Kitaa Privacy Policy
This Privacy Policy applies to the Kitaa app for Android and the website kitaa.app. It explains what personal data we collect, why, who handles it, how long we keep it, what happens to it when you delete your account, and the rights you have. “Kitaa”, “we” and “us” mean the operator of Kitaa.
In short: we use your Google account to sign you in. Calls and rooms are relayed live and never recorded. We do not sell your data, show ads or use analytics. When you delete your account it is closed and hidden, but the data linked to it is kept, not erased (see Deleting your account).
On this page
- Who is responsible for your data
- What we collect
- How we use your data and our legal grounds
- Information we get through Google Sign-In
- Video and audio
- Who handles your data
- Where your data is processed
- How long we keep data
- Deleting your account
- How we protect your data
- Your rights
- Withdrawing consent
- Automated decisions and profiling
- Data breaches
- Data Protection Officer
- Questions and complaints
- Users in Thailand
- This website
- Changes to this policy
- Language versions
- Contact
1. Who is responsible for your data
Kitaa is responsible for the personal data described in this policy. Contact us about anything in it at [email protected].
2. What we collect
We collect only what Kitaa needs to work. The table lists each kind of data, where it comes from, and whether you have to provide it.
| Data | Where it comes from | Required? What if you don’t provide it |
|---|---|---|
| Google account ID and email address | Google, when you sign in. Your email is updated each time you sign in. | Required. Without them you cannot create or sign in to an account. |
| Name and profile photo link | Google, once, when your account is created. They become your Kitaa nickname and profile picture. The photo itself stays on Google’s servers; we store its link. | Required; taken automatically. You can change your nickname yourself on Edit profile in the app. To correct your photo, email [email protected] (the app has no way to change it yet). |
| Your agreement to our terms: which versions of the Terms of Service, the Community Guidelines and this policy you agreed to, when, and your phone’s language setting | Recorded each time you sign in, because signing in means you agree to them, and again when you close the notice the app shows after they change. | Recorded automatically. If you do not agree, do not sign in. |
| Device information: notification (push) token, Firebase installation ID, phone model, Android version, app version | Your phone, after you sign in. | Collected automatically. Needed to ring your phone for incoming calls. |
| Host profile: host status and the date you became a host | The Kitaa team, for users we make hosts. | Only for hosts. |
| Optional profile details: username (3 to 30 characters: letters A–Z, numbers, dots and underscores), bio (up to 150 characters), birth year (shown to you as your age), gender (Female, Male, Non-binary or Prefer not to say), country (chosen from a list), languages you speak and interests | You, if you choose to add them on Edit profile in the app. The Kitaa team can also correct your bio and username. | Optional. You can leave any of them empty and clear them at any time. The app does not ask you to fill them in, and you can use all of Kitaa without them. |
| Follows and blocks | You. | Optional. |
| Coin balance, any amount owed, and coin transactions (purchases, call charges, gifts, and adjustments by our team, such as compensation) | Created as you use Kitaa. | Collected automatically when you buy or spend coins. |
| Purchase records: Google order number, purchase token, product, price, time of payment, and Google Play’s verification response, which includes the country where you paid | Google Play. | Required to add coins you buy. We never receive your card or bank details. |
| Refund and reversal records: when Google Play tells us that a purchase was refunded, charged back or otherwise reversed, the purchase token, Google order number, purchase and reversal times, the source and reason Google Play gives, Google Play’s response, and how many coins we took back from your balance or recorded as an amount owed | Google Play. | Collected automatically when Google Play reports a refund or reversal. |
| Call records: who called whom, when, billed seconds and minutes, and why the call ended; and a timeline of each call (calling, answered, disconnected, reconnected, ended) | Created when you make or receive calls. | Collected automatically. |
| Call quality measurements: network type, mobile carrier name, bitrate, packet loss, delay, freezes, frame rate and resolution, sent every 5 seconds during a call | Your phone. | Collected automatically during calls. Used to charge only for connected time and to fix problems. |
| Rooms you open: type, title, topic, the country on your profile when you open the room, start and end time, highest number of viewers and total number of likes | You (hosts). | Required to open a room. |
| Room chat messages | You. | Optional; only if you send messages. |
| Likes in rooms | You, when you tap like in a room. | Optional. We only count how many likes each room gets; we do not record who sent them. |
| Gifts and host points | Created when gifts are sent and calls are charged. | Collected automatically. |
| Reports you make or that others make about you: reason, description, the room or call, the chat message reported, a copy of the room’s latest 50 chat messages at the time of the report (with the nickname each sender had then), and the outcome | You and other users. | Optional. |
| Bans, support notes, coin adjustments, host point deductions (amount, reason and who made them), and records of changes our team makes to your account, such as a corrected nickname, photo, bio or username | The Kitaa team. | Created only when needed. |
| Activity: when you were last active and the days you used the app | Created as you use Kitaa. | Collected automatically. |
| Server logs: user ID, which part of our service was used, the result and how long it took | Our servers. We do not log your IP address. | Collected automatically. |
| Reviews of Kitaa you post on Google Play: the name Google Play shows, star rating, review text (and Google’s translation of it), language, phone model, Android version, app version, the number of helpful and unhelpful votes, earlier versions of a review you edit, and our replies | Google Play. We do not match reviews to Kitaa accounts. | Optional; only if you review Kitaa on Google Play. Reviews on Google Play are public. |
| Emails you send to our @kitaa.app addresses | You. | Optional. |
We do not ask for or record your location. The only location-related data we hold is the country you choose to add to your profile, if any (it is also saved with each room you open as a host), and the country of payment that Google Play returns with each purchase. Video and audio are covered in Video and audio.
3. How we use your data and our legal grounds
| Purpose | Data used | Legal ground |
|---|---|---|
| Create your account, sign you in and show your profile | Google account ID, email, name, photo link | Performing our contract with you |
| Keep a record of your agreement to our terms and this policy | Agreement records | Legal obligation; legitimate interests (proving what you agreed to) |
| Connect calls, rooms and chat, and ring your phone for incoming calls | Profile, device information, follows, blocks, rooms, chat, room like counts | Performing our contract with you |
| Sell coins and keep accounts: add coins you buy, charge for calls, record gifts and host points | Purchase records, coin and host point transactions, call records | Performing our contract with you; legal obligation (accounting and tax records) |
| Take back coins from purchases that Google Play refunds or reverses, and record any amount owed | Refund and reversal records, purchase records, coin transactions | Performing our contract with you; legitimate interests (preventing fraud); legal obligation (accounting records) |
| Charge only for connected time and keep calls working well | Call quality measurements, call timeline | Performing our contract with you; legitimate interests (a reliable service) |
| Keep Kitaa safe: review reports, enforce our rules, prevent fraud and abuse, protect children | Reports and the chat copies saved with them, chat messages, call records, bans, support notes | Legitimate interests (the safety of our users); legal obligation |
| Customer support and requests about your data | Emails, account data, support notes | Performing our contract with you; legal obligation |
| Order the host list | Hosts’ online status and last active time | Legitimate interests (showing available hosts first) |
| Show the optional profile details you choose to add; let people filter hosts and rooms by a host’s country, and hosts by their interests (filters people choose themselves, not recommendations) | Optional profile details; the country saved with each room | Your consent: you give it by adding the details and withdraw it by clearing them |
| Read and reply to reviews of Kitaa on Google Play | Google Play reviews | Legitimate interests (answering feedback and improving Kitaa) |
| Comply with the law, respond to lawful requests and handle disputes | The data relevant to the matter | Legal obligation; legitimate interests |
Where the law requires consent, we rely on the agreement you give when you sign in: the sign-in screen says that by continuing you agree to our Terms of Service and this Privacy Policy, and links to both. We do not use your data for advertising, we do not build profiles of you, and we do not sell your data.
4. Information we get through Google Sign-In
You sign in to Kitaa with your Google account. With your permission, Google gives us your Google account ID, email address, name and profile photo link. We do not receive your Google password and we get no access to your Gmail, contacts, files or anything else in your Google account.
- How we use it: the account ID recognises you each time you sign in; the email identifies your account and is used for customer support and to check requests about your account; your name and photo become your Kitaa nickname and profile picture, which other users can see (you can change your nickname later in the app). We also use this information to keep Kitaa safe, prevent fraud and abuse, comply with the law and handle disputes, and after your account is closed we keep it for these purposes (see Deleting your account).
- Where it is stored: on our servers in Singapore, and in our encrypted database backups stored with Cloudflare. Your profile photo stays on Google’s servers; we store only its link.
- Who it is shared with: only the service providers in Who handles your data, to run Kitaa, and authorities when the law requires it. Other users see your nickname and photo.
- How long we keep it: for as long as your account exists, and also after you delete it. We keep it with no end date (see Deleting your account), except for users in Thailand, whose information is removed 10 years after the account is closed (see Users in Thailand).
- After you delete your account: the account is closed and hidden from everyone, but this information is not erased. Your Google account ID is moved to a separate record so that you can sign up again with the same Google account; a new sign-up creates a new, separate account.
You can remove Kitaa’s access to your Google account at any time in your Google Account settings, at myaccount.google.com/connections. This stops future sign-ins with Google but does not delete your Kitaa account or the data we already hold.
We use information from Google only for the purposes described in this section. We do not use it for targeted advertising, we do not sell it or pass it to data brokers, and we do not use it to train general-purpose artificial intelligence models.
5. Video and audio
Video and audio in calls, video rooms and voice rooms are relayed in real time through Cloudflare’s network so that they reach the other people quickly. Kitaa does not record, capture or store any video or audio, on our servers or anywhere else.
Your camera and microphone are used only while you are in a call, while you are hosting a video room, or while you are on a seat in a voice room.
The other person could still record their screen with another device. Recording people without their consent is against our Community Guidelines, and we act on reports.
When we review a report, we see the chat messages and call records linked to it, never video or audio.
7. Where your data is processed
Our servers are in Singapore. Cloudflare and Google operate worldwide, so some data is processed in other countries, including outside the country where you live. For example, live video is relayed through the Cloudflare location nearest to you, and notifications are delivered by Google.
We rely on these providers’ data processing terms, which require them to protect personal data to a standard comparable to the law that applies to us.
8. How long we keep data
| Data | How long we keep it |
|---|---|
| Account and profile data, including the optional profile details you have added, and agreement records | For as long as the account exists and after it is deleted, with no end date. When you change or clear an optional profile detail, the old value is not kept, except in three places: the country saved with each room you have opened as a host, the record we keep when our team changes your profile (the values before and after the change), and database backups, which are replaced every 30 days. |
| Follows and blocks | Until you unfollow or unblock, which removes the record straight away. Otherwise with no end date, including after the account is closed. After a deletion request they are no longer shown or counted; blocks still stop calls between the two accounts. |
| Coin balance, coin and host point transactions, purchase records, refund and reversal records, call records and gifts | With no end date. Accounting records are kept for at least five years in any case. |
| Call timelines, rooms (including their like counts), room chat messages, reports, bans, support notes, coin adjustments, records of changes our team makes to your account and activity records | With no end date. |
| Device information | The record for a phone is removed when you sign out on that phone, or when Google’s notification service tells us that the phone can no longer receive our notifications (for example, after Kitaa is uninstalled). If someone signs in to a different Kitaa account on the same phone, the record moves to that account. Otherwise it is kept; after a deletion request we no longer send notifications to it. |
| Call quality measurements | 30 days. Before deleting them, we keep one overall quality rating for each call (good, fair or poor) with the call record. |
| Signed-in sessions | Up to 30 days unless you use the app again. |
| Server logs | 1 year. |
| Emails you send us | 1 year after your request has been dealt with. |
| Google Play reviews | With no end date. Reviews are not linked to Kitaa accounts, so closing an account does not affect them, and the rules for users in Thailand do not apply to them. |
| Database backups | Replaced on a rolling 30-day cycle. |
Users in Thailand: after your account is closed, data that this table keeps “with no end date” is kept for 10 years, and device information for at most 10 years. After that, we remove the information that identifies you. See Users in Thailand.
9. Deleting your account
You can delete your account in the app (Me → Settings → Account → Delete account), or by emailing [email protected] from the email address of your account, in which case we make the request for you within 3 days. The Delete account page explains both.
- Straight away: you are signed out on every device and all sign-ins are cancelled. Any call you are in and any room you are hosting ends. Your profile disappears from the host list, rooms and follower lists, nobody can call you or follow you, and your past chat messages are no longer shown to people who join a room. From then on we keep your data but no longer use it to provide the service.
- Within 7 days: you can cancel by signing in to the Kitaa app with the same Google account. The app tells you that your account is being deleted and asks you to confirm that you want to cancel. If you confirm, everything is as before, including your coins and host points. If your account is banned and you cannot sign in, email [email protected] to cancel the deletion.
- After 7 days: the account is closed. It is hidden from you and from everyone else, cannot be called and does not appear anywhere in the app. Any coins and host points left in it are cancelled without refund.
Closing your account does not erase your data. We continue to store all the data we hold about the account, including your Google account ID, email address, nickname, photo link, the profile details you added, purchases, coin and host point records, calls, room chat messages, reports, bans and agreement records. We keep it with no end date (for users in Thailand, 10 years; see Users in Thailand), for security, preventing fraud and abuse, complying with legal obligations (such as accounting and tax rules and requests from authorities) and handling disputes and complaints. It is not shown in the app and is not used to provide the service. Only authorised Kitaa staff, with permission to do so, can see it in our internal admin tools, and we disclose it to authorities when the law requires it.
If you sign in with the same Google account after the 7 days, a brand-new Kitaa account is created. It starts with no coins, host points, follows or blocks, and the closed account is not restored.
Deleting your Kitaa account does not affect your Google account. Google keeps your Google Play purchase history under its own policies.
10. How we protect your data
- All connections between the app, this website and our servers are encrypted in transit.
- Our servers accept app traffic only through Cloudflare, not directly from the internet.
- Staff access is limited by role. Our admin tools require a password and two-step verification, record the changes staff make and their sign-ins, and partly hide email addresses from staff who do not need to see them in full.
- Database backups are encrypted before they are stored.
11. Your rights
Depending on where you live, for example Singapore, India, Indonesia, Malaysia or the Philippines, the law gives you rights over your personal data. We offer the following to all users:
- Access and a copy: ask what data we hold about you and get a copy, including in a structured, machine-readable format.
- Correction: ask us to correct inaccurate or incomplete data, such as your photo. You can change your nickname and optional profile details yourself on Edit profile in the app.
- Portability: ask us to send your data directly to another organisation you choose, where this is technically feasible.
- Account deletion: delete your account as described in Deleting your account. This closes the account but does not erase the stored data. If you believe the law that applies to you requires us to erase particular data, tell us; we will reply with our decision and the reasons for it.
- Withdraw consent: see Withdrawing consent.
- Object or restrict: object to how we use your data, or ask us to limit it.
- Automated decisions: ask for a person to review a decision made automatically (see Automated decisions).
- Nominate someone: appoint another person to exercise your rights for you, including if you die or become unable to act.
- Compensation: where the law gives you this right, for example in Indonesia, claim compensation if your personal data is processed unlawfully.
How to ask: email [email protected] from the email address of your Kitaa account (it is shown in the app in Me → Settings → Account), so that we can confirm it is you. If you cannot use that address, write from another one and tell us your account’s email address; we may then ask for more information to verify your identity. We act on requests within 72 hours. Account deletion follows the 7-day process above.
12. Withdrawing consent
You can withdraw your consent at any time, as easily as you gave it: ask to delete your account in the app or in the other ways on the Delete account page.
Kitaa cannot work without the data described in this policy, so withdrawing consent means you can no longer use Kitaa, and your account goes through the deletion process: your coins and host points are kept if you cancel within 7 days and cancelled after that. Withdrawal does not affect what we did before it, and data is kept as described in Deleting your account.
13. Automated decisions and profiling
We do not profile you. The host list is ordered only by whether hosts are online and when they were last active; it is not personalised and does not use your behaviour or your profile details. Reports and bans are decided by people. If we ever add recommendations, we will update this policy first.
One thing happens automatically: call charging. A call ends when you do not have enough coins for the next minute. If you think a charge or an ended call is wrong, email [email protected] and a person will review it.
14. Data breaches
If a breach affects personal data, we will notify the relevant authorities and the affected users as required by law in each country, such as Singapore, India, Indonesia and the Philippines.
15. Data Protection Officer
Our Data Protection Officer is responsible for how Kitaa handles personal data and can be reached at [email protected].
16. Questions and complaints
Please contact [email protected] first, and we will try to resolve your concern. You can also complain to the data protection authority where you live:
- Singapore: Personal Data Protection Commission (pdpc.gov.sg)
- India: Data Protection Board of India
- Philippines: National Privacy Commission (privacy.gov.ph)
- Malaysia: Personal Data Protection Commissioner (pdp.gov.my)
- Indonesia: the personal data protection agency to be set up under Law No. 27 of 2022, once it has been established
17. Users in Thailand
The rules below on keeping data after your account is closed apply to you if the country on your profile is Thailand when your account is closed, or if Google Play reported Thailand as the country where you paid for any coins added to your account. They add to the rest of this policy.
How long we keep data after your account is closed: 10 years from the date it is closed, for the purposes described in Deleting your account, including audits and dealing with legal claims. Shorter periods in How long we keep data still apply.
After 10 years, we remove the information that identifies you:
- your Google account ID, email address, nickname, profile photo link, username, bio and the other optional profile details you added (except your country), including in the records of changes our team made to your account;
- your device information;
- what you wrote: your room chat messages, the titles of rooms you opened and the descriptions in reports you made, including the copies of your messages saved with reports;
- what our team wrote about you, such as support notes and the reasons recorded for bans and coin adjustments;
- your Google Play purchase tokens, order numbers and Google Play’s verification and refund responses.
We keep only records that no longer show who you are, such as your country, amounts, dates and counts, for accounting and statistics. Copies in our database backups are replaced within 30 days.
18. This website
kitaa.app does not use cookies, analytics, advertising or third-party scripts. Cloudflare, which hosts the site, keeps technical logs of visits, such as IP address and browser type, under its own policies, to deliver and protect the site.
19. Changes to this policy
When we change this policy, we publish the new version on this page and update the dates at the top, which show when this policy took effect and when it was last revised. The next time you open the app, it shows a notice with links to the new version. If you keep using Kitaa after that, you agree to the updated policy; when you close the notice, we record the version and the time. If you do not agree, you can stop using Kitaa and delete your account (see Deleting your account).
20. Language versions
This policy is available in English, Bahasa Indonesia, Bahasa Melayu and Thai with the same content. If the versions differ, the English version prevails.
21. Contact
Email [email protected] about privacy, your data, account deletion or our Data Protection Officer. Other addresses are on the Contact us page.