Katha (कथा / കഥ) — Privacy Policy

Effective date: 11 Oct 2026

Katha, operated by Elemint Studio LLC, a California limited liability company (“we,” “our,” or “the app”), is a family storytelling application that helps families preserve oral histories through voice recordings. We take your privacy seriously. This policy explains what information we collect, why we collect it, and how we protect it.

1. Information We Collect

Information you provide directly:

• Account details — email address, display name, and password (or Google account credentials if you choose “Continue with Google”).
• Profile information — preferred name, date of birth (used to confirm you are 18 or older), and an optional profile photograph.
• Audio recordings — voice stories you record within the app.
• Transcripts & edits — text generated from your recordings, including any corrections you make.
• Photos — images you attach to stories.
• Family information — names of family members you invite or tag, and the family albums you create or join.
• Comments & reactions — text comments and heart reactions left on stories.
• Feedback — bug reports or feature suggestions you submit through the in-app feedback form. We may copy feedback, in full or in part, into our private issue tracker (Section 4).

Information collected automatically:

• Device information — device model, operating system version, and app version/build number, used for crash reporting and diagnostics.
• Crash reports — stack traces, device model, operating system and app version, sent to Firebase Crashlytics together with your Katha account ID so we can find and fix the problem. Crash reporting is on by default; you can turn it off at any time in the app’s Settings → Privacy → Crash Reports.
• Push notification tokens — device tokens used to deliver notifications about new family stories or comments.
• Approximate location — if you opt in to analytics (see Section 12, which also covers older test versions): Firebase Analytics and Firebase Performance Monitoring work out your approximate location, such as your country or city, from your device’s IP address. Katha never asks for location permission and never collects your precise location.

2. How We Use Your Information

• Preserve your stories — store and sync your audio recordings, transcripts, and photos so they are accessible to you and your invited family members.
• Transcription & translation — send your audio to Google’s Gemini API (see Section 4) to generate text transcripts, and optionally translate them for family members who speak different languages.
• Family sharing — allow invited family members to listen to stories, leave reactions, and add comments within shared family albums.
• App improvement — use crash reports and diagnostics to identify and fix technical issues.
• Notifications — send push notifications when new stories are shared or family members interact with your recordings, and to encourage regular recording — a weekly recording reminder and an occasional nudge if you have not recorded in a while. New accounts start with these two reminders turned on; you can turn either off anytime in the app’s Settings.

3. How We Store & Protect Your Data

• Local-first architecture — recordings are saved to your device first and synced to the cloud only when a stable connection is available. You retain a local copy at all times.
• Cloud storage — cloud data is stored on Google Firebase (Firestore, Firebase Storage, Firebase Auth) with encryption in transit and at rest.
• Where your data is stored — recordings and photos are stored in Firebase Storage in Google Cloud’s Asia–South 1 (Mumbai, India) region, and the server functions that manage your stories run there too. Other app data is stored in our database (Cloud Firestore) in Google Cloud’s United States multi-region. This includes your profile (such as your name and date of birth), your album memberships, story titles, transcripts and translations, and comments and reactions. The database’s backups are kept in the same United States location. Transcription and translation are processed by Google’s Gemini API, which runs on Google’s global infrastructure and is not tied to one region (see Section 5).
• Authentication — passwords are handled by Firebase Authentication and are never stored in plaintext by Katha.

4. Third-Party Services

We use the following third-party services to operate the app:

• Google Firebase — authentication, database, file storage, push notifications, crash reporting, and, if you opt in (Section 12), usage analytics and performance monitoring.
• Google Sign-In — optional sign-in method.
• Google Gemini API — speech-to-text transcription, translation, and content processing of transcripts.
• RevenueCat — manages purchases and the Katha Heritage subscription made through Google Play. It receives your Katha account ID, the ID of the album a purchase is for, and your purchase and subscription history — never your card details (see Section 11).
• Resend — sends Katha’s emails, such as the email that tells someone their request to join your album was approved, and our own notices to us when someone reports content. It receives the recipient’s email address and the content of the email.
• Anthropic — we use Anthropic’s Claude to help us sort feedback and content reports before we act on them. It receives the feedback or report as stored, including any voice-note transcript, device details and the account and album IDs.
• GitHub — our private issue tracker. When you send feedback or report content, we may copy it, in full or in part, into a private GitHub issue so we can act on it. An issue about a content report can also include a short summary or quote of the reported story, comment or translation, and the IDs of that story and its album. These copies stay after the account of the sender, or of the reported content’s author, is deleted, unless you ask us to remove them.

The katha.family website also uses Vercel, which hosts it, and Google Analytics; see Section 17.

We do not sell your data to any third party. Audio and transcripts sent to the Gemini API are used to produce transcripts and translations. Under Google’s terms for the paid Gemini API, Google does not use them to improve its products or train its models.

AI Transcription Services

When you record a story, the audio file is sent to Google’s Gemini API for transcription. Google processes it to return a text transcript and, under Google’s terms for the paid Gemini API, does not use it to improve its products or train its models. The transcript is returned to Katha and stored with your story in our database in the United States (see Section 3). Audio files are stored in Firebase Storage (Asia–South 1, Mumbai); transcription runs on Google’s global infrastructure, which may include data centres outside India.

5. International Data Transfers

Your recordings and photos are stored in Asia–South 1 (Mumbai, India), where the server functions that manage your stories also run. Your profile, transcripts, comments and other app data are stored in our database in Google Cloud’s United States multi-region, together with its backups (see Section 3). Recordings, transcripts and other text we send to Google’s Gemini API are processed on Google’s global infrastructure; under Google’s terms for the paid Gemini API, this data may be stored temporarily or cached in any country where Google or its agents have facilities, such as the United States. Google also keeps a log of our requests and its responses, including transcripts, for 55 days, to detect and prevent misuse and for any legally required disclosures. Account authentication is handled by Firebase Authentication, which processes data in the United States. Crash reports, push notifications and, if you opt in (Section 12), analytics and performance data are handled by Firebase services on Google’s global infrastructure, which may process data in any country where Google or its agents have facilities. Purchases are managed by RevenueCat, and emails are sent by Resend; both process data in the United States. Copies of feedback and content reports are kept on GitHub, which stores and processes data in the United States and other countries. Anthropic, which helps us sort them, stores data in the United States and may process it in the United States, Europe, Asia and Australia. The website’s host, Vercel, and Google Analytics may process website data in the United States (Section 17). By using Katha, you consent to the transfer of your data to these locations for the purposes described in this policy.

6. Sharing Your Information

Your stories and profile information are shared only with family members you explicitly invite to your family album, and through a share link if you or another album member creates one (below). We do not have public feeds, social discovery, or advertising.

Share links. Any member of an album can create a link to one of its stories (katha.family/s/…) to send to someone. Anyone who has that link can see a short preview of the story without signing in: its title, the author’s name, the first 150 characters of its transcript (with an English translation if the story is in another language), and its length. The link never gives access to the full transcript or the recording. Permanently deleting the story removes the preview.

We will not share your personal information with third parties except:

• With the service providers named in Sections 4 and 17, solely for the purposes described there.
• If required by law or to protect the safety of our users.

7. Your Rights & Choices

• Access & export — you can download an album’s recordings, transcripts and photos as one archive at any time in the app: Settings → Your Data → Download Everything. You can also request a copy of your data by contacting us at kathalabs.help@gmail.com.
• Correction — you can edit your transcripts and profile information at any time within the app.
• Deletion — you can delete your account directly from the app’s Settings screen. The process includes multiple confirmation steps and re-authentication for your protection. You can also request deletion by contacting us at kathalabs.help@gmail.com. See Section 8 for details on what happens to your data upon deletion.
• Notifications — you can disable push notifications through your device’s system settings. In-app notification preferences are available in Settings; full server-side enforcement of these preferences is being developed for a future update.
• Privacy controls — you can set listening preferences in the app’s Settings. Granular access controls are being developed for a future update.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data (profile, comments, reactions, and family associations) is removed immediately. If you choose to keep your stories for your family (“Keep for Family”, the default), they stay in the album, credited to “A Former Member” instead of your name, and remain accessible to your family album members. They are not anonymous: the recording still has your voice, the transcript still has your words, and your name stays in the recording file’s technical details. From 12 October 2026, if you are the last member of an album, that album and all its stories are deleted with your account, even if you chose “Keep for Family”. Purchase records are kept for refunds, tax and Google Play. Crash reports, linked to your account ID, are kept by Google Firebase for up to 90 days for diagnostic purposes. The full list of what is deleted and what is kept is at katha.family/delete-account. Anything we delete, whether your account or a single story, may remain in our encrypted backups and server logs for up to 30 days after it is finally deleted (for a single story, that is when it leaves Recently Deleted). Those copies then expire. We use these backups only to recover from errors.

Deleting a single story — Recently Deleted (about 7 days)

When you delete an individual story, it disappears from your family album immediately, but it is not destroyed straight away. It moves to Settings → Recently Deleted, where the story’s author or the album owner can restore it for about 7 days. This exists because a recording of a relative’s voice cannot be re-created after a mis-tap.

During that window:

• The story, its transcript, its recording and its cover photo are still stored on our servers, and are still counted against your album’s story limit.
• The app hides the story from every other member of the album — it no longer appears in the journal, in search, or in any export or backup you download from within the app. If you had previously shared a public link to the story, that link’s limited preview is a separate surface and is not automatically taken down by moving a story to Recently Deleted; delete the story permanently (or email us) to remove it.
• The story’s author or the album owner can restore it at any time, or delete it permanently right away — permanent deletion runs the same server-side erasure described above and cannot be undone.

After the window expires the story is deleted automatically, along with its recording, cover photo, comments and reactions. The automatic sweep runs on a schedule, so a story may persist for up to about a day past the 7-day mark before it is removed; we say “about 7 days” rather than “exactly 7 days” for this reason. Deleting your whole account is not affected by this window — account deletion follows the process described above.

9. Children’s Privacy

You must be 18 or older to create a Katha account. The app is not directed at, and account holders may not be, anyone under 18. Children may appear as recorded subjects in stories created by an adult account holder, but no person under 18 may hold an account or directly use the app. We do not knowingly collect personal information directly from anyone under 18. If you believe a person under 18 has created an account, please contact us at kathalabs.help@gmail.com and we will promptly close the account and delete the associated data.

10. Additional Information for California Residents

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know — you may request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete — you may request that we delete personal information we have collected from you.
• Right to Non-Discrimination — we will not discriminate against you for exercising your CCPA rights.
• Authorized Agents — you may designate an authorized agent to submit requests on your behalf. We may require verification of your identity and the agent’s authority.

We do not sell or share your personal information for cross-context behavioral advertising. To exercise your rights, contact us at kathalabs.help@gmail.com.

11. Subscription Data & Billing

Katha offers a one-time Katha Gift and a Katha Heritage subscription, both purchased through Google Play. We do not collect or store your payment card details. Purchase history, subscription status, and billing periods are managed by RevenueCat (our subscription management service) and Google Play. When a subscription expires, your album enters a cooling period as described in our Terms of Service (Section 5).

12. Analytics & Consent

If you opt in to analytics (via the in-app prompt shown after your first story, or at any time in Settings), we collect usage events through Firebase Analytics, and app performance data through Firebase Performance Monitoring. These events include: which screens you visit, how many stories you record, and subscription-related actions (paywall views, purchases). Events never contain your name, your email address, transcript text or audio. They carry a Firebase-assigned app instance ID and randomly generated IDs for your album, stories and share links, so we can count things like stories per album. Both services also work out your approximate location, such as your country or city, from your IP address (see Section 1). Analytics is off until you turn it on, and you can turn it off again at any time in the app’s Settings → Privacy. Crash reports have their own switch there (see Section 1). One exception: in test versions up to 2.3.15, which only testers received, Firebase Analytics and Firebase Performance Monitoring started each time the app opened, before your choice was applied, so they could collect data, including your approximate location, even if you had not opted in. Version 2.3.16 and later wait for your choice; updating the app fixes this.

13. GDPR Rights (European Economic Area, United Kingdom and Switzerland)

If you are located in the European Economic Area, the United Kingdom or Switzerland, you have the following additional rights under the General Data Protection Regulation (GDPR) and its UK and Swiss equivalents:

• Right to access — request a copy of your personal data.
• Right to rectification — correct inaccurate data.
• Right to erasure — request deletion of your data (see Section 8).
• Right to restrict processing — request that we limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing of your data for certain purposes.

To exercise these rights, contact us at kathalabs.help@gmail.com. We will respond within 30 days. You can also complain to your data protection authority, such as the Information Commissioner’s Office in the UK.

14. Compliance

Katha is designed to comply with:

• India Digital Personal Data Protection Act, 2023 (DPDP)
• California Consumer Privacy Act (CCPA)
• Google Play Developer Program Policies

15. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the “Effective date” at the top of this page and, for significant changes, notify you through the app.

16. Website Reminder List

The “Get the Diwali reminders” sign-up at katha.family/waitlist is separate from a Katha app account — signing up there does not create one.

• What we collect — your name, your email address, and, if you choose one, a note on whether you are recording for yourself, sending Katha as a gift, or both. In our database we store a SHA-256 hash of the IP address you submitted from instead of the address itself, together with a signup timestamp and an internal status flag. Our servers’ request logs also record the IP address of each sign-up; they are deleted after 30 days (Section 17).
• Why — your name and email are used to send the reminder emails listed on the sign-up page for the Diwali launch window (currently three: the day Katha opens, a nudge before Diwali, and a note when the window closes). The IP hash is used only to limit sign-ups to five a day from the same connection, to curb spam and abuse; it is never used to identify or contact you. If we invite your sign-up into early testing, your email is also added to an access list that lets you install the app, and you receive a separate email with that link.
• Who processes it — your name, email, and the IP hash are stored in our Firestore database in Google Cloud’s United States multi-region, the same database described in Section 3. The reminder emails and any early-access invitation are sent through Resend, our email provider. When you sign up, we also email ourselves your name, your email address and your choice, through Resend.
• How long we keep it — we delete the whole list, the IP hashes and the copies emailed to us by 30 November 2026, after the Diwali launch window closes. You can ask us to remove your sign-up sooner at any time.
• Unsubscribing & deletion — to stop receiving these emails or to have your sign-up information deleted at any time, email us at kathalabs.help@gmail.com.

17. The katha.family Website

This section covers visits to katha.family. The rest of this policy applies to website data too, including your rights (Sections 7, 10 and 13) and how to reach us (Section 18).

• Hosting and server logs — Vercel, a US company, hosts the website. Like any web host, its servers log each request, including your IP address, your browser type and the page you asked for, to run and protect the site; Vercel keeps those logs for a limited time under its own policies. When you send a form on the site, such as the reminder sign-up or a request to join an album, it goes to our own servers on Google Cloud, whose request logs, including your IP address, are deleted after 30 days.
• Asking to join an album — if you ask to join an album from a shared story page, we store your name, your email address and any note you add, and show them in the app to the person who shared the story, with your name in a notification, so they can approve or decline. We delete the request after 30 days. To limit abuse, we also keep a SHA-256 hash of your IP address for two days. If your request is approved, we add your email address to our access list and to an invitation for that album, and email you an install link through Resend (Section 4); these stay until you ask us to remove them. While Katha is still in testing, before it is public, we also email ourselves your name, your email address and the album’s name, and add your email address to our Google Play testers group so the install link works; we delete those emails by 30 November 2026.
• Google Analytics — we use Google Analytics to count visits, see which pages and buttons people use, and learn which links and campaigns bring people to the site. It records the address and title of each page you view, how long you spend on it, the site or link that brought you here (including campaign tags in the link), your device type and model, operating system, browser, language and screen size, your approximate location (country, region and city), and some of the buttons you tap, such as “Give Katha”, including whether a reminder sign-up went through. On a shared story page it also records that the link was opened, with the link’s short code, whether a translated preview was shown, and the story’s original language. Google Analytics’ standard measurement can also record how far you scroll, links you follow to other sites such as Google Play, and when you start or send a form. Invitation details (the inviter’s name and account ID, and the album’s name and ID) are removed from the page addresses and links that Google Analytics records, and shared story pages don’t send the story’s title. The “Download Katha” button on an invitation page passes the invitation to Google Play, so the app can open the right album after it installs. Google works out your approximate location from your IP address and says it does not store the IP address. Analytics sets two cookies: _ga, which holds a random ID so that repeat visits are counted once, and _ga_ followed by an ID, which keeps track of your current visit. Each is set to expire two years after your most recent visit, though some browsers delete them sooner. Google deletes visit-level Analytics data two months after the visit, and visitor-level data two months after your most recent visit, in a monthly sweep, so it can take a few weeks longer; after that our reports keep only counts, such as visits per page, city or device. We have turned off Google signals and every setting that shares this data with Google for its own purposes, and we never use it for advertising.
• Your choice — if you visit from the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar, the European Economic Area (including EU regions such as Réunion), Switzerland or Quebec, or if we can’t tell where you are visiting from, Google Analytics starts only after you accept it in the cookie banner. Everywhere else it runs when you visit, and you can switch it off at any time. Wherever you are, “Cookie settings” at the bottom of every page lets you change your answer, and turning Analytics off removes its cookies. Where we ask first, we rely on your consent, which you can withdraw at any time in Cookie settings. Google processes Analytics data in the United States; for visitors from the UK, the EEA and Switzerland, that transfer relies on the EU–US Data Privacy Framework, its UK Extension and the Swiss–US Data Privacy Framework, under which Google LLC is certified.
• What the site stores for your choice — your answer is kept in your browser’s local storage. One cookie, katha_consent_region, records only whether visitors from your region are asked first; it holds no identifier and expires after a day.

18. Contact Us

If you have questions about this privacy policy or your data, please contact us:

Email: kathalabs.help@gmail.com