Privacy Policy

Last updated: 7 September 2026

Katha Kutty is operated by AU Innovations Private Limited (“we”, “us”), registered in Kerala, India. This policy explains what we collect, why, and what you can do about it. It is written for parents, because in this app the parent is our customer and the child is who we are protecting.

The short version

• We never show advertising to children, and we do not sell or share personal data with advertisers or data brokers.
• A child cannot create an account. Every account belongs to a parent or guardian.
• We collect the minimum needed to run a subscription and remember where a child got to in a story.
• You can delete a child’s profile, or your whole account, from inside the app.

Who the account belongs to

Accounts are created and controlled by an adult. We ask for a mobile number, verify it by one-time password, and optionally allow sign-in with Google. By creating an account you confirm you are the parent or legal guardian of any child profile you add, and you consent on their behalf to the processing described here — the verifiable parental consent required by India’s Digital Personal Data Protection Act, 2023.

What we collect

From the parent

• Mobile number, and name and email if you provide them or sign in with Google — to identify the account and contact you about it.
• Subscription and payment records — plan, dates, invoices and transaction identifiers. Card and bank details are handled entirely by our payment provider (Razorpay) or by Google Play. We never see or store them.
• Device information — a push notification token, app version and device type, so notifications reach you and so we can diagnose faults.
• Support messages you send us by the contact form, email or WhatsApp.

About the child

• First name or nickname — used to greet them in the app.
• Date of birth — to suggest age-appropriate stories and to send a birthday greeting.
• Gender and chosen avatar, if you provide them. Both are optional.
• Listening history — which stories were played and for how long, so the app can resume where a child stopped and so you can see it in parental controls.

Name recordings, if you use that feature

If you ask us to say your child’s name at the end of stories, you may record a few seconds of yourself saying the name so our storyteller pronounces it the way your family does.

• Your recording is deleted as soon as the clip has been made, and immediately if we decide we cannot fulfil the request.
• The finished name clip is stored privately and delivered only through short-lived signed links. It is never publicly addressable.
• You can remove your child’s name clip at any time from their profile.

What we do not collect

• No precise location.
• No contacts, photos, microphone or camera access, except the microphone during a name recording you deliberately start.
• No advertising identifiers, and no behavioural profiling of children.
• No third-party analytics or advertising SDKs inside the children’s experience.

Why we are allowed to process it

We process personal data to perform the contract you enter into when you subscribe, to comply with tax and accounting law, and — for anything beyond that — on the consent you give, which you may withdraw at any time.

Who else sees it

Only service providers who need it to make the app work, each bound to use it solely on our instructions:

• Razorpay — payments and subscriptions.
• Google Firebase — push notifications and sign-in.
• Cloudflare R2 — private audio and image storage.
• Hostinger — application hosting.
• MSG91 — one-time passwords and WhatsApp support.

We do not sell personal data. We disclose it otherwise only where the law requires it.

Where it is stored, and for how long

Data is held on servers in India. We keep account and child data for as long as the account is open, and financial records for the eight years Indian tax law requires. When you delete your account we remove personal data within 30 days, other than those records we are legally obliged to retain.

Your rights

You may ask us to show you the data we hold, correct it, delete it, or stop processing it. Most of this is available directly in the app: each child profile can be edited or removed, and the account can be deleted from the profile screen. For anything else, contact us below and we will respond within 30 days.

Security

Traffic is encrypted in transit. Audio and images are held in private storage and served only through links that expire. Passwords and parental-control PINs are stored hashed, never in plain text. Administrative access is restricted and logged.

Changes

If we change this policy we will update the date above, and we will tell you in the app before any change that materially affects you takes effect.

Contact and grievances

AU Innovations Private Limited
TC-10/104/1, Krishnanjali, Samskara Lane,
Powdikonam, Thiruvananthapuram – 695588,
Kerala, India
CIN: U85499KL2024PTC089872
Email: info@kathakutty.com
Phone: +91 80893 99420

Grievance Officer (as required by the Information Technology Rules, 2021 and the DPDP Act, 2023): Unnikrishnan R, reachable at the address and email above. We acknowledge complaints within 24 hours and resolve them within 15 days.