Kaalakkanitham Privacy Policy

Last updated: 26 October 2026

This policy explains what the Kaalakkanitham app ("the app", "we", "us") collects, why, who it is shared with, how long it is kept, and the choices you have. It covers the Kaalakkanitham app on Google Play and our server that the app talks to.

1. What we collect and why

1.1 Your account (members)

When you become a member we keep: your name, mobile number, email address (if you give one), gender, country, Member ID, membership plan and expiry date, preferred language, the referral code you used (if any), and your password - stored only in a scrambled form that cannot be turned back into the password. We use these to run your membership, sign you in, send you one-time codes, receipts and renewal notices, and help you when you contact us.

1.2 Your phone (everyone, including guests)

For every phone that uses the app we keep: a scrambled phone ID (a one-way code made from Android's device ID, not the ID itself), the date the app was first installed, country, time zone, app language, the notification token used to send you notifications, and - if you are a member signed in on that phone - your Member ID and mobile number. We use these to give free trials fairly, to keep one account per phone, to send notifications at the right local time, and to prevent misuse.

1.3 Wallet, purchases and points

Top-ups and membership payments are handled by Google Play. We never see or store your card, UPI or bank details. We keep what was bought, the amount, currency and date, Google's purchase reference, your wallet balance, the credit points you earn (quiz streak, Full Moon Walk, referrals) and how they were used, and how many free PDF reports you have used.

1.4 Birth details and reports

• Birth details stay on your phone. Your birth profile, and the birth details of any family members you add, are saved only on your phone in Android's encrypted storage.
• What is sent for a report. The app works out the birth chart on your phone and sends our server only chart facts: planet signs and degrees, Rasi, Nakshatra, Lagna, Dasha periods and the day's panchangam, with your gender and language. Your name, birth date, birth time and birth place are not included. (Older versions of the app also sent the birth date, time and place with weekly and monthly reports; our server ignores them - it never stores them or passes them on.)
• Marriage matching sends the chart facts of both people - no names or birth details.
• Rahu-Ketu Peyarchi 2026 (members): you can ask for your own report and up to three family members' reports. The chart facts and the finished report are kept on our server until 30 days after your phone has saved the report; your own report may be prepared ahead of the transit using chart facts the app sends once. After that only a short record remains (Member ID, a fingerprint of the chart, language) until the transit ends on 24 June 2028, when everything is deleted.
• My Life Report (members): a report from your own birth chart. The app sends the chart facts, your gender, the language and your age group (18-24, 25-34, 35-44, 45-59 or 60+) - never your name, birth date, time or place. The chart facts and the report are kept on our server until 30 days after your phone has saved the report (90 days after it was made, if it is never collected). A short record of each report (date, free or paid, language, a fingerprint of the chart - no report text or birth details) stays while your account exists, so the free-remake rules can be applied, and is deleted with your account.
• Report history: for each report we note which report, when, the language, whether it worked, and your Member ID or scrambled phone ID. This helps us answer complaints and keep the service fair. Kept 60 days.
• PDF reports are made on your phone.

1.5 Location

The Planetary positions screen, and the "Use my current location" button for choosing your city (used for sunrise and today's times), can use your phone's current location - only if you allow it. It is used only on your phone and is never sent to our server; for your city, only its name and position are saved, on your phone. When you search for a birth place or a city, the place name you type is looked up by your phone's built-in place search (provided by Google); it is not sent to our server.

1.6 Physical activity (Full Moon Walk)

If you allow the activity permission, the app counts your steps on your phone during the Full Moon Walk (a notification shows while it is counting). Your step counts stay on your phone. Only the fact that you completed the walk on a given date is sent to our server, to add your points.

1.7 Notifications

We use Firebase Cloud Messaging to tell you when a report is ready, about renewals, and other service news. You can turn notifications off in the app's Settings or in your phone's settings.

1.8 Problem reports and server logs

If the app cannot reach our server, it may send a short technical error message with your Member ID or scrambled phone ID (kept 90 days). Our server's technical logs record the internet (IP) address, time and the request made, for security; they are kept 14 days.

1.9 Analytics and ads (Google)

• Google Analytics for Firebase collects how the app is used (screens viewed, taps, app version, device model, approximate region), linked to an app instance ID and your phone's Advertising ID - not to your name. Firebase In-App Messaging uses this to show messages inside the app.
• Google AdMob shows ads on some screens. It may use your Advertising ID, IP address, how you interact with ads and the app (such as app launches, taps and video views) and information about how the app performs (such as launch time, freezes and battery use), to show and measure ads - which may be personalised - and to prevent fraud. You can reset or delete your Advertising ID, or opt out of personalised ads, in your phone's settings (Settings > Google > Ads, or Settings > Privacy > Ads).

2. Who we share data with

We do not sell your data or share it for anyone else's marketing. We use these service providers, each only for the purpose shown:

• Google Gemini (AI): receives chart facts to write AI reports - never your name or birth details. We currently use Gemini's free service. Under Google's terms for it, Google may use what we send and the replies to improve its products, and trained reviewers at Google may read them.
• Google Play: payments and subscriptions.
• Google Firebase: notifications, analytics and in-app messages.
• Google AdMob: ads.
• Google Drive: our encrypted database backups.
• Gmail (Google): sends emails such as one-time codes, receipts and renewal notices to your email address.
• Twilio: sends SMS one-time codes to your mobile number.
• Cloudflare: carries all traffic between the app and our server and protects it from attacks; it sees your IP address.
• Oracle Cloud: runs our server and its database in Mumbai, India, and keeps an encrypted weekly copy of the server for recovery.

We may also share information if the law requires it, or to protect our users or the service from fraud or misuse.

3. Where your data is stored

Our server and its database run on Oracle Cloud in Mumbai, India (until 21 October 2026 they were in New Zealand). Oracle stores and processes them only to run the server for us, under its cloud terms, which include its data-processing agreement, with the protections described in section 4. Our other service providers may process data in other countries, including the United States. When your data leaves your country, we use only the providers listed above, for the purposes listed above.

4. How we protect your data

• All traffic between the app and our server is encrypted (HTTPS). The app reaches our server only through Cloudflare's secure connection.
• Passwords are stored only in scrambled form (PBKDF2 with 600,000 rounds); sign-in sessions are stored only as fingerprints.
• Database backups are encrypted (AES-256) before they leave the server; the key that opens them is kept offline.
• On your phone, your profile and family details are kept in Android's encrypted storage.
• Only the app's owner can sign in to the server - with a private key, never a password. Oracle, which hosts it, encrypts the server's disks and copies, and its staff reach the systems only as needed to run them.

No system is perfectly secure. If a breach affects your data, we will tell you, and the authorities, as the law requires.

5. How long we keep data

6. Your choices and rights

• See and correct: you can change your email address in the app (Settings), and your birth profile is edited on your phone. For anything else, such as your name, email us.
• Delete your account: in the app, go to Settings > Delete My Account. You confirm with your password and, if your account has an email address, a 6-digit code we send to it; the account is deleted at once and we email you a confirmation (with a copy to our support inbox). Without the app, see how to delete your account, or email challycraf.support@gmail.com with the subject "Account Deletion Request", your Member ID and your registered mobile number; we may send a code to your phone or email to confirm it is you, and we delete it within 30 days. We delete your account details (from every table that holds them), your wallet balance and points and your remaining membership (these can't be refunded), your report history and the reports kept on our server. We keep: payment records (Google Play purchases and membership payments) with your Member ID replaced by a reference number, only as long as the law requires; a record of the deletion request for 3 years, as proof that you asked (your Member ID, the last 4 digits of your mobile, the first letter and domain of your email, scrambled fingerprints of both that can't be turned back into them, the time of each step, your phone's scrambled ID, IP address and app version, and what was lost); your Member ID, which is never given to anyone else; and your phone's install date without your number, so deleting an account doesn't restart the free trial. Copies in our backups disappear within 30 days.
• Data on your phone: uninstalling the app, or clearing its data, deletes your birth details, family members and saved reports from the phone.
• Withdraw permission: you can turn off location, physical activity and notification permissions at any time in your phone's settings. The related features will stop working; the rest of the app keeps working.
• India: under the Digital Personal Data Protection Act, 2023, you can ask us for a summary of your data, ask us to correct or erase it, nominate someone to act for you, and raise a grievance with us. If we do not resolve it, you can complain to the Data Protection Board of India.
• EEA, UK and Switzerland: you can ask to access, correct, delete or move your data, and object to or restrict its use; you can also complain to your data protection authority. We rely on our contract with you (account, reports), your consent (location, physical activity, notifications), our legitimate interests (security, preventing misuse, improving the app) and legal duties (financial records).

To use any of these rights, email us. We reply within 30 days.

7. Children

The app is meant for people aged 18 and over, and we do not knowingly create accounts for anyone under 18. If you believe a child has an account, email us and we will delete it. When you add a family member, please make sure they are happy for you to do so (for a child, you as their parent or guardian decide); only chart facts are sent for them.

8. Changes to this policy

When we change this policy we update this page and the date at the top. For important changes we will also tell you in the app.

9. Contact us

Email: challycraf.support@gmail.com
Address: Thoothukudi, Tamil Nadu, India

This policy is available in English and Tamil. If they differ, the English version applies.