Privacy Policy

Last updated: 9 October 2026

Katha Kutty is operated by AU Innovations Private Limited (“we”, “us”), registered in Kerala, India. This policy explains what we collect, why, and what you can do about it. It is written for parents, because in this app the parent is our customer and the child is who we are protecting.

The short version

• We never show advertising to children, and we do not sell or share personal data with advertisers or data brokers.
• A child cannot create an account. Every account belongs to a parent or guardian.
• We collect the minimum needed to run a subscription and remember where a child got to in a story.
• You can delete a child’s profile, or your whole account, from inside the app.

Who the account belongs to

Accounts are created and controlled by an adult. We ask for a mobile number, verify it by one-time password, and optionally allow sign-in with Google. By creating an account you confirm you are the parent or legal guardian of any child profile you add, and you consent on their behalf to the processing described here — the verifiable parental consent required by India’s Digital Personal Data Protection Act, 2023.

What we collect

From the parent

• Mobile number, and name and email if you provide them or sign in with Google — to identify the account and contact you about it.
• Subscription and payment records — plan, dates, invoices and transaction identifiers. Card and bank details are handled entirely by our payment provider (Razorpay) or by Google Play. We never see or store them.
• Device information — a push notification token, the app version, the model name of your phone or tablet, and your device’s time zone, so notifications reach you at a sensible hour and so we can diagnose faults.
• Approximate location — we never ask your device for its location, and the app has no location permission. We do record the IP address you connect from and work out an approximate city and region from it: the kind of accuracy that says “Kozhikode” or “Kuwait City”, never a street or a building. It is refreshed each time you sign in, and we use it to show the right currency and plans.
• Support messages you send us by the contact form, email or WhatsApp.

About the child

• First name or nickname — used to greet them in the app.
• Date of birth — to suggest age-appropriate stories and to send a birthday greeting.
• Gender and chosen avatar, if you provide them. Both are optional.
• Listening history — which stories were played and for how long, so the app can resume where a child stopped and so you can see it in parental controls.

Name recordings, if you use that feature

If you ask us to say your child’s name at the end of stories, you may record a few seconds of yourself saying the name so our storyteller pronounces it the way your family does.

• Your recording is deleted as soon as the clip has been made, and immediately if we decide we cannot fulfil the request.
• The finished name clip is stored privately and delivered only through short-lived signed links. It is never publicly addressable.
• You can remove your child’s name clip at any time from their profile.

Messages recorded by family

A parent can invite a grandparent or another family member to record a short spoken message for their child. We store the audio, the name the recorder gives, and the relationship they describe (for example “Achamma”). We ask them for nothing else, and they do not need an account with us.

The parent hears every recording before the child does, and approves or rejects it. Nothing reaches a child that a parent has not listened to first.

The recording belongs to the family. A parent can delete it at any time, and the person who recorded it can ask us to remove it by writing to info@kathakutty.com. Recordings are stored privately and played through links that expire. They are never public, never used in our own content, and never shared outside the household that invited them.

What we do not collect

• No GPS and no precise location — the app has no location permission at all. See “approximate location” above for the city-level detail we work out from your IP address.
• No contacts, photos, microphone or camera access, except the microphone when you deliberately start a recording — either to teach the app how your child’s name is said, or to record a family message. The app never listens at any other time.
• No advertising identifiers, and no behavioural profiling of children.
• No third-party analytics or advertising SDKs inside the children’s experience.

Why we are allowed to process it

We process personal data to perform the contract you enter into when you subscribe, to comply with tax and accounting law, and — for anything beyond that — on the consent you give, which you may withdraw at any time.

Who else sees it

Only service providers who need it to make the app work, each bound to use it solely on our instructions:

• Razorpay — payments and subscriptions.
• Google Firebase — push notifications and sign-in.
• Cloudflare R2 — private audio and image storage.
• Hostinger — application hosting.
• MSG91 — the one-time password that signs you in, and the WhatsApp messages we send about your own account: a weekly summary of your child’s listening, renewal and payment notices, and replies to your messages. We do not send marketing on WhatsApp.

We do not sell personal data. We disclose it otherwise only where the law requires it.

Where it is stored, and for how long

Data is held on servers in India. We keep account and child data for as long as the account is open, and financial records for the eight years Indian tax law requires. When you delete your account we remove personal data within 30 days, other than those records we are legally obliged to retain.

Your rights

You may ask us to show you the data we hold, correct it, delete it, or stop processing it. Most of this is available directly in the app: each child profile can be edited or removed, and the account can be deleted from the profile screen. For anything else, contact us below and we will respond within 30 days.

Security

Traffic is encrypted in transit. Audio and images are held in private storage and served only through links that expire. Passwords and parental-control PINs are stored hashed, never in plain text. Administrative access is restricted and logged.

Changes

If we change this policy we will update the date above, and we will tell you in the app before any change that materially affects you takes effect.

Contact and grievances

AU Innovations Private Limited
TC-10/104/1, Krishnanjali, Samskara Lane,
Powdikonam, Thiruvananthapuram – 695588,
Kerala, India
CIN: U85499KL2024PTC089872
Email: info@kathakutty.com
Phone: +91 88910 19420

Grievance Officer (as required by the Information Technology Rules, 2021 and the DPDP Act, 2023): Unnikrishnan R, reachable at the address and email above. We acknowledge complaints within 24 hours and resolve them within 15 days.