What we collect
- Account data — your email and a hashed password (or your Google/GitHub/Apple identity if you sign in with them).
- Payment records — plan, amount, and Razorpay payment/order ids. We never see or store your card/UPI details; Razorpay processes the payment.
- Code you index — for codebase search (@codebase), the files crenya ai indexes are split into chunks, credentials are removed, and each chunk is sent to OpenAI to be turned into a search vector. We store the chunks and their vectors so you can search them. They are deleted when you delete your account, or automatically after 90 days without re-indexing.
- Prompts and completions — sent to our AI model providers to generate your response, and retained by us only as operational metrics (token counts) needed to run the service and enforce your plan limits. We do not sell your data.
- Device and session ids — crenya ai creates a random id for each install, and our server issues a random id for each open IDE window. We store only a one-way hash of each. They enforce the plan rules: one computer per account, and one active coding session at a time (when you open crenya ai somewhere else, the first window stops and offers "Continue here"). We do not use your IP address or hardware details for this, and these ids are not used for advertising or tracking.
- No usage tracking in the IDE — crenya ai ships with telemetry turned off, and our websites set no advertising or analytics cookies. Errors on our own servers are recorded by our error monitoring without the content of your requests.
Processors
We use Razorpay (payments), AI model providers (to generate responses to your requests), email delivery, error monitoring, and cloud hosting providers as processors. Requests to AI providers carry the content needed to answer them, not your account identity. Content you send is handled by those providers under their own terms, which govern how they may retain or use it. We do not sell your data, and we do not train models of our own.
Which companies process your requests — please read this one
Requests are processed by DeepSeek, on servers in China, or by OpenAI, on servers in the USA. Each account is assigned to one of the two. That includes the code, files and text you send with a request; screenshots and autocomplete always go to DeepSeek. Codebase indexing and search (@codebase) always go to OpenAI, on servers in the USA, whichever provider your account is assigned to, and so does voice input: a recording made with the microphone button is sent to OpenAI to be turned into text and is not kept by us. DeepSeek's terms permit them to use what is sent to them to train their models. Unless DeepSeek confirms in writing that our account is excluded from training, and we update this page to say so, assume that anything sent to DeepSeek may be used for training. OpenAI's API terms state that data sent to its API is not used to train its models; OpenAI keeps abuse-monitoring logs for up to 30 days.
When the assigned provider is unavailable, a request is answered by the other one or by Z.ai (GLM) instead. Z.ai's API terms state that it does not use API content to develop or improve its services. Each provider handles what it receives under its own terms.
You accept this before your first request. crenya ai asks you to read and accept this notice before anything you send reaches a model, and asks again if the notice changes.
Secrets are removed first. Before a request leaves our servers, we replace API keys, access tokens, private keys and similar credentials with a placeholder, so the provider never receives them. This catches common formats, not every possible secret: do not rely on it for data you are not allowed to share. If a file or screenshot shows something you do not want a model provider to see, such as a customer's data or an internal dashboard, leave it out or describe it in words instead.
If we change which providers process requests, or their terms change, we will update this section and ask you to accept the new notice.
Images, web search and code review
- Image generation — when you ask crenya ai to create an image, your description is sent to Black Forest Labs (USA/Germany), whose terms allow them to use it, and the image they return, to train their models. Do not describe confidential material in an image request.
- Web search is off by default. If you turn it on in settings, the search queries the model writes from your conversation are sent to Exa (exa.ai), a third-party search provider.
- Code review ("review my changes") sends the diff you choose to review to the same model providers as any other request, as described above. The result is kept on our servers for up to 15 minutes so that a repeated request does not run, or bill, twice.
Your rights (DPDP Act, 2023)
- Deletion — delete your account from the console (or email us); this deletes your account data and all indexed code. Payment records are retained (anonymised from your profile) as required by Indian tax law.
- Access/correction — email us to access or correct your data.
- Grievance — reach our grievance officer (Crenya Technologies LLP) at info@crenya.com. We respond within 7 working days.
Security & retention
Data is stored on managed cloud infrastructure with encrypted transport, hashed passwords, and daily off-site backups. Account data is kept while your account exists; indexed code until you remove it or delete your account, and automatically after 90 days without re-indexing; payment ledger entries for the statutory record-keeping period.
Breach notification
If a breach affects your personal data we will notify you and the Data Protection Board of India as required by the DPDP Act.