Privacy Policy

Information You Provide

• Account information. When you create an account, we collect your name and email address. Authentication is handled through our account provider, Clerk. If you sign in using a third-party service (such as Google), we receive your name and email address from that provider.
• Payment information. When you purchase Find Your Focus, payment is processed by Stripe. Stripe collects your payment card details and billing address. We do not receive or store your full card number — Stripe provides us only with a transaction confirmation, billing country, and the last four digits of your card.
• NorAI conversations. When you interact with NorAI, your messages are encrypted using industry-standard encryption before being stored. We cannot decrypt your stored conversations without your password. During AI processing, your messages are temporarily sent over a secure connection to our AI provider, Anthropic, to generate responses. We do not retain unencrypted conversation content after processing is complete. See Section 6 for more details.
• Communications. If you contact us at privacy@drishtiquest.com or through any other channel, we collect the content of your message and your contact information.

Information Collected Automatically

• Usage data. We track how you interact with the Service, including pages visited, program progress, and trial funnel activity (such as whether you started or completed the free trial). This data is associated with your account and helps us understand how people use Find Your Focus.
• Analytics data. We use Vercel Analytics to collect aggregated, anonymized data about website traffic, including page views, referral sources, and general browser and device information. Vercel Analytics does not use cookies for tracking.
• Device information. When you access the Service, we automatically collect basic technical information such as your browser type, operating system, and screen size.

Information From Third Parties

• Clerk. If you authenticate using a third-party provider (such as Google) through Clerk, we receive your name and email address from that provider.
• Stripe. After a payment is completed, Stripe shares transaction details with us, including billing country, payment status, and a truncated card identifier.
• Resend. Resend delivers transactional emails on our behalf (such as purchase confirmations). Resend receives your email address to perform this function.
• ConvertKit. If you opt in to marketing emails or subscribe to our newsletter, ConvertKit receives your email address. ConvertKit also tracks email engagement (such as opens and clicks) to help us improve our communications.

NorAI is AI, not a human

When you use NorAI, you are interacting with an AI system, not a human being. NorAI is powered by technology from Anthropic, a third-party AI provider. No human at Drishti Quest reads, monitors, or participates in your NorAI conversations.

NorAI is not therapy, counseling, or professional advice

NorAI is a personal development tool for educational purposes only. It is not a licensed therapist, counselor, medical professional, or financial advisor. NorAI is not a substitute for professional medical, mental health, psychiatric, legal, or financial advice. If you are experiencing a mental health crisis, please contact a qualified professional or call 988 (Suicide & Crisis Lifeline).

AI output accuracy

NorAI may produce responses that are inaccurate, incomplete, or unsuitable for your specific situation. You should not rely on factual assertions from NorAI without independently verifying their accuracy. NorAI is designed to ask questions and guide reflection — not to provide authoritative answers.

How your conversations are processed

When you send a message to NorAI, the following happens:

1. Your message is sent over a secure connection from your browser to our server.
2. Our server forwards your message to Anthropic's API to generate a response. During this step, your message is temporarily in plaintext on our server and at Anthropic.
3. Anthropic processes your message and returns a response. Anthropic acts as a data processor on our behalf — they do not use your conversations for their own purposes or to train AI models. Anthropic automatically deletes API inputs and outputs within 30 days, except where retention is required to enforce their Usage Policy or comply with the law.
4. Your message and NorAI's response are encrypted using a key derived from your password and stored in our database. Once encrypted, we cannot read the stored content without your password.

No AI training

Your NorAI conversations are never used to train or improve AI models — not by Drishti Quest and not by Anthropic. Anthropic operates as a data processor under their Commercial Terms, meaning they process your data solely on our behalf and do not retain it for independent use. Anthropic automatically deletes API inputs and outputs within 30 days of receipt. In limited cases — such as when a conversation is flagged for a potential Usage Policy violation — Anthropic may retain data for up to 2 years for enforcement purposes.

Your conversations are encrypted

NorAI conversations are encrypted using industry-standard encryption before being stored in our database. Your encryption key is derived from your password — we store only a password-protected version of the key and cannot decrypt your stored conversations without your password. Even in the event of a database breach, your conversation content would remain unreadable without your personal key.

Your data is protected in transit

All data transmitted between your browser and our servers, and between our servers and third-party providers, is protected using TLS encryption.

Automatic session protection

Your encryption key is held only in your browser's memory while you are actively using the Service. Your session locks automatically after 30 minutes of inactivity or 24 hours — at which point you must re-enter your password to continue.

Account recovery

When you set up your account, you receive one-time-use recovery codes that can restore access to your encrypted data if you forget your password. If you lose both your password and all recovery codes, your encrypted data cannot be recovered by anyone, including us.

What is not encrypted with your personal key

Your account information (name and email address), program progress, and usage data are stored using standard security measures but are not encrypted with your personal key. This data is necessary for the Service to function — for example, to send you emails or track which lessons you have completed.