Privacy policy

Last updated 1 October 2026

This explains what Kholona collects and what we do with it. We try to collect as little as possible: there are no accounts, no advertising and no tracking cookies.

What we store

• Your gift. The names, messages, photos, voice notes and choices you put in it, so the person you send it to can open it. Photos and recordings are stored in our file storage.
• A private edit key. You get a secret link that lets you edit or delete the gift. We store only a scrambled (hashed) version of the key, never the key itself.
• Replies. If the recipient sends a reaction or message back, we store it for you to read, together with a scrambled visitor code so one person can’t flood you. We don’t know who they are.
• Payment details. When paid sending is on, payments are handled by our payment provider. We never see or store card, UPI or bank details; we keep a record that a gift was paid for.
• Simple usage counts. To learn which steps confuse people we record events such as “opened the creator”. These carry a random per-tab code that cannot be linked across visits, the page type and where the visitor came from. They are deleted after thirteen months. They never include gift ids, names or messages, and they are skipped if your browser sends Do Not Track or Global Privacy Control.
• Abuse protection. To stop bulk abuse we keep a scrambled (hashed) version of your network address for up to a day alongside a count of recent requests. If someone reports a gift, the report carries the same kind of scrambled value and is kept for up to six months. We cannot turn these back into an address.
• On your device. Your drafts and list of gifts are kept in your own browser’s storage so you don’t lose work. Clearing your browser data removes them.

Who else handles it

We use hosting and database providers (Vercel and Supabase) to run the service, and a payment provider when paid sending is on. They process data for us under their own security commitments. Their servers may be outside India. We don’t sell your data and we don’t share it for advertising.

How long we keep it

• A saved gift that has not been unlocked: for the period shown to you (7 days by default), then deleted with its files.
• An unlocked gift: until its link expires (shown when you pay), then deleted with its files. You can delete it sooner from “My little gifts”.
• Removed gifts: the content and files are erased straight away; a small record of the removal stays.

Your choices

You can see, change and delete your gift at any time with your private edit link. To ask us to correct or erase something, or to ask what we hold about you, write to the contact details on our Contact page. If you received a gift you did not want, you can report it. If you think we have mishandled your data you can contact our grievance officer at the same address, and you may also approach the Data Protection Board of India where the law provides.

Children

The service is for adults. Please don’t make gifts containing a child’s photo or details unless you are their parent or guardian.

Changes

If we change this page in a way that matters, we will update the date above.