RankingTiger Privacy Policy

Draft — have a lawyer review before publishing.
Text in square brackets marked [CONFIRM: ...] must be filled in or checked before this page goes live.

Draft prepared: October 23, 2026
Effective date: [CONFIRM: date of publication]
Published at: https://rankingtiger.com/privacy

1. Who we are

RankingTiger is an app for iPhone, Android and the web (at RankingTiger.com). It helps you find topic ideas, write ranking-style video scripts with AI, translate them, record or import short videos, add captions and pictures, and edit them.

The RankingTiger service is operated by:

• Company: Athelp Info Solutions Pvt Ltd
• Contact email for privacy questions: support@athelp.in
• Business address: 15, Block A, Lok Vihar, Pitampura, Delhi 110034, India

In the language of Indian law, we are the Data Fiduciary and you are the Data Principal. In the language of the EU and UK GDPR, we are the controller. This policy uses plain words ("we", "you") and covers all of these roles.

This policy explains what personal data we collect, why, who we share it with, how long we keep it, and what choices you have. It is written from how the app and our servers actually work on the date above.

Please also read our Terms of Service and our Refund and Cancellation Policy.

2. Short summary

• We collect only what the app needs: your sign-in details, the content you send to our AI features, your credit and plan records, and basic technical data.
• Your scripts, recordings, edit projects and settings are kept on your own device. We do not keep copies of them on our servers. Two exceptions: the text and audio you send for AI processing (sections 5 and 6), and the results of AI jobs, which we keep for up to 7 days (section 8).
• When you use an AI feature, your inputs are sent to third-party AI providers through OpenRouter. Those providers may use your inputs to train their own models. We do not train AI models on your content. Read section 5.3 before you use AI features.
• We do not use analytics tools, crash-reporting tools, advertising tools or tracking. We do not sell your data.
• You can delete your account inside the app (Me tab, then Delete account). It deletes your account and the data tied to it (section 12.1).
• Our main database is in India (Supabase, Mumbai region). Several providers we use are outside India (section 9).
• RankingTiger is for people aged 18 and over (section 10).

3. What information we collect

3.1 Information you give us

3.2 Records we make when you use the app

3.3 Information stored only on your device

Scripts, recordings, edit projects, video projects, your recent AI results, your language and currency choices and teleprompter settings are stored in your phone's or browser's storage. On iPhone and Android, your sign-in session is encrypted on the device with a key kept in the phone's secure storage. We cannot see these files. If you uninstall the app or clear your browser data, they are gone.

3.4 Device permissions

The app asks for these permissions only when a feature needs them:

• Camera and microphone: to record videos in the Teleprompter (Record) screen. Recordings are made and kept on your device.
• Photo and video library, or file picker: only when you choose to import a video, and (to save) when you export a video to your photos.
• Sign in with Apple or Google: the provider shares the details you approve with us (for example your name and email).

We do not ask for your precise or approximate location, your contacts, or an advertising ID. We do not use face recognition, and we do not create facial templates or other biometric identifiers from your video. The framing guide in the recorder is a drawing on the screen only.

3.5 Information we do not collect on purpose

• Card numbers, bank account numbers or UPI PINs. Payment pages are run by Apple, Google, or Razorpay.
• Government identity numbers (such as Aadhaar or PAN), unless you send them to us in a support message.
• Your precise location, contacts, or advertising identifiers.
• Information from anyone under 18 (section 10).

3.6 Please keep sensitive details out of your prompts

The AI features may be used for health, money and other sensitive topics. A script about a health topic is content about the topic, and we do not ask for health information about you. Please do not type your own medical details, or personal details of other people, into AI inputs. Anything you type is sent to the AI providers (section 5).

4. Why we use your information and our legal basis

We use personal data only for the purposes below. Under the India Digital Personal Data Protection Act, 2023 (DPDP Act) we rely on your consent, and on the limited "legitimate uses" the DPDP Act allows (such as complying with the law). You give consent when you create an account and when you use a feature that sends your content to AI providers. [CONFIRM: the app does not yet show this policy, or ask for consent, on the sign-up screen. Add a notice and consent step before launch. See docs/LEGAL-CHECKLIST.md.] Under the EU and UK GDPR we rely on the bases listed in the last column.

We do not use your data to make decisions that have a legal or similarly significant effect on you, other than to enforce plan limits and to stop abuse of free credits.

5. AI features and AI providers

5.1 What the AI does

• Topic ideas, scripts, revisions, hooks and post captions: you enter a topic and options, and an AI model writes the text. To match your voice, the app may include up to three of your recently edited scripts with a script request.
• Translation: the AI translates a script or captions into another language.
• AI pictures: you describe a picture, or the auto edit asks for a picture of each item name, and an AI model makes it.
• Transcription and auto edit: speech in the audio you upload is turned into text with word times. The server uses the text to cut silences and repeated takes and to place captions. For the cut decisions, an AI model may also receive the transcript text (not audio) to give a second opinion.

AI output is generated by software. See the Terms of Service, section 7.

5.2 Who processes the data

Our server sends AI requests to OpenRouter (a routing service). OpenRouter passes the request to the company that runs the model. At the date above, the models set in our server are:

• Scripts, ideas, hooks, captions and translation: model openai/gpt-6.1-terra, chosen by us and changeable by us.
• Speech to text: elevenlabs/scribe-v2 (ElevenLabs), and google/gemini-3.5-transcribe (Google) if the first fails.
• Pictures: openai/gpt-image-2.5-sunburst (OpenAI).

We may change models. [CONFIRM: the model list is read from the server code on the date above. Update this list whenever the models change, and add each model provider's name and country to section 7.]

We do not send your name, email address, phone number or account ID to OpenRouter or the model providers. We send only the content needed for the request. But your content may itself contain personal data if you type it in. We have not set any OpenRouter option that limits which providers see the data or that forbids them from keeping it. [CONFIRM: check your OpenRouter account privacy settings (prompt logging and data-use options) and state here what is really set.]

5.3 Use of your content to train AI models

We do not train AI models on your content. RankingTiger does not train, fine-tune or otherwise improve any AI model with your scripts, inputs, audio or video.

Third-party providers. We send your inputs to the providers named in section 5.2, through OpenRouter, so that they can produce the result you asked for. Those providers process your inputs under their own terms. Under those terms, a provider may be allowed to keep the content it receives and to use it to train or improve its own models. Whether it does depends on the provider, the model and the terms that apply to each request. We cannot control this and the app has no switch for it. The app tells you this under the buttons of the script, topic ideas and auto edit screens. [CONFIRM: the terms of each provider in use. Do not describe a setting that has not been made.]

If you do not want your content processed by these providers, do not use the AI features.

5.4 Accuracy of AI output

AI output may be wrong, out of date, incomplete, or unsuitable for your purpose. This is especially true for health, medical, legal, financial and safety topics. The AI does not give professional advice. Please check facts yourself before you publish.

6. Videos, audio and uploads

• Recording and editing on your device: videos you record in the app, and manual editing, stay on your phone or browser. We do not receive them.
• Audio for transcription or auto edit: when you use Auto edit or Auto captions, the app takes the audio out of your video on your device and uploads only that audio to a private folder in our storage (Supabase, Mumbai region). Only your account can read your folder. The server reads the file to transcribe it and sends the audio to the speech-to-text provider (section 5.2). The app deletes the uploaded file when the request ends, whether it worked or failed. If the app is closed or loses connection before it can do that, the file may stay in your folder. A scheduled job on our server then deletes any uploaded audio file that is more than 24 hours old. It runs every hour, so a leftover file is normally gone within about 25 hours. You can also remove it sooner by deleting that recording in the app, and it is removed when you delete your account. [CONFIRM: this clean-up job is in migration 0027 and must be applied and tested (including the Vault secrets it needs) before you publish this sentence.]
• Long recordings: if we switch on the option to cut long audio into pieces, the pieces are made on a media server of ours (Oracle Cloud) that is reached only through Cloudflare. That option is off at the date above.
• Exports: exports saved to your device are yours. Free-plan exports include a RankingTiger watermark.
• Sharing: the share feature sends the file to the app you choose. We do not post your videos anywhere for you.
• Please do not upload recordings of people unless they have agreed to it, or you have another lawful reason. See the Terms of Service, section 6.

7. Who we share information with

We do not sell your personal information. We share it only as described below.

Service providers (processors). These companies process data for us to run the service:

We do not use analytics, crash-reporting, advertising or attribution providers, and we do not share data for advertising.

Other reasons we may share data:

• Law and safety: when required by law, a court order, or a valid government request, or where needed to protect the rights, property or safety of users or others.
• Business changes: if we merge with, or sell, all or part of our business, your data may move to the new owner under the same protections. We will tell you before this happens.
• With your direction: when you choose to share something, such as an exported video.

Refund requests to Apple and Google. If you ask Apple or Google for a refund of an App Store or Google Play purchase, we may share app usage information about that purchase with Apple or Google, through RevenueCat, so that they can decide the request. We do this only if you ticked the box on the Plans screen, and your choice is saved on your account. If you have not agreed, we do not share this information. You can change your choice at any time on the Plans screen. A change applies to refund requests made after it is saved. [CONFIRM: the exact usage information each store asks for, and the consent wording, with the lawyer.]

We do not allow service providers to use your data for their own purposes, except where section 5.3 describes an AI provider's own use of content.

8. How long we keep information

When we no longer need your data for the purposes in this policy, we delete it or make it anonymous. Where the law requires us to keep something longer, we keep only what is required.

9. Where your data goes (international transfers)

Our main database is in India. Some providers we use are located outside India, including in the United States, so we transfer some personal data abroad when you use AI, purchase and update features.

• India: the DPDP Act allows transfers outside India, except to countries the government restricts by notification. We will comply with any such restriction.
• EU and UK: where we transfer personal data from the EU or UK to a country without an adequacy decision, we rely on Standard Contractual Clauses (and the UK International Data Transfer Addendum), or on the EU-US Data Privacy Framework where the provider is certified. [CONFIRM: which mechanism each provider offers. Most large providers include these clauses in their standard terms.]
• You can ask us for details of the safeguards. Contact us at the email address in section 16.

10. Children and minors

• RankingTiger is for people aged 18 and over. When you create an account, the app asks you to confirm that you are 18 or older. We do not knowingly allow anyone under 18 to create an account, and we do not offer a parental-consent process.
• We do not knowingly process the personal data of anyone under 18. If we learn that an account belongs to a person under 18, we delete that account and the data tied to it.
• Under the DPDP Act, anyone under 18 is a "child", and a company may process a child's data only with the verifiable consent of a parent or guardian, and may not track children or target them with ads. Because we do not accept children, we do not collect their data on purpose.
• If you are a parent or guardian and believe your child has given us data, contact us. We will delete the data and close the account.
• The App Store age rating is 18+ and the Google Play target audience is 18+, to match this policy.

11. Security

We use reasonable safeguards, which include:

• encryption of data in transit (HTTPS) between the app, our servers and our providers;
• on iPhone and Android, encryption of your saved sign-in session on the device, with a key kept in the phone's secure storage;
• database rules that let each account read only its own rows, and a private storage folder per account;
• keeping secrets, such as AI provider keys, on our server only, never inside the app;
• storing only one-way scrambled codes for the anti-abuse records in section 3.2;
• a CAPTCHA (Cloudflare Turnstile) and rate limits on sign-in and AI features;
• optional two-step sign-in with an authenticator app.

No system is perfectly secure. If a personal data breach affects you, we will tell you without delay, and we will report it to the Data Protection Board of India and to other regulators as the law requires (under the DPDP Rules, a full report to the Board within 72 hours; under the GDPR, a report to the authority within 72 hours where it applies).

You are responsible for keeping your password and devices safe. Tell us at once if you think someone else has access to your account.

12. Your choices and rights

12.1 Deleting your account and data

In the app: open the Me tab, go to the red Delete account section, tap Delete account, and type DELETE to confirm. If you signed in with Apple, you confirm with Apple on the iPhone app. We then:

• remove Sign in with Apple access for our app, if you used it;
• remove the audio files in your storage folder;
• delete your account. This deletes, at the same time, your profile, plan, credit and usage records, AI job records, purchase events, referral records, device codes and rate-limit counters;
• clear the scripts, recordings and edit projects on that device, and sign you out.

Some things remain: backups until they are overwritten (section 8); the scrambled anti-abuse codes for 30 days (section 8); and records that Apple, Google, RevenueCat, Razorpay or the AI providers hold under their own policies. Deleting your account does not cancel a paid plan. Cancel it in the App Store or Google Play first (see the Refund and Cancellation Policy).

If you cannot use the app (for example you uninstalled it or cannot sign in): email support@athelp.in from the email address of your account with the subject "Delete my account". We will verify that the account is yours and delete it. [CONFIRM: say how long this takes, for example within 30 days, and make sure you can do it from the Supabase dashboard.]

12.2 Other choices you can make in the app

• Edit your profile and settings at any time.
• Delete your scripts and recordings from inside the app. Deleting a recording also removes any leftover audio upload of it.
• Choose whether to share usage information for refund requests with Apple or Google (Plans screen, section 7).
• Withdraw consent for any purpose that relies on consent. Withdrawing may mean we can no longer provide a feature, such as AI scripts. You can withdraw consent by deleting your account or by contacting us (section 14 or 16).

12.3 Rights under the Indian DPDP Act

You may:

• Ask for a summary of the personal data we process about you, the processing we do with it, and the names of the other companies we share it with (access).
• Ask us to correct, complete or update your personal data (correction).
• Ask us to erase your personal data when it is no longer needed for the purpose it was collected, or when you withdraw consent (erasure). We may keep data the law requires us to keep.
• Have your grievance heard (see section 14).
• Nominate another person to exercise your rights if you die or become incapable of acting for yourself.
• Withdraw your consent at any time, as above.

12.4 Rights under the EU and UK GDPR

If you are in the EEA or the UK, you have the right to:

• access your data;
• have inaccurate data corrected;
• have your data deleted in some cases;
• restrict or object to some processing, including processing based on legitimate interests;
• receive a copy of your data in a portable format, where processing is based on consent or contract;
• withdraw consent where processing is based on consent;
• complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

[CONFIRM: owner decision O.15 on serving EU and UK users is open. If you serve them, a representative under GDPR Article 27 and UK GDPR Article 27 may be needed. Add the name and address here, or state that the service is not offered there.]

12.5 Rights for California residents (CCPA, as amended by CPRA)

California residents have the right to:

• Know the categories and specific pieces of personal information we collect, use and disclose (section 13.1 lists the categories);
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information. We do not sell personal information for money. We do not share it for cross-context behavioural advertising, because we use no advertising or tracking tools. We cannot promise that an AI provider's own use of content (section 5.3) is not a "sale" or "sharing" under California law. [CONFIRM: ask a lawyer whether it is, and whether the CCPA applies to you at all, because it applies only above certain size thresholds.]
• Limit the use of sensitive personal information. We use account log-in details only to provide the service.
• Not be discriminated against for using these rights.
• Use an authorised agent to make a request for you.

We do not respond to "Do Not Track" browser signals, because there is no agreed standard for them.

12.6 How to make a request

• Use the in-app controls in sections 12.1 and 12.2, or
• email us at support@athelp.in, with the subject line "Privacy request", from the email address linked to your account.

We may need to verify your identity before we act on a request. We aim to respond within 30 days, or within any shorter period the law requires. We do not charge for a reasonable request. If a request is very complex, we may need more time, and we will tell you.

13. Region-specific notices

13.1 California: categories of personal information in the last 12 months

We keep each category for the periods in section 8. We do not sell personal information for money, and we do not share it for advertising.

13.2 Other regions

We may offer the service to people in other countries. Where local law gives you additional rights, we will respect them. [CONFIRM: review for each target market before launch.]

14. Questions, grievances and complaints

For any question about your personal data, or a complaint about how we handle it, contact:

• Grievance Officer / contact person for data questions: [CONFIRM: full name]
• Email: [CONFIRM: email address for the Grievance Officer. It can be support@athelp.in.]
• Postal address: [CONFIRM: postal address. It can be the business address in section 1.]

We will acknowledge your message and reply as soon as we can, and we aim to resolve a grievance within 30 days. Under the DPDP Rules, the longest time allowed to answer a grievance is 90 days. [CONFIRM: check the timelines with a lawyer.]

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is in operation, or to the authorities described in sections 12.4 and 12.5.

15. Cookies and similar technologies (web)

The web version of RankingTiger stores what it needs to work, such as your sign-in session, your language and settings, and your saved work, in your browser's storage. These are "strictly necessary" and do not need your consent. Our public website (rankingtiger.com) sets no analytics or advertising cookies and loads no analytics or advertising scripts. The sign-in CAPTCHA (Cloudflare Turnstile) loads from Cloudflare when you sign in. [CONFIRM: check in a browser whether Turnstile sets any cookie, and list it here.]

The app on your phone uses device storage for the same purposes. We do not use cookies or device identifiers to show you targeted ads.

16. Contact us, and changes to this policy

• Company: Athelp Info Solutions Pvt Ltd
• Email: support@athelp.in
• Business address: 15, Block A, Lok Vihar, Pitampura, Delhi 110034, India

We may update this policy as the app or the law changes. For material changes, we will tell you in the app or by email before the change takes effect, and where the law requires it, we will ask for your consent again. The "Effective date" at the top shows when the current version started.