Privacy Policy

Last updated: 14 October 2026

Kadhai Kutty makes a new, personalised illustrated bedtime storybook each night, starring your child and the family members you tell us about, in your family’s own language. This page explains exactly what we collect, why, and the control you have. It reflects how the app actually works today.

Kadhai Kutty is built for families. A parent or guardian (18+) sets it up and gives verifiable consent before any child profile is created. We treat children’s data with extra care under India’s DPDP Act and the US COPPA rules (for Indian families settled abroad).

What we collect

Your account — the email address you sign in with (Google sign-in, or email and password), used to identify your account. If you sign up with email and password we send a 6-digit code to that address to confirm it is yours.
Fair-use signals — to stop the free story being claimed again and again from new accounts, we keep a one-way scrambled code (not the raw value) made from a random ID the app creates when it is installed, your email address, and the first part of your network address. These codes cannot be turned back into your email or address, are used only for fraud prevention, and are deleted after 12 months. We do not read your phone’s IMEI or other hardware identifiers.
Safety checks — photos are checked by an AI model to confirm they show one real person before a character is painted, and text you type for stories is checked so nothing unkind or unsafe ends up in a child’s book. We keep the check result, not extra copies of your photo.
Your child’s profile — the nickname you choose, family roles (Amma, Appa, Paati…), and preferences you set such as a favourite colour or animal. These personalise the stories.
Photos — one photo of your child and of each family member you add. A photo is needed for every character so the story looks like your family. Each photo is used only as a likeness reference for that person’s AI-painted watercolour character, and you can have photos deleted at any time.
Reading activity — which stories were made and read, to continue your child’s story world and streak.

How we use it

To generate your child’s personalised stories and deliver them at bedtime.
To keep continuity across a season’s stories (their “world”).
To operate your account and process one-time story-pack purchases.

What we never do

We never sell your data and never share your child’s data with third parties for their own use.
We never use your photos or your child’s data to train AI models.
We show no ads, and there are no third-party advertising trackers.

Your rights

Delete — you can revoke consent and delete all data at any time (see Delete my data). This removes child profiles, family members, stories, seasons and any photos/assets.
Export — you can request a full export of your data (DPDP data-portability).
Withdraw consent — at any time, from the app’s Settings.

Who helps us run Kadhai Kutty

Stories and pictures are made with AI. To do that, we use a few service providers who process data only on our behalf and only to run the service:

Google (Firebase) — sign-in.
Amazon Web Services — private storage of photos and story images, and account emails, on servers in India.
OpenRouter — routes story-writing and picture-checking requests to AI language models.
Higgsfield — paints the illustrations, using your family’s reference pictures.
Google Play and PayU — payments for story packs.
Sentry — crash reports, so we can fix problems.
Cloudflare — network security in front of our servers.

This website

We count visits to kadhaikutty.in with our own simple analytics, running on our own servers. It records which pages are viewed, which sections of a page come into view, which buttons and links are tapped, how long a page is actually being read, a rough device and browser type (for example “Android phone, Chrome”), the country, and how you arrived (the website or campaign link that sent you).

No cookies, and no advertising or third-party trackers on the website.
The analytics does not store IP addresses. To count unique visits, it makes a code from your connection and browser that changes every day, so visits can’t be linked from one day to the next.
Each browser tab gets a random visit id, kept in that tab’s session storage and gone when the tab closes, so going from the home page to the beta page counts as one visit.
Nothing you type into a form is recorded by the analytics.
Visit records are deleted after about 13 months.
If your browser sends Global Privacy Control, we don’t count your visit at all.

The beta request form is separate from the analytics. If you request a beta invite, we keep the email, name and home language you give us, plus your IP address and browser type, to run the beta list and protect it from abuse. The form sends these to our beta tester list and to our sign-up list.

Storage & security

Data is stored on secured servers. Photos and generated assets are kept private to your account. Access is limited to operating the service.

Contact

Questions about your privacy, or a request about your data? Use the data request form and we’ll get back to you.

This notice describes current practice and will be updated as the product evolves. It is a plain-language summary, not legal advice.