Kagelin — Privacy Policy

Last updated: 2026-10-07. Not legal advice. A plain-language description of how Kagelin handles your data.

---

1. Who we are

Kagelin ("we," "us," "our") is a task, habit, and focus-management application, operated by Achyuth S, operating as Kagelin, based in India, reachable at privacy@kagelin.app. This policy explains what personal data Kagelin collects, why, and what rights you have over it, whether you're in India, the EU, California, or anywhere else.

Kagelin is currently in invite-only beta. This policy will be updated as features (billing, native apps) ship; check the "last updated" date above.

2. Guest Mode: the default is zero collection

If you use Kagelin without creating an account, we never receive your task, habit, or focus data. Tasks, habits, focus sessions, and settings are stored only in your browser's local storage, on your device. The one exception is anonymous usage telemetry, which is off by default and only sends anything if you explicitly opt in (see Section 5). Switching to an account moves your local data to our servers, at which point the rest of this policy applies.

3. What we collect (registered accounts)

We do not collect: phone number, physical address, government ID, payment/financial information (no billing exists yet), or social-media profile data (no "Sign in with Facebook/Twitter").

What "encrypted" means for a registered account

Saying "your data is encrypted" would overclaim, so here's exactly what a content passphrase covers.

Registered accounts set a content passphrase. It encrypts everything you write on your device, before it reaches us: task and habit names, notes, event titles, and locations. Kagelin cannot read any of that.

It does not cover:

• Schedule and timing. Dates, priorities, durations, completion state, and how often you show up stay readable, because reminders and analytics need them.
• Account identity. That an account exists, its email address, and how many items it holds are never covered. That's how an account works at all. auth.users (your email and account identity) is managed by our authentication provider, Supabase, and is out of our reach to encrypt.
• Calendar sync. Events synced from Google or Outlook stay readable at those providers. The encryption guarantee only covers what's stored on Kagelin's servers.
• Backup exports. A WebDAV backup or a downloaded backup file is a plain, readable copy of your content. The content passphrase doesn't travel with it, so it's only as protected as wherever you store it: a WebDAV server's own login, or your device's own file security.

Each encrypted value is also bound to the exact place it is stored: your account, and the table, field and record it belongs to. If someone with access to our database moves a value to another record or field, the app reports it as unreadable instead of showing it in the wrong place.

If your key leaks, you can rotate it in Settings. Kagelin then creates a new key, a new passphrase and a new recovery code, and re-encrypts your content. When that finishes, the old key is deleted. Backups taken before then keep old-key copies for up to 30 days (Section 7).

If you lose both your passphrase and your recovery code, we cannot recover your data. There is no support route that gets it back. Save the recovery code somewhere separate from the passphrase when you're given it.

Founding cohort

If you signed up for our early-access waitlist (kagelin.app's homepage) as part of the founding cohort, we hold that signup (email, cohort, invite/grant timestamps) in the same database as registered accounts. When you confirm an app account using that same email, we automatically check it against your waitlist signup and, on a match, apply the founding-cohort offer to your account (see Section 8 of the Terms of Service for what that offer is). This check is automatic and internal — the waitlist data isn't shared with any processor beyond what's already listed in Section 4.

4. Who we share data with

We do not sell personal data, and we do not use it for advertising or remarketing. Kagelin has no ads and no ad-tech integrations. We use these processors to operate the service:

• Supabase: database hosting and authentication.
• Resend: transactional email (magic-link sign-in, notifications), sent from a verified kagelin.app domain.
• Sentry: error monitoring. May capture technical diagnostic data (IP address, browser info, stack traces) at the moment an error occurs.
• Upstash: rate limiting. Sees only an IP address or user ID and the fact of a request, never your task/account content.
• Cloudflare (Turnstile): bot-prevention challenge on the sign-in form.
• Have I Been Pwned (pwnedpasswords.com API): checked when you set a password, to warn you if it's been exposed in a known breach. Only a 5-character prefix of your password's SHA-1 hash is sent (k-anonymity); your password and account identity never leave your device for this check.
• Google / Microsoft: only if you connect a calendar, governed by your existing relationship with those providers as well as this policy. Kagelin's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Cloudflare R2: stores our nightly, GPG-encrypted (AES-256) full database backup, as a disaster-recovery backstop. Not accessible without the separately-held encryption passphrase.

Each processor is bound by its own terms; we don't share data with anyone beyond what's needed to run the listed feature.

5. Cookies, local storage, and anonymous telemetry

We use browser local storage / IndexedDB to keep the app responsive offline (this is core to how the PWA works, not a tracking mechanism) and a session cookie for authentication. We do not use third-party advertising or analytics cookies (no Google Analytics or similar is integrated).

Anonymous usage telemetry (opt-in)

Kagelin can optionally send anonymous product-usage telemetry, off by default for everyone — Guest Mode and registered accounts alike. You're asked to opt in via an in-app prompt, and can turn it on or off any time in Settings → Privacy & Data.

If you opt in:

• We generate a random device ID, not tied to your account, email, or authenticated identity, and store it in your browser.
• We record only enumerated event types and counts — for example, that a focus session completed or a task was created — never task titles, habit names, notes, or any other content.
• Raw events are deleted after 30 days; only aggregate daily counts (like "42 focus sessions completed today") are kept longer, for product metrics.
• Your IP address is used in memory, at the moment a request is made, only to rate-limit abuse; it is never stored alongside telemetry data.
• Opting out immediately stops all telemetry and discards your device ID.

6. Your rights

If you're in the EU/UK (GDPR)

You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. Our legal basis for processing is contract performance (running the account you signed up for) and legitimate interest (security, abuse prevention). We don't currently have a formal EU representative under GDPR Article 27. This is a known open gap, not a claimed exemption. Article 27's "occasional processing" exemption is narrowly interpreted and generally doesn't cover an ongoing account-based SaaS, so it likely doesn't apply here once EU users are real. We intend to appoint a representative (a low-cost annual service, not a law firm) before actively recruiting EU users at scale. You can lodge a complaint with your local data protection authority regardless.

If you're in California (CCPA/CPRA)

You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of "sale" or "sharing" of personal information, which is moot here since we do not sell or share personal information for cross-context behavioral advertising. We do not discriminate against users who exercise these rights.

If you're in India (DPDP Act, 2023)

See the dedicated section below. DPDP grants similar access/correction/erasure/grievance rights and additionally requires a named grievance contact.

CalOPPA (California)

This policy is posted at kagelin.app/privacy and describes the categories of information collected, third parties we share with (Section 4), and how to request changes (contact us, Section 12). We do not currently respond differently to browser "Do Not Track" signals, since we don't run tracking scripts that would be affected by it.

Regardless of jurisdiction

Every user, anywhere, can request account and data deletion by contacting us; see Section 7.

7. Data retention & deletion

We keep your data as long as your account is active. The in-app "Clear Cloud Data" feature deletes your tasks, projects, habits, focus logs, and calendar events immediately. Full account deletion (profile, push subscription, connected-calendar records, stored OAuth tokens, and the underlying account itself) is currently handled manually during beta. Email privacy@kagelin.app and we will delete all remaining personal data within 30 days. (A self-serve "Delete my account" flow is planned before the app exits beta.)

This doesn't reach our nightly encrypted database backups (Section 4): those roll off automatically 30 days after the night they were taken, regardless of when you delete your account or data in between, since they're whole-database snapshots rather than per-account records. The same applies to a content key rotation (Section 3): backups taken before its re-encryption finished keep content encrypted under the old key until they roll off.

8. India DPDP Act notice & Grievance Officer

Under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, we act as a Data Fiduciary and you as a Data Principal, regardless of your location. This section applies in addition to, not instead of, the rest of this policy.

Grievance Officer: Achyuth S, privacy@kagelin.app. Per the DPDP Rules, 2025, we will resolve grievances within 7 days of receipt; this is a mandated timeline for every data fiduciary, not a target we've chosen.

Cross-border transfer: your data may be processed on servers outside India (our processors' infrastructure). The DPDP Act permits this except to countries specifically restricted by the Indian government; none currently apply to our processors.

Consent withdrawal: disconnect optional features (calendar sync, push notifications, WebDAV) any time in Settings; email us to withdraw consent to processing entirely (equivalent to account deletion, Section 7).

Government and legal requests: for a registered account, the content passphrase means we have nothing readable to hand over in response to a legal request, court order, or compulsion order. We can supply account metadata (email, timestamps, item counts, schedule data), but not task, habit, or event content, because we cannot read it either. This applies regardless of which jurisdiction's authority is asking.

9. Children's privacy

Kagelin requires users to be at least 18 years old (see Terms of Service, Section 3). This single threshold covers DPDP's definition of a child (under 18, requiring verifiable parental consent, a flow Kagelin doesn't support), COPPA's under-13 threshold, and GDPR's 13-to-16 age-of-digital-consent range. There is no age-verification step beyond the account-creation acknowledgment. If you believe someone under 18 has an account, contact us and we'll delete it.

10. Security

• Calendar OAuth refresh tokens: encrypted at rest (AES-GCM), service-role-only access.
• WebDAV credentials: never persisted, in-memory for the session only.
• Database access: row-level security scoped to your account governs what the app itself can read on your behalf. It does not limit us: as the operator, we have administrative access to the underlying database (via Supabase) for operations, debugging, and support.
• Sensitive account changes (like setting a password) require reauthentication.
• Task/habit content is encrypted client-side under your content passphrase before it reaches our database, so that administrative access can't read it. See "What 'encrypted' means for a registered account" in Section 3 for exactly what this does and doesn't cover.
• Row binding and key rotation: see Section 3.

No system is perfectly secure; we can't guarantee absolute security, but we design for it.

11. Changes to this policy

We'll update the date at the top and, for material changes, notify registered users by email.

12. Contact

For privacy questions, data requests, or grievances under any jurisdiction above, contact privacy@kagelin.app.