps for Windows, macOS and Linux, web apps and SaaS products, browser extensions, APIs, and products we build and host for clients. If you reached this page from an app store listing, a sign-in screen, or an OAuth consent screen, this is the policy for that product.

Products covered today:

• devlune.in (Website and client portal): Marketing site, estimate and contact forms, private client rooms at /client, admin portal at /portal.
• DevLune app (Android app): The client's side of a DevLune project. Sign in with Google or email; we keep your name, email, a push-notification token per device, what you upload or write in a project, and payments you report. Shown to no third party. Delete the account from Settings; project records stay as contracts and invoices.
• LearnFlow (Desktop and web app): Course player. Optional Google sign-in to stream videos from your own Google Drive. Progress stays on your device unless you opt in to sync.
• SysWatch (Desktop agent and Android app): Real-time system telemetry paired with a short code. Metrics relay through our realtime backend and are not stored long term.
• Aurora (Desktop app): Music player. Connects to streaming providers you choose to sign in to; credentials stay on your device.
• Membrain (Self-hosted tool and hosted service): Memory ledger for AI assistants. Self-hosted data never reaches us; the hosted version stores what you save under your account.
• Humanize (Web app): Text rewriting. Submitted text is processed by an AI provider to produce the result and is not used to train models.
• DevLune Webmaster (Web dashboard): Site analytics for sites you own. Collects page views and performance events from those sites under your account.
• HanuMart (Android app): Grocery shopping app with its own account system; see also the in-app policy pages hosted at devlune.in/hanumart.
• Raseed (Desktop app): Billing software activated with a licence key bound to your machine; invoices and customers stay in your local database.
• DevLune Inspector (and PE Inspector, APK Inspector) (Desktop app): Read-only static analysis of Windows PE binaries and Android packages. Files you open are read on your machine as data and are never uploaded, executed, or modified. No account, no licence key, and no analytics. The only network activity is a signed auto-update check and, if you open the Learn course, downloading its lessons from devlune.in.
• Bespoke (Web app): Free, open-source AI resume builder at resume.devlune.in. No account; your resume is stored only in your browser. Only the text you send to your chosen AI provider leaves the device, and a local model or manual copy-paste mode sends nothing. Nothing per-user is stored on our servers, so there is no account to delete.
• repo-sweep (Web page): Free, open-source page that bulk-manages the GitHub repositories you own, at siddhu123m.github.io/repo-sweep or from the file itself. No account and no server of ours: the GitHub token you paste stays in your browser and is sent to api.github.com only; the page loads nothing from any third party. Nothing per-user is stored on our servers, so there is nothing to delete.
• Client builds (Apps and sites we build for clients): Where DevLune hosts or operates a product on a client's behalf, this policy applies to the parts we operate. The client's own policy governs their business data.

New products we release are covered from the day they ship, and the list above is updated when they do.

We collect as little as each product needs to work. Depending on the product, that can be:

• Account details you give us when you sign up or sign in: name, email address, and for social or Google sign-in the identifier and profile basics the provider shares.
• What you submit: messages through our forms, estimate answers, files you upload to a client room, text you paste into a tool, comments and ratings.
• Product data you create inside an app: course progress, playlists, saved memories, invoices, analytics events for sites you own, system metrics you chose to share.
• Device and technical data: device model, operating system version, app version, language, crash reports, and a machine fingerprint for licence-locked desktop software.
• Usage and analytics: pages visited, features used, approximate location from IP address, referrer and UTM parameters. We use privacy-respecting analytics and Meta's Conversions API for our own marketing site only.
• Payment records: invoice and payment status. Card and bank details are entered with the payment provider (Razorpay or your bank), never stored by us.

We never ask for, and never store, passwords in plain text, government identity numbers, or payment card numbers.

We process data to perform the service you asked for, with your consent where the law requires it (for example optional sync, marketing emails, or access to your Google account), and for our legitimate interest in keeping products secure and improving them. India's Digital Personal Data Protection Act, the GDPR for people in the EU and UK, and similar laws elsewhere give you rights over your data: access, correction, portability, deletion, and withdrawal of consent. Email us and we will act within 30 days.

We do not sell personal data and do not share it with advertisers. We do not send marketing email unless you asked for it, and every such email has an unsubscribe link.

Hosted data is stored with Supabase (PostgreSQL, Mumbai region) and, for some products, Firebase, Cloudflare (KV, D1, R2) and Upstash. Files are stored in private buckets with signed access. Connections use TLS, secrets live in environment configuration rather than code, and administrative access is limited to Sidharth with multi-factor authentication.

Desktop apps keep your data on your machine in their own application folder. Licence files are signed so they can be checked offline without contacting us. Uninstalling the app removes the local database unless the app offers a separate export.

No system is perfectly secure. If we learn of a breach that affects you, we will tell you without undue delay.

Products that connect to your Google account (for example LearnFlow, which reads the Google Drive folders you pick to stream course videos, or Google sign-in in any of our apps) comply with the Google API Services User Data Policy, including the Limited Use requirements. Use of information received from Google APIs is limited to providing or improving the user-facing features of that product.

Scope: we request the narrowest scopes that work. For Drive that is read access to files you explicitly select or share with the app, never your whole Drive.

Storage: Drive file contents are streamed and never stored on our servers. OAuth tokens and the folder structure are cached on your device (the app or your browser) only.

No transfer: Google user data is not transferred to third parties except as needed to provide the feature, for security, or as required by law. It is never used for advertising and never used to train AI or machine learning models.

Deletion: signing out revokes and deletes the tokens on your device. You can also revoke access at any time from your Google Account permissions page.

We rely on these providers, each under their own privacy policy and a data-processing agreement where applicable:

• Hosting and infrastructure: Vercel, Cloudflare, Supabase, Firebase (Google), Upstash.
• Email: Resend, for transactional and requested emails. Open and click tracking is enabled on studio emails so we know a proposal reached you.
• Payments: Razorpay for Indian payments; international clients pay by bank transfer or a link we share after signing.
• Scheduling: Calendly, when you book a call.
• Sign-in providers: Google, Facebook and Instagram (Meta), where a product offers them.
• Analytics and ads: privacy-respecting page analytics and Meta's Conversions API on devlune.in only. No ad tracking inside our apps.
• App distribution: Google Play, which collects its own install and crash statistics.
• AI providers: as described above, under API terms that exclude training.

Self-hosted versions of our open-source tools (such as Membrain) run entirely on your infrastructure; nothing from them reaches us.

Any account or product: email sidharth@devlune.in with the subject “Delete my data” from the address on the account. We confirm within 7 days and remove everything we are not legally required to keep (signed agreements and invoices are retained for accounting). Apps with an in-app delete option (HanuMart, Membrain hosted, Webmaster) remove the account immediately.

Facebook and Instagram sign-in: see devlune.in/data-deletion, which also serves as the Meta data-deletion callback. Google: revoke access from your Google Account and sign out of the app.