Privacy Policy

1. Information we collect

Account information. When you sign in with Google, we receive your name, email address, and profile picture from your Google account. We do not receive your Google password.

Content you create. Article briefs, generated drafts, titles, keywords, uploaded reference images, and any edits you make are stored in your Citeya workspace so you can retrieve them later.

Usage data. We log basic technical data — IP address, browser type, device type, pages visited, and timestamps — to keep the service secure and to understand how it's used.

Payment data. If you upgrade to Pro, billing is handled entirely by Razorpay. Citeya never receives or stores your card, UPI, or bank details — only a subscription status and ID.

2. How we use your information

• To authenticate you and operate your account and workspace.
• To generate, store, and let you retrieve your content.
• To process Pro subscription payments and enforce plan limits.
• To respond to support requests submitted via our contact form.
• To detect abuse, prevent fraud, and keep the platform secure.
• To improve Citeya's features based on aggregate, non-identifying usage patterns.

We do not sell your personal data, and we do not use your account information to serve you ads.

3. Cookies and similar technologies

Citeya uses a small number of cookies and browser storage items:

• Session cookie — keeps you signed in between visits. Strictly necessary; the app cannot function without it.
• Theme preference — remembers whether you last used light or dark mode. Stored in your browser's local storage, never transmitted to us.
• Advertising cookies — on blog articles only (see Section 4), Google and its advertising partners may set cookies to serve and measure ads.

You can block or delete cookies in your browser settings at any time. Doing so may sign you out or prevent the theme toggle from persisting, but the rest of the marketing site will continue to work.

4. Advertising and Google AdSense

Citeya's blog (citeya.com/blog and individual articles) displays advertising served through Google AdSense. This section exists to meet Google's disclosure requirements for publishers who use AdSense.

• Google, as a third-party vendor, uses cookies to serve ads on our blog based on your prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the internet.
• You may opt out of personalized advertising by visiting Google's Ads Settings.
• Alternatively, you can opt out of a third-party vendor's use of cookies for personalized advertising by visiting www.aboutads.info.
• Ads are not shown on the application/dashboard screens, the generator, sign-in, or account pages — only on blog content pages.

We may also display a publisher-verification file (ads.txt) that lists Google as an authorized seller of our ad inventory. This is standard practice and does not itself involve collecting personal data.

5. Third-party services we use

We share the minimum data necessary with the following processors to operate Citeya:

• Google OAuth — authentication (name, email, profile picture).
• OpenAI — processes your content briefs to generate drafts, metadata, and images. Briefs are sent solely to produce your output and are not used by Citeya to train models.
• Razorpay — payment processing for Pro subscriptions.
• Resend — delivers transactional email (e.g. contact form replies, account notifications).
• Google AdSense — serves advertising on blog pages, as described in Section 4.

Each provider processes data under its own privacy policy and only for the purpose we've engaged them for.

6. Data retention and security

We retain your account and content data for as long as your account is active. If you delete your account, we remove your personal data and generated content from our production database within 30 days, except where we're required to retain records for legal or billing purposes.

Data is stored in an access-controlled database, transmitted over HTTPS, and session tokens are signed and time-limited. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures to protect your data.

7. Your rights (GDPR, UK GDPR, and CCPA)

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data or complete incomplete data.
• Request deletion of your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain processing, including opting out of personalized advertising as described above.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at support@citeya.com or via our Contact page. We respond to verified requests within 30 days.

8. Children's privacy

Citeya is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

9. International data transfers

Citeya's infrastructure and service providers may process data outside your country of residence. Where required, we rely on standard contractual clauses or equivalent safeguards for cross-border transfers.

10. Changes to this policy

We may update this policy as our product or legal obligations change. Material changes will be reflected by updating the "Last updated" date above. Continued use of Citeya after changes take effect constitutes acceptance of the revised policy.

11. Contact us

Questions about this policy or your data? Reach us at support@citeya.com or through our Contact page.