Enwrite Privacy Policy

Last updated: 28 June 2026 · Effective: 19 May 2026

Enwrite is a keyboard app published by Fanbuff Technology India Private Limited (Gurgaon, India). It rewrites text you select into clearer, politer English using AI. This policy explains exactly what data we collect, why, where it goes, and how to delete it. We follow India's Digital Personal Data Protection Act, 2023 (DPDP Act).

1. The short version

We do not log your keystrokes. Only text you explicitly select and tap Rewrite/AI Generate on is sent to our server.
We do not store the text you rewrite. Our server forwards it to an AI provider, returns the result, and discards it.
If you sign in, we keep your Google name, email, and account ID to track free-tier usage and your Pro subscription.
We never see your card details — Razorpay and Apple handle all payments.
You can delete your account and all associated data at any time from inside the app (Settings → Delete account), or by emailing contact@spectatr.ai.

2. What we collect

2a. When you tap Rewrite or AI Generate

The text in the current input field (only what's selected/rewritten — never surrounding text or keystrokes).
Your IP address, as captured by Cloudflare's CF-Connecting-IP header. Used only for rate-limiting and abuse prevention. Not stored beyond 24 hours.
Your app version, platform (iOS/Android), and a randomly-generated device ID (for anonymous usage and rate-limiting).
If you turn on “Personalize my writing” (off by default): a small anonymous style summary — your preferred formality, typical message length, emoji usage, and common words/sign-offs, all computed on your device — is sent with each rewrite to tailor the output. It contains no message text, and turning the setting off deletes it.

2b. When you sign in with Google

Your Google account name, email address, and Google account ID (sub).
We do not see your password — Google handles authentication. We receive a short-lived token, exchange it for our own session token, and discard the Google credential.

2c. When you subscribe to Pro

Android / desktop / web (Razorpay): Razorpay payment ID, order ID, and signature. We never receive card numbers, CVV, UPI IDs, or billing address.
iOS (Apple StoreKit): Apple transaction ID and signed receipt. We never receive Apple ID or payment details.
Your subscription status is cached on our server for up to 4 hours per refresh.

2d. Locally on your device

The following stay on your device unless explicitly transmitted above:

Session JWT (7-day) and refresh JWT (90-day) — stored encrypted in iOS Keychain or Android EncryptedSharedPreferences (AES-GCM).
Locally-generated device ID for anonymous rate-limiting.

2e. Crash and error reports

If Enwrite crashes, we send an anonymous crash report via Sentry. The report contains a stack trace, app version, OS version, and device model. It never contains the text you were typing, your email, or your account ID.

3. What we do NOT collect

Your keystrokes during normal typing.
Your contacts, messages, photos, calendar, microphone audio, or location.
Hardware device identifiers (IMEI, MAC address, advertising ID).
Browsing history outside of Enwrite.
Card details, bank details, or UPI IDs.

4. Third-party services your data passes through

Enwrite is a thin layer over several specialised services. When you use Enwrite, your data may pass through:

Service	Purpose	Country	Policy
Google AI	Primary AI models (Gemini) — rewrite your text	United States	policies.google.com/privacy
Anthropic	Standby AI model (Claude) — may rewrite your text if the primary models are unavailable	United States	anthropic.com/legal/privacy
OpenRouter	Routing layer between Enwrite and the AI providers above	United States	openrouter.ai/privacy
Google Identity	Issues the sign-in token we verify	United States	policies.google.com/privacy
Razorpay	Handles Android / desktop / web Pro subscriptions and payment	India	razorpay.com/privacy
Apple	Handles iOS Pro subscriptions via StoreKit	United States	apple.com/legal/privacy
Sentry	Anonymous crash and error reports	United States	sentry.io/privacy
Cloudflare	Hosts our server (Workers) and storage (KV); processes the request that carries your text	Global	cloudflare.com/privacypolicy

Each provider operates under its own privacy policy. We encourage you to review them.

5. International transfers

Most of our processing partners are based in the United States. By using Enwrite, you consent to your data being processed outside India. We take reasonable steps to ensure these providers offer protections consistent with the DPDP Act, including encryption in transit (TLS 1.2+).

6. How long we keep things

What	Kept for
Text you rewrite	Not stored by Enwrite. AI providers may retain briefly per their policies.
IP address (rate-limiting)	Up to 24 hours
Anonymous device ID counter	48 hours after last activity
Signed-in daily usage counter	Until end of UTC day + ~48 hour grace
Session JWT (on your device)	7 days
Refresh JWT (on your device)	90 days
Account record (name, email, Google ID, subscription)	Until you delete your account
Subscription status cache	Refreshed every ~4 hours
Crash reports (Sentry)	Per Sentry's default retention (~90 days)

7. Your rights under the DPDP Act, 2023

Right to access. Request a copy of personal data we hold about you. Email contact@spectatr.ai.
Right to correction. Ask us to correct inaccurate or outdated data.
Right to erasure. Request deletion of your account and all associated data. We process erasure requests within 30 days. Active Pro subscriptions must be cancelled before final deletion (your subscription continues until the end of the billing period; account deletion happens after).
Right to grievance redressal. Contact our Grievance Officer (below). We respond within 30 days as required by the DPDP Act.
Right to nominate. You may nominate another person to exercise your rights on your behalf in the event of death or incapacity. Email us to register a nominee.

How to delete your account: the fastest way is in the app — go to Settings → Delete account, which immediately and permanently deletes your account record and all associated data. Alternatively, email contact@spectatr.ai from the address linked to your Enwrite account with the subject line "Delete my account"; we confirm within 7 days and complete deletion within 30 days. Crash analytics (Sentry) are anonymous and cannot be linked back to you.

8. Children

Enwrite is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided data to us, please email contact@spectatr.ai and we will delete it. Sign-in via Google requires a Google account, which has its own age requirements.

9. Security

All network traffic uses HTTPS (TLS 1.2+).
Session tokens are HMAC-SHA256-signed by our server, with single-use refresh-token rotation and family-wide revocation on misuse.
Tokens on your device are stored in OS-secured stores: iOS Keychain or Android EncryptedSharedPreferences (AES-GCM).
Payment is handled entirely by Razorpay (Android/desktop/web) and Apple (iOS) — your card and bank details never touch our servers.

10. Permissions Enwrite asks for

Internet access — required to send selected text to the AI rewriting service and receive the result.

Enwrite does not ask for contacts, camera, microphone, location, storage, SMS, call log, or any other sensitive permission.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via an in-app prompt and a banner on this page. The "Last updated" date at the top reflects the most recent change. Continued use of Enwrite after a material change means you accept the updated policy.

12. Contact

Fanbuff Technology India Private Limited
Gurgaon, Haryana, India

General queries: contact@spectatr.ai
Grievance Officer (per India DPDP Act, 2023): Chetan, contact@spectatr.ai — response within 30 days.