Privacy Policy
Last updated: 24 August 2026
This policy explains what Kshirpa ("we", "us") collects when you use the Kshirpa mobile app, why we collect it, and what control you have over it.
The short version. You sign in with a phone number and a one-time code. Other people see your Kshirpa ID, not your number, unless they already have that number saved. Radar uses location only while you turn it on. Photos we relay are deleted after the other person receives them. You can add an email to recover the account if you lose the number. We do not show ads or sell data.
Information we collect
- Phone number. Required to create and sign in to an account. We send a one-time code by SMS. The number is the account key. It is not shown on Radar or in a new chat unless the other person already has it in their contacts.
- Kshirpa ID and display name. A public handle you choose, and the name that appears next to it.
- Recovery email (optional). If you add one, we send a one-time code to prove you own it. Then you can sign in with that email if you lose the phone number. Cloud backup of chats is not offered yet.
- Messages. The text of messages you send, who sent them, which conversation they belong to, and when they were sent.
- Photos in transit. When you send a photo we store the file long enough to deliver it. After the recipient downloads it we delete the file. If it is not collected within 24 hours we delete it anyway. A short label such as “Photo” can remain in the chat history.
- Location (Radar only). If you turn Radar on, we receive your approximate coordinates so we can list Kshirpa users nearby. We stop updating and drop that ping when you turn Radar off, or after it goes stale (about 15 minutes).
- Contact matching. If you allow contacts access, we receive the phone numbers in your address book only to hash them and see (1) who is already on Kshirpa and (2) whether you already have someone’s number, so we can show it to you. We store those hashes, not a readable copy of your address book.
- Presence. Whether you are connected, and whether you are typing. This is held in memory while you are online and is not written to our database.
- Technical connection data. Our hosting and SMS/email providers process standard connection information, including your IP address, in order to route traffic and send codes.
What we do not collect
- Advertising identifiers. There are no advertising or analytics SDKs in the app.
- Your full address book as a list of names. Matching uses hashed numbers only.
- Cloud backups of your chat history. That feature is not on, and this page will change before it is.
How we use your information
We use it only to run the service: to sign you in, to deliver messages and photos, to show who is nearby when you ask, to decide whether a number can be shown, and to recover an account by email if you set that up. We do not sell your data, rent it, or share it with advertisers.
Who can see your number
Other users see your Kshirpa ID by default. We reveal your phone number to another Kshirpa user only when the hashed form of that number is in the contact set they uploaded. If they do not have you saved, they do not get the number from us.
Security, and one thing to be clear about
Traffic between the app and our servers is encrypted in transit with HTTPS and TLS. One-time codes are stored only as salted hashes and expire in minutes.
Message text, however, is stored on our servers in a form we can read. Photos sit on disk only until they are delivered. Kshirpa is not end-to-end encrypted today. If that changes, this page will say so.
How long we keep it
Your account, Kshirpa ID, phone number, recovery email, and text messages are kept until you delete them. Radar location pings go stale after about 15 minutes. Relayed photos are deleted after the recipient receives them, or after 24 hours, whichever comes first. Messages you send with a disappearing-message timer are removed once the timer runs out. If an account is inactive for 24 months we may delete it and its messages.
Deleting your data
Email admin@kshirpa.in from the recovery address on the account, or include your phone number or Kshirpa ID, and we will delete your account, your messages, contact hashes, and remaining media within 30 days. Routine encrypted backups age out within 30 days.
Data stored on your phone
Theme and appearance settings, privacy toggles, quiet hours, chat drafts, floating bubbles, downloaded photos, and your app-lock PIN stay on the device. The PIN is held in the Android encrypted keystore and is never sent to us.
Service providers
We use a cloud host for the API and database, a static host for this website, and an SMS and/or email provider to deliver one-time codes. They process data on our behalf under their own security obligations. We do not use advertising or analytics processors.
Children
Kshirpa is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. Material changes will also be announced in the app. Features that are still undecided — including chat backup — will not launch before this page is updated.
Contact
Questions, deletion requests, or security reports: admin@kshirpa.in.