Effective 2026-10-30
Who we are
intwave writes interview preparation guides from your resume and a job description. It is run by Pyriox, a sole proprietorship of Piyush Katole ("we", "us"). For anything in this policy, write to intwave.in@gmail.com. Our grievance officer is named on the contact page.
What we collect
- Your Google account details when you sign in: your name, email address, profile photo and Google account id, and when you last signed in. We never see your Google password.
- What you give us for a guide: the text of your resume (we read the file you upload and keep its text and file name, not the file), the job description, the job title, the company name and experience if you enter them, when your interview is, and the guide length you choose.
- Job titles you type under "Other". Once several different people have used the same title, it is added to the role list everyone sees, as a title only, never with who used it.
- The guides we write for you and what you do in them: ticked items, how you rated your answers, and the answers you type into the fill-in blanks.
- Payment records: Razorpay ids for your subscription and payments, amounts, dates, status, your autopay status and your guide credits. Your card, UPI and bank details go to Razorpay and never reach us.
- Records of how each guide was written: which AI model wrote each chapter, how many tokens it used and what it cost, and any errors. These are linked to the guide, not to anything else about you.
Your IP address is used briefly to limit abuse (for example, too many requests in a minute). It is not stored in our database.
How we use it
- To sign you in and keep you signed in.
- To write your guide and show it only to you.
- To take payments, run autopay, add and spend your guide credits, and show your billing history.
- To help you when something goes wrong: our admins can see your guides, how they were written and your payment records in order to fix a failed guide, answer a question or process a refund. Every admin action is logged.
- To prevent abuse and keep the service secure.
- To count which pages and campaigns bring visitors who go on to create guides and pay (our own reports; see below).
We don't sell your data, and we don't use your resume or guides to advertise to you.
Who else handles your data
| Who | What they get | Why |
|---|---|---|
| Anthropic (Claude API) | Your resume text, the job description and the job details, sent with each chapter request | Claude writes the guide. Requests are processed outside India under Anthropic's commercial API terms. |
| Razorpay | Your payment and autopay details, and the email and name we pass to the checkout | Payments, UPI AutoPay and card mandates, refunds |
| The sign-in request | Signing in with your Google account | |
| Amazon Web Services | Everything above, stored on our server and database | Hosting, in AWS's Mumbai region (India) |
| Meta (unless you opt out) | What the "Meta Pixel" section below lists | Measuring our Meta ads |
The Razorpay checkout window is run by Razorpay and follows Razorpay's own privacy policy.
Cookies
| Cookie | What it does | How long |
|---|---|---|
| authjs.session-token | Keeps you signed in (a signed token, not your password) | Until you sign out, or 30 days |
| authjs.csrf-token, authjs.callback-url | Protect the sign-in form and return you to the page you were on | The browser session |
| iw_vid | A random id for this browser, so our own reports can count visitors | 180 days |
| iw_src | How you first reached us: the campaign tags in the link (utm_*), an ad click id (fbclid), the landing page and the referring site | 30 days |
| iw_lt | The last paid campaign that brought you back, in the same form | 30 days |
| iw_sid | A random id for this visit, so our reports can group what happened in one sitting | 30 minutes after your last action |
| iw_consent | Whether you dismissed the Meta cookie notice or opted out | 180 days |
| _fbp, _fbc (Meta) | Set by the Meta Pixel, unless you opt out | Up to 90 days |
On secure (https) connections the sign-in cookies carry a "__Secure-" or "__Host-" prefix. They are needed for the site to work and can't be switched off.
Our own measurement
We record how visitors reach intwave and use it, so we can tell which pages and campaigns work and where people get stuck. When you first visit, we note the campaign tags in the link, the page you landed on and the site that sent you, with a random visitor id. When you sign in, that visitor id is linked to your account. When you create a guide, start autopay or pay, the record is copied onto the guide, subscription or payment.
We also record short, fixed events, each with the time, the page address (without anything after a "?") and your device type (phone, tablet or computer):
- Pages viewed and which button you clicked to start.
- Which fields of the guide form you completed, whether you submitted it or left it. Never what you typed or uploaded.
- Opening and closing the sign-in window, and signing in.
- Opening and closing a checkout, and whether a payment went through or failed (with the amount, and the reason code Razorpay gives for a failure).
- When your guide starts and finishes being written, and which chapters you open, finish or reveal answers in. Never the guide's text.
- Cancelling autopay, buying credits, and coming back on a later day.
These events never contain your resume, the job description, your guides, anything you type, your name, your email address or your IP address. They stay on our own server and database: nothing goes to any other company, and this continues if you opt out of Meta cookies, because it stays with us.
Meta Pixel and Conversions API
We advertise on Facebook and Instagram. From your first visit we load the Meta Pixel and send Meta the events below, from your browser and from our server (the Conversions API), so Meta can tell which ads work, and a notice at the bottom of the page tells you so and lets you opt out. We never load it on our own staff's browsers.
- Events: page views, creating a guide, signing up for the first time, opening the checkout, starting the trial, your first monthly subscription charge (later renewals are not sent), and buying credits, with the amount and currency for payments.
- With each server event: your email address and our id for you, both hashed (turned into a one-way code) before they leave our server; Meta's _fbp and _fbc cookies; the page address; and, when the event happens while you are on the site, your IP address and browser type. We don't keep the IP address and browser type after sending.
- When you press OK on the notice while signed in, we keep that and Meta's _fbp and _fbc ids with your account. Opting out deletes those ids.
- Never sent: your resume, the job description, your guides, anything you type, your name or your phone number.
If you opt out, the pixel stops, Meta's cookies are removed and we send Meta nothing more about you. You can opt out at any time with "Cookie settings" at the bottom of our pages; it stops all future events, including those about later payments.
How long we keep it
- Your account, guides and progress: for as long as you have an account, or until you ask us to delete them.
- Payment, subscription and credit records: as long as Indian tax and accounting law requires, even after you delete your account.
- Admin action logs: kept to show who did what, without your resume or guide text.
- Measurement events: 180 days, then deleted. We keep only daily totals (counts per day, campaign and device), which say nothing about any one person.
- Our record of each event sent to Meta (hashed email and id, Meta's ids, the event and amount): 180 days, then deleted. The IP address and browser type are removed as soon as it is sent.
Your rights
Under the Digital Personal Data Protection Act, 2023 you can ask us for a summary of the personal data we hold about you, ask us to correct or complete it, ask us to delete it, withdraw consent you gave us, and raise a grievance. Write to intwave.in@gmail.com from the email address you sign in with. Deleting your account deletes your guides; we keep only the payment records the law requires. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.
Security
The site is served only over https. Your data is stored on our server and database in AWS's Mumbai region; the database is not open to the internet. Only our admins can see your guides and payments.
Children
intwave is meant for job seekers aged 18 or over. If you are under 18, please don't use it.
Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we will tell you by email before it applies.