Privacy Policy

This Privacy Policy explains how Kaushal Jain, an individual ("Kasa," "we," "us," or "our"), the operator of the Kasa web application (the "Service"), collects, uses, discloses, and protects information when you use the Service.

1. Who We Are

Kaushal Jain (individual operator of Kasa)
Country: India. Postal address: provided on request by email, and to authorities where the law requires.
Contact email: thekasacommunity@gmail.com

If you are located in India, see Section 12 for our designated Grievance Officer, as required under the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

2. Information We Collect

2.1 Account information

When you sign in with Google, we receive your name, email address, and profile photo URL from Google. We do not receive or store your Google password.

2.2 Content you create or send

• Direct messages with other users, and message-request/invitation details (including space invitations you send or receive). These are stored in our database and automatically deleted after 24 hours.
• Inside a room — chat, whiteboard drawings, uploaded files, code/document editor content, shared screens, and other content you share — travels directly between the participants' devices and is not stored on our servers. It disappears when the room ends, although other participants may keep their own copies.
• Display name, room names/topics you create (a public room's name, topic, capacity and host name are visible in the public room list), and social connections (who you follow/are followed by)

2.2a Issue reports you send us

If you use the Report an issue button, we store what you type (the category, a short summary and your description), your account name and ID, and an email address if you give one. If you leave the box ticked, we also store technical details: your browser and device type, screen size, language, time zone, app version, which part of the app you were in, and the last few error messages. You can see exactly what will be sent before you press Send. Reports are visible only to us and are used to fix the problem and, if you left an email, to reply. We delete a report once the problem is dealt with, and you can ask us to delete yours at any time (see Section 14). If you send a report by email instead, it is handled like any email you send us.

2.3 Call and communication metadata

We store limited metadata to enable audio/video calling and notifications: who called whom, call type (audio/video), and timestamps. We do not record or store the audio/video content of your calls or rooms — media is transmitted directly between participants' devices (peer-to-peer) and is encrypted in transit. Where a direct path between two devices is not possible (for example on some mobile or corporate networks), the still-encrypted media is passed through a relay (TURN) server operated by our relay provider; the relay does not record or store it. Because connections are direct, other participants in a call or room can see your network (IP) address.

2.3a Live captions

When someone in a room turns on the captions (CC) button, each other participant's browser turns that participant's own speech into text and sends the text to the room, so that the person who turned captions on can read what others say. This uses the browser's built-in speech recognition (available in Chrome, Edge and Safari), which may send the audio to the browser maker's speech service (for example Google for Chrome, Apple for Safari) — not to us. We do not receive, record or store the audio or the text; the text is shown on screen for a few seconds and is not saved. You are told when it starts for you, and muting your microphone pauses it. Captions do not run on Android phones.

2.4 Device and push notification data

If you enable notifications, we store a device-specific push token (via Firebase Cloud Messaging) to deliver notifications to your device. We generate a random device identifier stored in your browser's local storage; this is not linked to any advertising identifier.

2.5 Technical and usage data

Our hosting and infrastructure providers (see Section 5) automatically log technical data such as IP address, browser type, device type, and access timestamps, for security, abuse prevention, and service operation purposes. If error monitoring is enabled, our error-monitoring provider receives technical information about crashes (the error message, browser and device type, the page address and IP address); it does not receive the content of your messages, calls, or rooms.

2.6 Information we do NOT collect

We do not collect payment card information, government identification numbers, precise geolocation, biometric data, or health information through the Service.

3. How We Use Your Information

• To create and manage your account, and authenticate you
• To provide the core functionality of the Service: rooms, chat, whiteboard, calling, and social features
• To deliver notifications you have opted into (calls, messages, missed-call alerts)
• To maintain security, prevent abuse, fraud, and enforce our Terms of Service
• To respond to support requests and legal obligations (e.g., grievance redressal, lawful requests from authorities)

We do not sell your personal information, and we do not use your content to serve third-party advertising.

4. Legal Basis for Processing (EEA/UK users)

If you are in the EEA or UK, we process your information under the following legal bases pursuant to the General Data Protection Regulation (GDPR):

• Contractual necessity — to provide the Service you have requested (account, rooms, calling, messaging)
• Consent — for optional features such as push notifications, which you can withdraw at any time
• Legitimate interests — for security, fraud prevention, and service improvement, balanced against your rights
• Legal obligation — where we must retain or disclose information to comply with law

5. How We Share Your Information

We share information only with the following categories of recipients, each acting as our data processor/sub-processor under contract, not as independent owners of your data:

We may also disclose information: (a) to comply with a valid legal process, court order, or governmental request; (b) to protect the rights, safety, or property of Kasa, our users, or the public; or (c) in connection with a merger, acquisition, or sale of assets, with notice to you where required by law.

6. International Data Transfers

Our infrastructure providers operate global server networks, which means your information may be processed in countries other than your own, including the United States. Where we transfer personal data out of the EEA/UK, we rely on appropriate safeguards such as Standard Contractual Clauses. Where we transfer data of Indian users outside India, we do so consistent with the Digital Personal Data Protection Act, 2023 and any rules notified thereunder.

7. Data Retention

Direct messages and message requests are deleted automatically after 24 hours. Room content is not stored on our servers (see Section 2.2). We retain your account data for as long as your account is active. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we are required to retain it for legal, security, or dispute-resolution purposes. Consistent with Indian IT Rules, we may retain certain records for 180 days following any account cancellation or withdrawal of registration, for investigation and law-enforcement purposes.

8. Your Privacy Rights

8.1 If you are in India (Digital Personal Data Protection Act, 2023)

• Right to access a summary of your personal data we process
• Right to correction and erasure of your personal data
• Right to grievance redressal through our Grievance Officer (Section 12)
• Right to nominate another individual to exercise your rights in the event of death or incapacity
• Right to withdraw consent at any time for processing based on consent, without affecting prior lawful processing

8.2 If you are in the EEA/UK (GDPR)

• Right to access, rectify, or erase your personal data
• Right to restrict or object to processing
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection supervisory authority

8.3 If you are in California (CCPA/CPRA)

• Right to know what personal information is collected, used, and disclosed
• Right to delete personal information, subject to certain exceptions
• Right to correct inaccurate personal information
• Right to opt out of the sale/sharing of personal information — we do not sell or share your personal information for cross-context behavioral advertising
• Right to non-discrimination for exercising your privacy rights

8.4 Exercising your rights

You can also use the in-app Export My Data and Delete Account links (shown at the bottom of the home screen while you are signed in) to download or permanently delete your account data yourself.

To exercise any of the above rights, contact us at thekasacommunity@gmail.com. We will verify your identity before fulfilling a request and will respond within the timeframe required by applicable law (for India, generally within a reasonable time as prescribed by the DPDP Act and its rules).

9. Children's Privacy

The Service is intended for people who are 18 years of age or older (the age of consent under India's DPDP Act, and above the digital-consent age in the EEA/UK and the US). It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact us and we will take steps to delete it.

10. Security

We use industry-standard safeguards to protect your information, including encrypted transport (HTTPS/TLS), authenticated and access-controlled database rules, and server-side verification of identity tokens before performing privileged actions. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

11. Cookies and Local Storage

We use browser local storage (not third-party tracking cookies) to remember a device identifier for push notifications and basic session preferences. We do not use third-party advertising or analytics cookies at this time. If this changes, we will update this policy and request consent where required.

12. Grievance Officer (India)

In accordance with the Information Technology Act, 2000 and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the Grievance Officer for the Service is:

Name: Kaushal Jain
Designation: Founder and operator
Email: thekasacommunity@gmail.com
Postal address: in India; provided on request by email and to authorities where the law requires.
We will acknowledge complaints within 24 hours and resolve them within the timeframes prescribed by applicable rules (generally within 15 days for most complaints, and within shorter statutory windows for specific categories of unlawful content).

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy with a new "Last updated" date, and, where required by law, seek renewed consent.

14. Contact Us

Questions about this Privacy Policy can be sent to thekasacommunity@gmail.com.