Privacy Policy

1. Information We Collect

When you use Kekar without an account:

• A session identifier (stored as a cookie) to associate your stories with your browser session.
• Story topics and preferences you enter (language, story type).
• Files you upload to the Reader (stored temporarily on our server).
• Voice recordings submitted for speech-to-text transcription.

When you create an account:

• Name, email address, and a securely hashed password.
• All of the above, now permanently linked to your account.
• Voice preferences and custom voice descriptions you create.

Automatically collected:

• Basic server log data (IP address, browser type, pages visited) — retained for 30 days.
• Error logs to help us diagnose and fix issues.

2. How We Use It

• To generate stories and audio based on your inputs.
• To extract text from uploaded documents for narration.
• To associate your content with your account or session so you can access it again.
• To improve the service — identifying common errors, popular features, and performance bottlenecks.
• To respond to contact form submissions.
• To send transactional emails (password resets, account notices) — no marketing emails without your explicit consent.

We do not use your stories or voice recordings to train AI models.

3. Data Storage & Retention

• Guest session data — stories and uploaded files are retained for 30 days after the last activity, then automatically deleted.
• Registered user data — retained for as long as your account is active. You can delete individual stories, content items, or your entire account at any time.
• Generated audio files — stored in our server's public storage. Deleted when the associated story or content item is deleted.
• Voice samples (for custom voices) — stored privately. Deleted when you delete the custom voice.
• Server logs — retained for 30 days.

Our servers are located in India. Data is not transferred internationally unless required to access HuggingFace AI model APIs (the text you submit is sent to HuggingFace for processing under their Privacy Policy).

4. Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share information only in these cases:

• AI Processing: Story text and document text are sent to HuggingFace's inference API to generate content and audio. This is strictly for service operation.
• Legal requirement: If required by Indian law, court order, or to protect the rights and safety of users.
• Business transfer: If Kekar is acquired or merged, user data may transfer to the new entity, with advance notice given to users.

5. Cookies & Sessions

We use a single session cookie (kathavaani_session) to:

• Keep you logged in across page loads.
• Associate guest stories and reader content with your browser before you register.
• Store your active voice preference.

We do not use third-party tracking cookies, analytics SDKs, or advertising pixels. You can clear this cookie at any time via your browser settings — you will simply be logged out and any unsaved guest content will be unlinked.

6. AI-Generated Content

Stories generated by Kekar are produced by large language models. While we prompt for cultural accuracy, AI-generated content may occasionally be inaccurate, inconsistent, or incomplete. Please review content before sharing it publicly.

You own the stories you generate on Kekar. We do not claim any intellectual property rights over the output.

7. Your Rights

Under applicable Indian data protection law (DPDP Act 2023) and general privacy principles, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and all associated data.
• Withdraw consent at any time by deleting your account.
• Data portability — request an export of your stories.

To exercise any of these rights, use the Contact Us page or delete your content directly from your account.

8. Children's Privacy

Kekar is suitable for all ages, but account registration requires users to be at least 13 years old. We do not knowingly collect personal data from children under 13. If you believe a child has registered without parental consent, please contact us and we will delete the account promptly.

9. Security

We implement industry-standard security measures including:

• Bcrypt password hashing (passwords are never stored in plain text).
• CSRF token protection on all forms.
• HTTPS enforcement in production.
• File upload validation and type checking.
• Separation of admin and user authentication guards.

No system is 100% secure. If you discover a security vulnerability, please disclose it responsibly via our contact form.

10. Policy Changes

We may update this policy as the service evolves. When we make material changes, we will update the "Last updated" date at the top and notify registered users via email at least 7 days before changes take effect. Continued use of Kekar after that date constitutes acceptance of the updated policy.

11. Contact

For privacy-related queries, data access requests, or complaints:

• Email: privacy@kathavaani.in
• Contact form: kathavaani.in/contact

We aim to respond to privacy requests within 72 hours.