Privacy Policy
Last updated: 30 July 2026
This policy explains what Cache Club (operated by Shivani Wankhede) collects, why, and what you can do about it. It covers Creator Cache™ and Womeown.
The short version. Cache Club is local-first: without an account, your data stays in your own browser and never reaches us. With an account, we store what you choose to sync so it follows you between devices. We do not sell your data, and we do not run advertising trackers.
1. What we collect
a. Without an account
Nothing is sent to us. Your profile, portfolio, ideas, pipeline and habits are stored in your browser's local storage on your own device. Clearing your browser data deletes them, and we cannot recover them.
b. When you register
- Email address — to identify your account, confirm it is real, and contact you about the Service.
- Mobile number — to keep accounts unique, so one person cannot hold several free accounts. We do not send marketing SMS.
- Password — stored only as a salted hash by our authentication provider. We never see it.
c. What you put into the app
Your name, headline, bio, photo, work samples, links, social handles, testimonials, client pipeline, ideas, posts and habits — whatever you enter. This is yours; we store it so you can get it back on another device.
d. Payments
Handled by PhonePe. We receive a payment reference, the amount and the status. We never receive or store your card number, UPI PIN or bank credentials.
e. Usage
- AI usage counts per day, to apply your plan's limit and to keep the service sustainable.
- Anonymous in-app event counters (which screens are opened, when an upgrade prompt appears). These live in your browser and carry no personal identifiers.
- Your IP address at sign-up, briefly, to rate-limit automated account creation.
2. Why we are allowed to hold it
| Data | Purpose | Basis |
|---|---|---|
| Email, password | Run your account | Performance of contract |
| Mobile number | Prevent duplicate accounts | Legitimate interest |
| Content you enter | Provide the Service | Performance of contract |
| Payment records | Billing, tax records | Legal obligation |
| AI usage counts | Enforce plan limits | Performance of contract |
3. Who we share it with
We do not sell your personal data and we do not share it for advertising. We use a small number of processors, each only for the job named:
| Provider | What it handles |
|---|---|
| Supabase | Database and authentication |
| Cloudflare | The API layer between the app and other services |
| Google (Gemini API) | Runs the language model behind the AI assistant |
| PhonePe | Payment processing |
| Hostinger | Website hosting |
We also disclose data where the law requires it, or to protect our rights or someone's safety.
4. What the AI assistant sends
When you use the AI assistant, the prompt — which may include details from your profile such as your headline, USP and bio — is sent to Google's Gemini API so the model can answer in your context.
- Only what is needed for that request is sent.
- We do not use your content to train any model of our own, and we do not sell it.
- Google may use it to improve their models. The assistant currently runs on the free tier of Google's Gemini API, and Google's terms for that tier permit them to use prompts sent through it to improve their services, including review by human reviewers. This is the honest trade for the assistant being free to you. If we move to a paid tier — where that use is excluded — we will say so here.
- Do not paste anything confidential — client secrets, passwords, ID numbers, anything under an NDA — into the assistant. On the free tier this matters more than usual.
5. Where it is stored
Data is held on servers operated by the providers above, which may be outside India. They are bound by contract to protect it to the standard described here.
6. How long we keep it
- Account and content: while your account is open, and for 30 days after you delete it, so an accidental deletion can be undone.
- Payment records: 8 years, as required by Indian tax law.
- AI usage counts: 12 months.
- Sign-up IP addresses: 30 days.
7. Your rights
You can ask us to:
- Show you what we hold about you;
- Correct anything wrong — most fields you can edit yourself in the app;
- Delete your account and data, subject to the payment records we must keep by law;
- Export your data in a portable format;
- Withdraw consent to optional processing.
Email support@yourdomain.com from your registered address. We respond within 30 days, free of charge.
8. Security
- All traffic is encrypted over HTTPS.
- Passwords are hashed by our authentication provider; we never see them.
- Database row-level security means one account cannot read another's data, even if it tries.
- The credentials used to reach the AI provider are held on our server only. They are never sent to a browser, and where an account holds its own key it is encrypted at rest.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority without undue delay.
9. Cookies and local storage
We use no advertising or third-party tracking cookies. We use:
- Local storage — to hold your app data on your device, which is what makes Cache Club work offline;
- A session cookie from our authentication provider, to keep you signed in.
10. Children
Cache Club is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.
11. Changes
We may update this policy. Material changes are notified by email or in the app at least 14 days before taking effect. The date at the top always shows the current version.
12. Contact and grievances
Privacy questions: support@yourdomain.com. For formal complaints, the Grievance Officer's details are on the Contact page.