Kagelin — Privacy Policy

Last updated: 2026-08-25. Not legal advice. A plain-language description of how Kagelin handles your data.

---

1. Who we are

Kagelin ("we," "us," "our") is a task, habit, and focus-management application, operated by Achyuth S, operating as Kagelin, based in India, reachable at privacy@kagelin.app. This policy explains what personal data Kagelin collects, why, and what rights you have over it, whether you're in India, the EU, California, or anywhere else.

Kagelin is currently in invite-only beta. This policy will be updated as features (billing, native apps, encrypted-at-rest content) ship; check the "last updated" date above.

2. Guest Mode: the default is zero collection

If you use Kagelin without creating an account, we never receive your task, habit, or focus data. Tasks, habits, focus sessions, and settings are stored only in your browser's local storage, on your device. The one exception is anonymous usage telemetry, which is off by default and only sends anything if you explicitly opt in (see Section 5). Switching to an account moves your local data to our servers, at which point the rest of this policy applies.

3. What we collect (registered accounts)

We do not collect: phone number, physical address, government ID, payment/financial information (no billing exists yet), or social-media profile data (no "Sign in with Facebook/Twitter").

Founding cohort: if you signed up for our early-access waitlist (kagelin.app's homepage) as part of the founding cohort, we hold that signup (email, cohort, invite/grant timestamps) in the same database as registered accounts. When you confirm an app account using that same email, we automatically check it against your waitlist signup and, on a match, apply the founding-cohort offer to your account (see Section 8 of the Terms of Service for what that offer is). This check is automatic and internal — the waitlist data isn't shared with any processor beyond what's already listed in Section 4.

4. Who we share data with

We do not sell personal data, and we do not use it for advertising or remarketing. Kagelin has no ads and no ad-tech integrations. We use these processors to operate the service:

• Supabase: database hosting and authentication.
• Resend: transactional email (magic-link sign-in, notifications), sent from a verified kagelin.app domain.
• Sentry: error monitoring. May capture technical diagnostic data (IP address, browser info, stack traces) at the moment an error occurs.
• Upstash: rate limiting. Sees only an IP address or user ID and the fact of a request, never your task/account content.
• Cloudflare (Turnstile): bot-prevention challenge on the sign-in form.
• Have I Been Pwned (pwnedpasswords.com API): checked when you set a password, to warn you if it's been exposed in a known breach. Only a 5-character prefix of your password's SHA-1 hash is sent (k-anonymity); your password and account identity never leave your device for this check.
• Google / Microsoft: only if you connect a calendar, governed by your existing relationship with those providers as well as this policy. Kagelin's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Cloudflare R2: stores our nightly, GPG-encrypted (AES-256) full database backup, as a disaster-recovery backstop. Not accessible without the separately-held encryption passphrase.

Each processor is bound by its own terms; we don't share data with anyone beyond what's needed to run the listed feature.

5. Cookies, local storage, and anonymous telemetry

We use browser local storage / IndexedDB to keep the app responsive offline (this is core to how the PWA works, not a tracking mechanism) and a session cookie for authentication. We do not use third-party advertising or analytics cookies (no Google Analytics or similar is integrated).

Anonymous usage telemetry (opt-in)

Kagelin can optionally send anonymous product-usage telemetry, off by default for everyone — Guest Mode and registered accounts alike. You're asked to opt in via an in-app prompt, and can turn it on or off any time in Settings → Privacy & Data.

If you opt in:

• We generate a random device ID, not tied to your account, email, or authenticated identity, and store it in your browser.
• We record only enumerated event types and counts — for example, that a focus session completed or a task was created — never task titles, habit names, notes, or any other content.
• Raw events are deleted after 30 days; only aggregate daily counts (like "42 focus sessions completed today") are kept longer, for product metrics.
• Your IP address is used in memory, at the moment a request is made, only to rate-limit abuse; it is never stored alongside telemetry data.
• Opting out immediately stops all telemetry and discards your device ID.

6. Your rights

If you're in the EU/UK (GDPR)

You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. Our legal basis for processing is contract performance (running the account you signed up for) and legitimate interest (security, abuse prevention). We don't currently have a formal EU representative under GDPR Article 27. This is a known open gap, not a claimed exemption. Article 27's "occasional processing" exemption is narrowly interpreted and generally doesn't cover an ongoing account-based SaaS, so it likely doesn't apply here once EU users are real. We intend to appoint a representative (a low-cost annual service, not a law firm) before actively recruiting EU users at scale. You can lodge a complaint with your local data protection authority regardless.

If you're in California (CCPA/CPRA)

You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" of personal information, which is moot here since we do not sell or share personal information for cross-context behavioral advertising. We do not discriminate against users who exercise these rights.

If you're in India (DPDP Act, 2023)

See the dedicated section below. DPDP grants similar access/correction/erasure/grievance rights and additionally requires a named grievance contact.

CalOPPA (California)

This policy is posted at kagelin.app/privacy and describes the categories of information collected, third parties we share with (Section 4), and how to request changes (contact us, Section 12). We do not currently respond differently to browser "Do Not Track" signals, since we don't run tracking scripts that would be affected by it.

Regardless of jurisdiction

Every user, anywhere, can request account and data deletion by contacting us; see Section 7.

7. Data retention & deletion

We keep your data as long as your account is active. The in-app "Clear Cloud Data" feature deletes your tasks, projects, habits, focus logs, and calendar events immediately. Full account deletion (profile, push subscription, connected-calendar records, stored OAuth tokens, and the underlying account itself) is currently handled manually during beta. Email privacy@kagelin.app and we will delete all remaining personal data within 30 days. (A self-serve "Delete my account" flow is planned before the app exits beta.)

This doesn't reach our nightly encrypted database backups (Section 4): those roll off automatically 30 days after the night they were taken, regardless of when you delete your account or data in between, since they're whole-database snapshots rather than per-account records.

8. India DPDP Act notice & Grievance Officer

Under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, we act as a Data Fiduciary and you as a Data Principal, regardless of your location. This section applies in addition to, not instead of, the rest of this policy.

Grievance Officer: Achyuth S, privacy@kagelin.app. Per the DPDP Rules, 2025, we will resolve grievances within 7 days of receipt; this is a mandated timeline for every data fiduciary, not a target we've chosen.

Cross-border transfer: your data may be processed on servers outside India (our processors' infrastructure). The DPDP Act permits this except to countries specifically restricted by the Indian government; none currently apply to our processors.

Consent withdrawal: disconnect optional features (calendar sync, push notifications, WebDAV) any time in Settings; email us to withdraw consent to processing entirely (equivalent to account deletion, Section 7).

9. Children's privacy

Kagelin requires users to be at least 18 years old (see Terms of Service, Section 3). This single threshold covers DPDP's definition of a child (under 18, requiring verifiable parental consent, a flow Kagelin doesn't support), COPPA's under-13 threshold, and GDPR's 13-to-16 age-of-digital-consent range. There is no age-verification step beyond the account-creation acknowledgment. If you believe someone under 18 has an account, contact us and we'll delete it.

10. Security

• Calendar OAuth refresh tokens: encrypted at rest (AES-GCM), service-role-only access.
• WebDAV credentials: never persisted, in-memory for the session only.
• Database access: row-level security scoped to your account governs what the app itself can read on your behalf. It does not limit us: as the operator, we have administrative access to the underlying database (via Supabase) for operations, debugging, and support.
• Sensitive account changes (like setting a password) require reauthentication.
• Task/habit content itself is not yet encrypted at rest, so it's currently readable through that administrative access. We're committed to closing this before opening signups beyond the current invite-only cohort — not deferred to some later, unspecified "post-beta."

No system is perfectly secure; we can't guarantee absolute security, but we design for it.

11. Changes to this policy

We'll update the date at the top and, for material changes, notify registered users by email.

12. Contact

For privacy questions, data requests, or grievances under any jurisdiction above, contact privacy@kagelin.app.