Munshi — Privacy Policy

Last updated: 24 August 2026

Munshi ("Munshi", "we", "us") is a personal assistant that connects to your WhatsApp account, reads your chats on your behalf, and turns them into tasks, reminders, a daily brief, and draft replies. Munshi is operated by Siddharth Gupta, contactable at [email protected]. This policy explains what we collect, why, who else touches it, and how you can get it deleted.

1. What we collect

Account information. When you sign in with Google, we receive your name, email address, and profile photo. We use this to create and secure your account.

WhatsApp content and metadata. When you link your WhatsApp account, Munshi reads, on an ongoing basis:

the text (and basic type) of messages in your chats,
chat and contact names, phone numbers, and group membership,
timestamps and read/delivery metadata.

Munshi links your account using an unofficial connection (not the official WhatsApp Business API). See §7.

Information about other people. Your chats necessarily contain information about the people you talk to — their names, numbers, and what they say. Munshi processes this to do its job. You are responsible for having a lawful basis to let us process your contacts' information (see our Terms). We do not contact these people, market to them, or build profiles of them for anyone but you.

Derived data. From your messages, Munshi generates tasks, calendar events, facts, summaries, a people directory, and draft messages. This is stored against your account.

Notifications. If you enable push notifications, we store the browser push subscription needed to send them.

Usage and diagnostics. Basic, non-content telemetry (which screens are used, error logs, AI-usage counts) to keep the service working and improve it.

We do not collect payment information — Munshi is free during the founding period.

2. How we use your data

Only to run the service for you: reading and understanding your chats, extracting tasks and events, producing your brief and weekly review, drafting messages you choose to send, sending you notifications, and supporting and improving the product. We do not sell your data or use it for advertising.

3. AI processing (important)

To understand your messages, Munshi sends message content and context to Google's Gemini API for processing. This means the plain text of relevant messages leaves our server and is processed by Google under Google's terms. We send the minimum needed for each feature, but you should assume that message content Munshi acts on is seen in plaintext by this AI provider.

Your consent, and your off switch. Munshi asks for your explicit permission in the app before any of your message content is sent to the AI provider, and you can pause AI processing at any time from Privacy → AI processing — while paused, nothing is sent. Data sent to the Gemini API travels encrypted over TLS and, under Google's paid API terms, is not used to train Google's models. We never sell your data or share it for advertising.

We do not claim Munshi is end-to-end encrypted or "zero-knowledge." It is not. See §4 for exactly what protection we do and don't provide.

4. Where your data lives, and how it's protected

Storage. Your data is stored in Google Firebase (Firestore), in a per-user space.
Encryption at rest. Message bodies are encrypted (AES-256-GCM) with a key unique to your account.
Raw messages are deleted on a rolling window. Munshi keeps raw message content only briefly — 7 days by default (you can choose 7, 14, or 30 days, or switch deletion off, in Privacy → What Munshi keeps), plus the most recent ~60 messages per chat that its drafting features read. Older raw messages are permanently deleted from our servers every night. What Munshi keeps long-term is what it learned: your tasks, calendar entries, notes, and chat summaries — the notebook, not the transcripts.
Honest limits. The encryption keys are held on our server so Munshi can read and process your messages for you. That means our operators have the technical ability to access your data, and — as in §3 — message content is decrypted to be processed by the AI provider. Encryption protects your data from theft of the raw database; it does not make your messages invisible to us or to Google. We hold this access to a minimum and treat it as a serious responsibility.
Transport. Traffic to the app and between services is over HTTPS/TLS.

5. Munshi never sends messages for you

Munshi is read-only on WhatsApp. It never sends, replies to, reacts to, or forwards messages on your behalf. Any draft it produces is copied and sent by you, by hand. This is a deliberate safety and trust boundary.

6. Who we share data with

We don't sell your data. We share it only with the service providers that make Munshi work ("processors"):

Processor	Purpose
Google Firebase / Firestore	Authentication and data storage
Google Gemini API	AI understanding of your messages
Google Cloud (Compute Engine)	Running the service
Web hosting / CDN (GoDaddy, Cloudflare)	Serving the website and app

Google Calendar and Google user data

If you choose to connect Google Calendar (Integrations → Google Calendar), Munshi asks Google for one permission — calendar.events — and uses it for exactly two things: writing the meetings and deadlines Munshi has found in your chats into your primary calendar (and removing an entry if you dismiss that event in Munshi), and reading your next 48 hours of events so they appear in your own morning brief. Entries Munshi creates carry a private marker so they are never re-read as new.

Your Google refresh token is stored encrypted with your personal key and is used only for these calls. Calendar data is never shared with anyone, never sold, never used for advertising, and never used to train AI models. Disconnecting in the app revokes the token at Google and deletes our copy immediately; Delete all my data removes everything else.

Munshi's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We may disclose data if required by law, or to protect the rights, safety, and security of our users and the service.

7. WhatsApp / Meta

Munshi is not affiliated with, endorsed by, or sponsored by WhatsApp LLC or Meta. "WhatsApp" is a trademark of its owner. Munshi connects to your account through an unofficial method; using third-party tools with WhatsApp may be against WhatsApp's own terms and could put your WhatsApp account at risk. You use this connection at your own discretion (see our Terms).

8. Keeping and deleting your data

Retention. Raw message content lives on a short rolling window (default 7 days — see §4) and is deleted nightly. Derived data — tasks, events, notes, summaries — is kept while your account is active so Munshi can do its job, and is yours to delete at any time.
Disconnecting. You can unlink WhatsApp at any time from the app; Munshi stops reading new messages immediately.
Deletion. You can request deletion of your data (there is a wipe option in the app, and you can email us). On deletion we remove your stored messages, derived data, and account records from our systems within a reasonable period, except anything we must retain by law.

9. Your rights

Depending on where you live (including under India's Digital Personal Data Protection Act, 2023, and comparable laws), you may have the right to access, correct, or delete your data, to withdraw consent, and to complain to a regulator. To exercise any of these, email [email protected].

10. Children

Munshi is not intended for anyone under 18. We do not knowingly collect data from children.

11. Changes

We may update this policy as Munshi evolves. We'll change the "Last updated" date, and for significant changes we'll notify you in the app or by email.

12. Contact

Questions, requests, or concerns:

[email protected] · Support: +91 98195 66736

← hellomunshi.com