Privacy, explained clearly.

We collect information that you, your family administrator, or another authorized family member gives us, including:

• Account information. Email address, login credentials, authentication identifiers, and basic Google profile information if you choose Google Sign-In.
• Family profiles and access. Family name, member names, relationships, role, age or date of birth, school and grade, profile image or avatar, email, phone number, color, and sharing permissions.
• Family content. Calendar events, activities, school information, tasks, habits, grocery items, meals, recipes, nutrition records, family preferences, and parenting questions or notes.
• Health and wellness information. Information you choose to record, such as allergies, dietary preferences, vaccines, clinicians, appointments, lab values, nutrition goals, and device-health summaries.
• Files and communications. Photos, documents, text, voice transcripts, pasted or forwarded emails, and support messages you choose to submit.
• Connected-service information. Google account email and identifiers, authorized scopes, Calendar events, and Gmail message information you select for search or extraction.

We also receive limited technical information needed to operate and secure the Service, such as IP address, browser or device type, operating system, session and security records, request timing, error details, and app version. Kulaya uses local storage, session storage, cookies, and comparable app storage for sign-in, offline use, preferences, synchronization, and security. We do not use these technologies to build advertising profiles.

We use personal information to:

• create accounts and family spaces, authenticate users, and apply family roles and permissions;
• save, organize, synchronize, display, and back up the content your family asks Kulaya to manage;
• provide optional Calendar, Gmail, voice, camera, photo, file-import, and AI features;
• personalize family views, suggestions, meal guidance, and other features you request;
• protect accounts, prevent abuse, troubleshoot errors, and maintain the Service;
• respond to support, privacy, and legal requests; and
• comply with law and enforce our Terms of Use.

We use sensitive information, including health information and information about children, only for the family-facing features described in this policy, security, support, and legal compliance. Kulaya does not use family content for targeted advertising.

Kulaya is built around a shared family space. Information added to that space may be visible to other authorized family members. The family owner or a parent administrator can invite people, connect profiles to logins, assign roles, and remove access. Role-based controls limit some information and actions. For example, child and teen accounts are limited to their own applicable information, while health changes and family administration are reserved for adults.

Please add only information you are authorized to share. If another person adds information about you, contact the family administrator first or email us for help with an access, correction, or deletion request.

Google features are optional and separated by purpose:

• Google Sign-In. If enabled and selected, Kulaya receives the basic account information Google provides for authentication, such as your email address and profile details. Kulaya never receives your Google password.
• Google Calendar. If you separately connect Calendar, Kulaya requests read-only access to your Google account email and Calendar events. We use event details to import, classify, attribute, and synchronize family events. Event details can be saved to your family calendar or held in a private review queue. Calendar OAuth tokens are encrypted and kept server-side.
• Gmail. If you separately connect Gmail, Kulaya requests read-only Gmail access plus account identity. Search first reads message headers and snippets. A full message body is fetched only when you choose it for extraction, processed through Kulaya's event-extraction feature, and not stored as an email body. We retain limited processing records, such as sender, subject, message identifier, outcome, and any event you approve. Gmail OAuth tokens are encrypted and kept server-side.

You can disconnect Calendar or Gmail in Settings. Calendar disconnect removes the connection and imported Calendar material according to the confirmation shown at that time, while preserving edited events where stated. Gmail disconnect revokes the connection, but events you already approved and limited processing records can remain until you delete them or your account.

Kulaya's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. We do not use Google user data for advertising, sell it, or permit humans to read it except with your affirmative agreement for support or security, when required by law, or when processing is necessary to provide the feature you asked for.

Kulaya uses Anthropic's commercial API for features such as natural-language actions, family assistance, email and document extraction, Calendar classification, parenting guidance, meal and nutrition suggestions, and photo analysis. When you use one of these features, the prompt, relevant family context, and any selected text, image, document, or connected-service content needed for the request are sent to Anthropic for processing.

Depending on the feature, relevant context can include family member names, ages, grades, relationships, schedules, tasks, food preferences, allergies, nutrition information, or health information. Kulaya limits context to what the feature needs. Anthropic acts as a service provider for its commercial API and states that commercial API inputs and outputs are not used to train its generative models by default. Anthropic may retain and process information under its commercial terms, safety rules, and legal obligations.

AI output is automated and can be inaccurate. Kulaya asks for confirmation before saving many AI-proposed actions, but you remain responsible for reviewing all output. Do not rely on AI output for diagnosis, treatment, emergencies, or other professional decisions.

Kulaya asks for device access only when you choose a feature that needs it. Camera and photo access can be used for avatars, meal photos, document extraction, or other selected uploads. Microphone and speech-recognition access can turn your speech into text. On the web, speech recognition is provided by your browser. In the mobile apps, it is provided through the device's speech-recognition service. Your browser, operating system, or speech provider may process audio under its own policies.

Raw Apple Health, Garmin, and Samsung Health export files selected for device import are parsed on your device and are not uploaded as raw export files. The daily summaries you choose to save can be stored in your family space and synchronized with Kulaya. You can manage permissions in your device settings.

We disclose personal information only as needed for:

• Your family. To authorized members of the family space, based on their role and the feature being used.
• Service providers. To providers that help us host and operate Kulaya, including Supabase for authentication, database, and file storage; Vercel for application hosting and delivery; Anthropic for AI processing; Google for optional sign-in, Calendar, and Gmail features; and infrastructure, email, security, and support providers we use as the Service evolves.
• Your direction. When you connect a service, approve an import, share content, or otherwise ask us to disclose information.
• Safety and law. When reasonably necessary to comply with law or legal process, protect rights and safety, investigate fraud or abuse, or secure Kulaya.
• Business changes. In connection with financing, reorganization, acquisition, or transfer of all or part of the business, subject to appropriate safeguards.

Kulaya does not sell personal information, share it for cross-context behavioral advertising, or serve targeted ads based on family content.

We keep account and family information while it is needed to provide Kulaya. Specific records may remain for shorter or longer periods based on the feature, your settings, family-sharing needs, security, dispute resolution, legal obligations, and backup cycles. Gmail bodies selected for extraction and raw health export files are handled as described above and are not retained as source files by Kulaya. AI providers can maintain their own limited service and safety records under their terms.

We use safeguards designed for the sensitivity of family data. These include encrypted network connections, database access controls, family-scoped row-level security, encrypted Google OAuth tokens, private file storage, rate limits, and Keychain or Keystore-backed encrypted storage for important native-app data. No system is perfectly secure. We will provide notices required by applicable law if we discover a qualifying breach.

You can take many privacy actions directly in Kulaya:

• review or update family profiles and family content;
• manage family access and roles if you are an owner or parent administrator;
• disconnect Google Calendar or Gmail from Settings;
• change device permissions through your browser or operating system; and
• delete individual content or delete your account.

Depending on where you live and whether a particular law applies, you may have rights to confirm our processing; access, correct, delete, or obtain a portable copy of personal data; opt out of certain sale, targeted advertising, or profiling; withdraw consent; and appeal a denied request. Kulaya does not currently sell personal data or use it for targeted advertising. We will not discriminate against you for exercising an applicable privacy right.

To submit a request, email m3b3nest@gmail.com. Tell us the email used for Kulaya and the right you want to exercise. We may need to verify your identity and authority over a family space. An authorized agent may submit a request where permitted by law, subject to verification.

To permanently delete your Kulaya account, sign in and open Settings, then choose Delete account and confirm. If you cannot sign in, email m3b3nest@gmail.com from the address connected to your account and write “Delete my Kulaya account” in the subject line.

Account deletion removes your authentication account, your user-scoped records, connected Google credentials, and your avatar files from Kulaya's active systems. Local app data is cleared on the device that completes deletion. Limited records can remain temporarily in backups, security logs, or where retention is required by law.

Kulaya is designed for families but is not directed to children as an independent consumer service. An adult who creates or administers a family space must be at least 18 and is responsible for deciding which family members may use Kulaya and what information may be added about them. A parent or legal guardian must create, authorize, and supervise any account or profile for a child under 13 and consent to the child's information being processed as described here.

Parents and guardians may review, correct, or delete a child's profile and information in Kulaya, remove the child's login, or contact us for help. If we learn that personal information was collected directly from a child under 13 without required parental authorization, we will take reasonable steps to delete it or obtain appropriate consent.

Kulaya is operated from the United States. If you use the Service from another country, your information may be processed in the United States and other places where our providers operate. Those countries may have different data-protection rules.

We may update this policy as Kulaya changes. We will post the new date at the top and provide additional notice when a change is material or when law requires it. We will seek consent where required.

For privacy questions, requests, or complaints, contact: