Privacy Policy

Last updated: [GO-LIVE DATE]

KiT-PaT helps your group run its monthly kitty party — the shared pool, the party plans, the games and the photos. This policy explains, in plain language, what personal data we collect, why, who can see it, and the rights you have over it. It is written to meet India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025.

Please read it with our Terms of Use. By using KiT-PaT you agree to this policy.

1. Who we are

KiT-PaT is operated by [LEGAL ENTITY NAME], [REGISTERED ADDRESS], India ("KiT-PaT", "we", "us"). For your personal data, we are the Data Fiduciary — the party that decides why and how your data is processed.

Questions, or want to exercise a right? Contact our Grievance Officer: [GRIEVANCE OFFICER NAME], support@kitpat.in (details in section 12).

2. The personal data we collect

We collect only what the app needs to work:

Who you are — your name and mobile number, so your group recognises you and can invite you.
What you record — kitty entries and the payments you mark as paid, party dates and attendance, game results and winners, and any notes you add.
Photos you upload — the pictures you add to your group's album.
Group membership — which groups you belong to and your role (for example, whether you are the host who keeps the register).
Device and usage information — app version, device type, and basic logs, to keep the app working and to fix problems.
Approximate location — city-level only, derived from your internet connection, used for anonymous usage statistics. We do not collect your precise GPS location.
Messages you send us — if you write to support or fill the contact form, the message and your contact details.

We do not ask for or knowingly collect special category data (such as health or biometric data). Please don't put such data into free-text fields.

3. Why we use it, and our lawful basis

Under the DPDP Act we process your data on the basis of your consent, and for certain legitimate uses the Act permits (such as responding to you when you contact us). We use your data to:

run your group's kitty and keep every total accurate and attributed to the member who recorded it;
plan gatherings, show who is coming, and split bills;
run the games and record results;
store and display your group's photo album;
keep the app secure, prevent misuse and fraud, and fix faults;
understand, in aggregate, how the app is used, so we can improve it;
respond to your questions and grievances; and
meet legal and regulatory obligations.

We do not sell your personal data, and KiT-PaT does not show you ads.

4. Who can see your data

Your group. Information you add to a group — kitty entries, plans, results, photos, your name — is visible to the other members of that group. That is the point of the app.
KiT-PaT administrators. A small number of trained staff can access group data to resolve disputes, correct wrong entries, and moderate content. Phone numbers are masked by default and every time an admin reveals or changes something it is logged.
Our service providers (Data Processors). We use trusted providers who process data only on our instructions and under contract: our database and authentication host (Supabase), media storage (Cloudinary), hosting and edge delivery (Vercel), messaging providers used to send invites, and our analytics tooling. We remain responsible for your data when they handle it.
Payment gateway. If you make a payment in the app, it is processed by our payment gateway; see section 6.
Legal disclosure. We may disclose data where the law requires, or to protect rights, safety and the integrity of the service.

5. Where your data is processed

Your data may be processed on servers located in or outside India, operated by the providers named above. We do not transfer personal data to any country or territory that the Government of India has restricted for such transfers under the DPDP Act.

6. Payments

The only payment KiT-PaT charges is the app subscription, and it is processed by our third-party payment gateway. KiT-PaT does not collect or hold the money your group contributes to its kitty, and we do not store your card, UPI or bank account details on our servers. The gateway handles payment details under its own security standards and privacy terms.

7. How long we keep it, and erasure

We keep your personal data for as long as your account is active and your group needs it to function. When you delete your account (section 9), we delete or de-identify your personal profile.

Because a group's financial history is shared, entries you recorded in a group's ledger may be retained as part of that group's records in a form that no longer identifies you personally, so the group's totals still reconcile after you leave. We may also retain limited data where the law requires, or for security and fraud prevention, and we will keep only what is necessary and for no longer than needed. When personal data is no longer required and retention is not legally mandated, we erase it.

8. Your rights

Under the DPDP Act you have the right to:

Access — get a summary of the personal data we hold about you and how we process it;
Correct, complete or update — fix data that is wrong or incomplete;
Erase — ask us to delete your personal data, subject to the retention rules in section 7;
Withdraw consent — at any time, as easily as you gave it (withdrawing consent does not affect processing already done, and some features may stop working);
Grievance redressal — a readily available way to complain to us (section 12);
Nominate — appoint another person to exercise your rights in the event of your death or incapacity.

To exercise any right, use the in-app controls or write to support@kitpat.in with enough detail for us to identify your account. We will respond within the timelines in section 12.

9. Deleting your account and data

You can delete your account and associated personal data at any time — from within the app (Settings → Account → Delete account) or from the web at kitpat.in/account-deletion, without reinstalling the app. We explain there what is deleted and what, if anything, is retained (and why). This meets both your DPDP right to erasure and the Google Play / Apple account- deletion requirements.

10. Children

KiT-PaT is intended for adults aged 18 and over. Under the DPDP Act, anyone under 18 is a child, and we do not knowingly process a child's data. We do not use anyone's data for behavioural monitoring or targeted advertising directed at children. If we learn that a person under 18 has created an account without verifiable consent of a parent or lawful guardian, we will delete it.

11. How we keep data safe

We use reasonable security safeguards appropriate to the data and its risks — including access controls, masking of phone numbers by default, audit logging of administrative actions, encryption in transit, and secured server-side handling of secrets. No system is perfectly secure, but we work to protect your data and to keep our providers to the same standard.

Personal data breach. If a breach affecting your personal data occurs, we will notify you and the Data Protection Board of India as required by the DPDP Act — informing affected users without undue delay and reporting to the Board within the prescribed period — and tell you what happened and what you can do to protect yourself.

12. Grievances and how to reach us

If you have a concern about your personal data, contact our Grievance Officer first:

[GRIEVANCE OFFICER NAME], Grievance Officer, KiT-PaT
Email: support@kitpat.in
Address: [REGISTERED ADDRESS], India

We will acknowledge your complaint within 48 hours and aim to resolve it promptly — data-rights requests as quickly as we can and in any case within 90 days, as the DPDP Act allows. You will get a reference to track it.

If you are not satisfied with our response, you may complain to the Data Protection Board of India as provided under the DPDP Act.

13. Cookies and analytics

Our website uses minimal, privacy-respecting analytics to count page views and understand, in aggregate, where visitors come from (country/region/city level only). This is derived on our server from your connection and is not used to identify you personally, and we do not use advertising or cross-site tracking cookies.

14. Changes to this policy

We may update this policy. If we do, we will post the new version here and change the "Last updated" date. Significant changes will be brought to your attention in the app.

Contact: support@kitpat.in · Grievance Officer: support@kitpat.in