This Privacy Policy explains how Mitr ("Mitr", "we", "us", "our") collects, uses, and protects information when you use heymitr.com and the Mitr chat app (together, the "Service"). It applies to anyone who visits our website or chats with Mitr, whether or not you ever pay for the service.
Questions, requests, or concerns about your data can be sent to hello@heymitr.com at any time — this is also our contact point for grievances relating to how your personal data is handled. We aim to respond within a reasonable time, and in any case within 30 days.
Mitr is intended for people 18 years of age or older. We don't knowingly collect personal information from anyone under 18. If you believe a minor has used the Service and shared personal information with us, please contact us at hello@heymitr.com and we will take appropriate steps to remove it.
Mitr is an AI friend, not a doctor, therapist, lawyer or financial adviser. You can talk to it about everyday life and how you feel, but it is not a crisis service and not a substitute for professional medical, legal or mental health care. What it says is general, can be wrong, and is not advice tailored to your situation — for anything that matters, please check with a qualified professional. See Section 7 for what happens if a conversation suggests you may be in crisis.
When you send a message, it's sent to our server just long enough to generate a reply, then forwarded to our AI provider to actually produce that reply (see Section 5). We do not write your messages to a database or file on our server. Your conversation history is kept in your own browser's local storage, on your own device — if you clear your browser data or switch devices, that history is gone, and we have no copy of it.
Every few messages, Mitr writes a short note about things you've shared (for example what you like to be called, or something you're dealing with) so a new conversation doesn't start from zero. This note is stored in your own browser, not on our server, and you can read, edit or erase it any time from the menu under "What Mitr remembers". To write and use the note, the relevant part of your conversation and the note itself are sent to our AI provider along with your messages, the same way your chat history is. Clearing your browser data erases the note, and we have no copy of it.
The first time you open Mitr, your browser generates a random id (stored locally as heymitr_device_id) and sends it with each message. We use this only to count how many free messages a device has used and to check whether that device is linked to a paid plan — it isn't tied to your name or any other identity unless you also give us your email (below).
We only ask for an email address when you choose to pay for Mitr Plus, or when you want to restore access on a new device. We send a one-time verification code to confirm it's really you. After that:
All payments are processed by Razorpay, a licensed payment gateway. Your card, UPI, or bank details go directly to Razorpay's own secure checkout — Mitr's server never receives or stores them. We only receive a payment confirmation (an order ID, a payment ID, and a signature we use to verify the payment is genuine) so we can activate your plan.
Like any website, our server briefly sees your IP address as part of handling each request. We use it only to apply a short-lived rate limit (to stop bots or scripts from overloading the service) — it isn't stored long-term or linked to your conversations.
If you use the microphone or "speak aloud" features, they run using your browser's own built-in speech capabilities (the Web Speech API). Audio is processed on your device / by your browser, not uploaded to or stored on our server.
Your language choice, currency display preference, and ambient-sound setting are saved only in your browser's local storage, so the app remembers your preferences on that device.
We use Google Analytics on our marketing homepage (heymitr.com) and inside the chat app (heymitr.com/startchat) to understand overall usage — things like how many people visit, which pages are viewed, how long visits last, and roughly what device, browser or region people are using. This is standard, aggregate web analytics, not an ad tracker. Google Analytics does not receive the text of the messages you send to Mitr or the replies you get, and we don't link it to your email address or the device id described above.
Inside the chat app, we keep simple anonymous counters of things like "the app was opened", "a message was sent" or "the upgrade button was tapped", so we can see where people get stuck and improve Mitr. Each count is tied only to a shortened one-way hash of the random device id described above, never to your name, email, IP address or anything you write. If your browser sends a Do Not Track signal, these counters are not sent at all.
Google Analytics sets its own cookies in your browser and is subject to Google's own privacy policy, which governs how Google itself processes that data. We don't use it to identify you personally. If you prefer not to be measured, you can block analytics cookies or use your browser's privacy settings or a content blocker, and Mitr will still work.
Mitr's replies are generated by a third-party AI service (currently, Anthropic's Claude models, accessed via OpenRouter). When you send a message, its content — along with the recent messages in that same conversation, so Mitr has context — is transmitted to that provider to generate a response, then the reply is returned to you. This is the one point where your message content leaves your device and our server to be processed elsewhere; it happens for every message, because it's how the reply gets written.
We don't control how our AI provider's own infrastructure logs or retains data on their side — that's governed by their own privacy and data-processing terms, not this policy. We chose a provider that doesn't use API traffic like ours to train their models, but we'd encourage anyone who wants the technical detail to review OpenRouter's and Anthropic's own privacy documentation.
Because this provider may process data on servers outside India, using Mitr means your message content may be transferred internationally for the moment it takes to generate a reply.
Before generating a reply, Mitr runs automatic checks for language that may indicate someone is in crisis (for example, mentions of self-harm). There are two parts: a fixed list of phrases in English, Hindi and Hinglish, and a second check in which a small AI model reads your latest message, along with the last few messages for context, to catch things the phrase list would miss. That second check is sent to the same AI provider described in Section 6 and uses the same message content; it is not a separate disclosure to anyone else.
These checks happen as part of producing your reply and are not separately logged or stored by us. If either one is triggered, we add crisis-support resources (such as helpline numbers) to Mitr's response, regardless of what the AI itself says, and Mitr will respond more gently and carefully. Neither check is perfect: it can occasionally flag a message that wasn't a crisis, and it can miss one that was. This is a safety measure, not a monitoring or reporting feature: we do not notify anyone or take any action beyond including these resources in your own reply.
| Who | What they receive | Why |
|---|---|---|
| OpenRouter / Anthropic | Your message content and recent conversation history, for that request only | To generate Mitr's reply |
| Razorpay | Your email address, device id, and order/payment details | To process your payment and issue receipts |
| Our hosting provider | Standard web server logs (e.g. IP address, request timing) | To run and secure the website itself |
| Google Analytics | Aggregate usage data for the homepage and chat app (page views, device/browser/region, approximate engagement) — not the content of your messages | To understand how people find and use heymitr.com |
We don't share your information with anyone else, and we don't share it for marketing or advertising purposes. We may disclose information if required to by law, or to protect the safety of a user or the public.
You can ask us, at any time, by writing to hello@heymitr.com, to:
If you're in India, these rights are consistent with the Digital Personal Data Protection Act, 2023. If you're elsewhere, we'll still honour these requests on the same basis.
We take reasonable technical measures to protect the limited data we do store — for example, storage directories that hold account and usage records are configured to block direct public access, and email addresses are never stored in plain text, only as a one-way cryptographic hash. No online service can guarantee perfect security, but we design Mitr to minimise what we collect in the first place, which is itself a form of protection.
If we make material changes to how we handle your information, we'll update the effective date at the top of this page. Continued use of Mitr after a change means you accept the updated policy.
For anything in this policy — questions, requests, or concerns — write to us at hello@heymitr.com.