Privacy Policy

1. Who we are

Kissa ("Kissa", "we", "us") is an audio story and creator platform. It is available as an Android app (package com.kissa.app), this website and the servers that support them. Kissa is the Data Fiduciary for the personal data described here, as defined in the DPDP Act. This policy applies to the app, the website and our API. If you don't agree with it, please don't use Kissa.

2. Summary

• You can browse stories and listen to free episodes on the website and in the app without an account.
• To sign in we use your mobile phone number and a one-time password (OTP) sent by SMS.
• If you create stories, the photos, voice recordings and text you provide are processed by Sarvam AI (an Indian AI company) to write, check, translate and narrate your story.
• Purchases are handled by Google Play. We never see your card, UPI or bank details for purchases.
• We don't sell your personal data and we don't show ads.
• Kissa is for adults aged 18+. You can access, correct and delete your data, and delete your account at any time.

3. Personal data we collect

3.1 Data you give us

3.2 Data created when you use Kissa

4. What we don't collect

• No GPS or precise location, contacts, SMS inbox or call logs.
• No advertising ID and no advertising SDKs.
• We access the microphone only while you are recording, and your photos only when you pick them to upload — and only the photos you pick.
• No card, UPI or bank details for purchases — Google Play handles payment.

5. How we use your data

• To provide the service: sign you in, stream and download episodes, remember your progress, library and settings.
• To create your stories: describe your photos, transcribe your voice, write, translate and narrate episodes (see section 7).
• To keep Kissa safe: check uploads and text against our Community Guidelines, match images against known child sexual abuse material, handle reports, apply strikes, prevent fraud, fake listens and abuse.
• To process purchases: verify Google Play purchases, credit coins, manage subscriptions and unlocks.
• To run the creator program: calculate listens, hit progress, tiers and, when live, payouts; verify KYC.
• To improve Kissa: aggregate statistics such as listeners, completion rates and AI cost per story.
• To communicate: service notifications (e.g. "your story is ready"), account, security and policy notices. Offers only if you turn them on.
• To meet legal obligations: IT Rules 2021 grievance handling, tax and accounting records, and valid requests from authorities.

We do not use your photos, voice recordings or private drafts to train AI models.

6. Consent and legal basis

Under the DPDP Act we process your personal data on the basis of:

• Your consent, given when you create an account and accept this policy and our Terms, and when you use optional features such as photo or voice stories, own-voice narration, KYC or notifications. Own-voice narration requires a separate, recorded consent.
• Legitimate uses under Section 7 of the DPDP Act, such as data you voluntarily provide for a specific purpose, compliance with law, court orders and responding to emergencies.

You can withdraw consent at any time, as easily as you gave it, by turning off a feature, deleting content or deleting your account. Withdrawal doesn't affect processing already done, and some features can't work without the data they need.

7. AI processing by Sarvam AI

Kissa's AI features run on Sarvam AI (Sarvam AI Private Limited, India), acting as our processor. When you create a story:

1. Child-safety check first. Each image is checked against an industry hash-matching service for known child sexual abuse material before any AI sees it.
2. Photos are sent to Sarvam Vision to describe scenes and read visible text. It is instructed never to identify or name people.
3. Voice recordings are transcribed by Sarvam's speech-to-text model (Saaras), and the language is detected automatically.
4. Text (your notes, transcript, or typed story) is used by Sarvam's language models to plan and write episodes, suggest titles, and check content against our policies.
5. Translation and narration: published stories are translated with Sarvam-Translate, localised, and narrated with Sarvam's text-to-speech voices (Bulbul). Own-voice narration uses Sarvam's voice cloning, only for your own voice and only after your recorded consent.
6. Search uses transliteration and language identification so you can search in any script.

We send Sarvam AI only the content needed for each step — not your phone number. Every story is labelled "AI-generated" and translations "Translated by AI". Please don't include other people's private information in your stories, notes or recordings.

8. Who we share data with

We don't sell or rent personal data and we don't share it with advertisers or data brokers.

Public content. Published stories, your display name, profile photo, tier and comments are visible to other users and, for stories, on this website. Anyone with a story's share link can open its page and hear its free episodes.

Legal reasons. We may disclose data when required by law or a valid order of a court or government authority, including obligations under the IT Act 2000 and IT Rules 2021, or to protect the safety of users and the public. Content involving child sexual abuse is reported to the authorities.

9. Where your data is stored

We aim to store and process data in India. Where a provider processes data outside India, the transfer follows the DPDP Act and any restrictions notified by the Government of India under Section 16.

10. How long we keep data

11. Security

• Encryption in transit (HTTPS/TLS) and at rest; KYC data additionally encrypted at field level.
• Short-lived access tokens, rotating hashed refresh tokens and the ability to sign out of all devices.
• Media served through time-limited signed URLs; drafts are visible only to you.
• Role-based staff access with a full audit log of admin actions; rate limiting on sign-in.

If a personal data breach occurs, we will inform the Data Protection Board of India and affected users as the DPDP Act requires.

12. Your rights

Under the DPDP Act you have the right to:

• Access a summary of your personal data and processing, and the identities of those we have shared it with;
• Correction, completion and updating — edit your profile in the app or ask us;
• Erasure — delete stories in the app, or delete your account;
• Withdraw consent at any time (section 6);
• Grievance redressal through our Grievance Officer;
• Nominate another person to exercise your rights in the event of death or incapacity.

To exercise a right, email support@kissa.app from the app's Help screen or use the grievance form, mentioning the phone number on your account. We respond within 30 days. If you're not satisfied, you can complain to the Data Protection Board of India.

13. Deleting your account

Delete your account in the app (Profile → Settings → Delete account) or request it on our Delete account page. We anonymise your phone number and name, unpublish your stories, sign you out everywhere and delete your data within 30 days, except what the law requires us to keep.

14. Age limit — adults only

Kissa is only for people aged 18 and over. You must confirm you are 18+ to create an account. We do not knowingly process personal data of children (anyone under 18 under the DPDP Act). If we learn that an account belongs to a child, we will delete it. If you believe a child is using Kissa, please contact us.

15. Storage on your device

The app stores sign-in tokens in Android's encrypted secure storage, your settings, and downloaded episodes and artwork for offline listening. They stay on your device and are removed when you sign out, clear the app's storage or uninstall it. This website does not use advertising cookies; fonts are self-hosted.

16. Changes to this policy

We will update the "Last updated" date when we change this policy. For significant changes we will tell you in the app before they take effect and ask for fresh consent where the law requires.

17. Contact and Grievance Officer

For privacy questions, requests or complaints, contact our Grievance Officer:

We acknowledge grievances within 24 hours and resolve them within 15 days. You can also use our grievance form.