Privacy Policy

Last updated 07/11/2026

1. Information We Use

When you create an Indoone account, you may provide your email address, mobile number, and password. This information is used for account authentication and account management.

2. OTP Verification

Indoone uses OTP verification for account creation and login. Your email address and required verification information may be sent to the IndoVerification service to request and verify OTPs.

3. Firebase

Indoone uses Firebase services for authentication and certain account profile information. Your registered email address, mobile number, and account identifier may be stored in Firebase services as required for these features.

4. Authenticator Accounts

Authenticator accounts and related information added to Indoone are stored in the app's encrypted local vault. Backup and recovery features may use this information when you choose to create or restore a recovery backup.

5. Account Changes

You can change your registered email address and mobile number from Profile. On the website, Forgot Password sends a reset link to your registered email, and that link is how a password is changed there. The Android app has no password reset yet, and an account you can no longer sign into cannot be recovered for you.

6. Trash and Deleted Accounts

Deleted authenticator accounts may remain in Trash for up to 30 days and may be restored during that period. After the retention period, they may be permanently removed. Trash restoration is not Indoone account recovery.

7. Backup and Recovery

Authenticator accounts are kept in an encrypted vault on your device and synced to your account, so signing in on another device brings them back. The website can produce a recovery PDF. The Android app has no separate backup file yet. You are responsible for keeping your password, your PIN and any recovery file you export secure.

8. Security

Indoone may provide App Lock, PIN protection, biometric authentication, Auto-Lock, and screenshot protection for supported features. These measures are intended to improve security but cannot guarantee complete protection against every security risk.

9. Third-Party Services

Indoone may use third-party services such as Firebase and IndoVerification to provide authentication, OTP verification, and related functionality. These services may have their own privacy policies and terms.

10. Data Sharing

Indoone does not sell your personal information. Information may be processed by third-party services when necessary to provide authentication, OTP verification, or other supported technical functionality.

11. User Responsibility

You are responsible for protecting your password, PIN, authenticator information, recovery files, and device. Unauthorized access to your device or recovery information may affect the security of your data.

12. The Assistant and Your Messages

When you send a message to the Indoone assistant, the text of that message and a short summary of recent messages in the same conversation are sent to a third-party AI model provider (currently Google Gemini, with Microsoft Azure as a fallback) so that a reply can be generated. Messages are used to answer you; they are not sold. Conversation content is retained only as long as it is needed to show you your history, and you can delete a conversation from the app.

13. Sensitive Information Masking

Before a message reaches the AI model, Indoone automatically detects and masks Aadhaar numbers, PAN, IFSC codes, UPI identifiers, card numbers, phone numbers and email addresses. The masked placeholders are what the model receives. This masking is automatic and does not require any action from you, and it is not a substitute for not sharing information you do not need to share.

14. Connected Services

You may connect GitHub, Gmail or Zoho Mail. When you ask a question that needs one of them, Indoone reads only what that question requires and passes the result to the AI model so it can explain it. Access tokens are stored securely and are never included in what the model sees, in logs, or in a reply. You can disconnect a service at any time, and no further reads happen after you do.

15. Voice

The app uses the speech engine on your phone to turn your voice into text, and the phone's own text-to-speech to read a reply aloud. The recording goes to that engine, which your device or its speech service provides - Indoone does not receive or keep the audio. The transcript follows the same path as a typed message, described above.

16. Running Code

Where the code feature is enabled, a snippet you ask the assistant to run is executed on Indoone's server in a restricted process with time and memory limits. The code and its output are used to answer you. Nothing you run has access to the network or to other users' data, and nothing is kept after the answer is produced.

17. Shared Conversations

You can create a link that shares a conversation. A share link is public to anyone who has it, and it does not expire unless it is removed. Treat a share link as you would a public post: do not create one for a conversation containing something you would not want a stranger to read.

18. Usage Records

Indoone records how many tokens a message used and what it cost, so that the service stays affordable and so that limits can be applied fairly. These records contain counts and costs, not the content of your messages.

19. Privacy Policy Changes

Indoone may update this Privacy Policy when features, services, or legal requirements change. Updated information may be published within the app or through an official Indoone channel.

20. Contact

Email: indoone@zohomail.in