Privacy Policy

Kissa (“Kissa”, “we”, “us”) is a creator-first audio storytelling platform operated from India. This Privacy Policy explains what personal data we collect when you use our website and progressive web app (collectively, the “Service”), how we use it, and the choices you have. We process personal data in accordance with India’s Digital Personal Data Protection Act, 2023 (DPDP Act).

1. Data we collect

• Account data: your name, email address, username, and password hash. If you sign in with Google, we receive your name, email, and profile picture from Google.
• Creator data: for creators, your display name, bio, avatar, and the series, episodes, images, and audio you upload.
• Usage data: watch history, playback position, bookmarks, likes, follows, playlists, and downloads, used to power your library and recommendations.
• Technical data: IP address, device and browser type, and diagnostic logs, used for security and to operate the Service.

2. How we use your data

• To provide and personalise the Service (your library, history, and trending feed).
• To authenticate you and keep your account secure (we use JWTs stored in HTTP-only cookies).
• To notify you about new episodes from creators you follow and account activity.
• To understand aggregate usage and improve the Service.
• To comply with legal obligations and enforce our Terms of Service.

3. Cookies

We use strictly necessary cookies to keep you signed in (access and refresh tokens). We do not use third-party advertising cookies. Disabling cookies will prevent you from signing in.

4. Service providers

We share data with infrastructure providers strictly to operate the Service:

• Google — for optional sign-in (OAuth).
• Amazon Web Services (AWS) — hosting and database, in the Mumbai (ap-south-1) region.
• Cloudflare — content delivery and object storage of uploaded media.

These providers process data on our behalf under their own security and privacy commitments. We do not sell your personal data.

5. Data retention

We retain your personal data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where retention is required by law.

6. Your rights

Under the DPDP Act, you have the right to access, correct, and erase your personal data, to withdraw consent, and to grievance redressal. To exercise any of these rights, contact us at the address below.

7. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children without verifiable parental consent.

8. Changes

We may update this policy from time to time. Material changes will be communicated through the Service. The “last updated” date above reflects the latest revision.

9. Contact

For privacy questions or to exercise your rights, email hello@kissa.in.