Sorry Kitty Privacy Policy

1. Introduction & Operator Identity

This Privacy Policy explains how Sorry Kitty ("we", "us", or "our"), operated by Aadarsh Kumar (an individual based in India), collects, uses, and handles information when you access https://sorrykitty.in and our web applications. We process personal data under the laws of India, including the Digital Personal Data Protection Act, 2023.

2. Information We Collect

We collect only the information necessary to provide social messaging and interactive games:

• Account Details: When you register an account or sign in with Google OAuth, we receive your email address, display name, and avatar URL. If you create an email/password account, passwords are cryptographic hashes managed by Supabase Auth and never stored in plain text.
• Chat Messages & Shared Content: Messages sent in public rooms (World Chat) and card-based rooms. When translation is used, message text is sent to our translation service provider (Google Translate / Google Input Tools) over HTTPS to generate the translated text.
• Games & Quiz Data: Move history and scores in Carrom and Tic-Tac-Toe, as well as questions and responses generated through Know Me quizzes.
• Technical Metadata: IP address, browser user-agent, and session identifiers collected automatically for network routing, security, and spam mitigation.

3. Data Storage & Access Control Status

Data is transmitted over HTTPS and stored in managed PostgreSQL databases hosted by Supabase. Access controls on database tables are managed through PostgreSQL Row Level Security (RLS) policies and column-level permission grants as follows:

• users table: Row Level Security and column-level permission grants restrict public queries. Clients can query only non-sensitive profile attributes (user ID, display name, avatar, kitty ID, created timestamp, and age confirmation declaration). Email addresses and authentication credentials cannot be queried by client applications.
• reports table: Protected by strict Row Level Security. Direct client reading and writing are prohibited. Reports are processed exclusively through server-side edge functions using administrative service role credentials. When a safety report is submitted, the reported message text, reason, and context are retained for moderation review.
• cards table: Row Level Security allows public read access by unique card identifier so recipients can view greetings. Non-owners cannot view quiz answer keys.
• chats table: Row Level Security restricts chat records to clients referencing the associated card identifier. Chat rate limits and blocking triggers are enforced at insertion time. Messages are not end-to-end encrypted.
• notifications, sessions, and activity_log tables: Row Level Security restricts access strictly to the authenticated account owner.

4. Operational Processors & Service Providers

We do not sell, rent, or trade your personal information to advertising brokers. We share data only with operational service providers necessary to operate the platform:

• Translation Services: Google Cloud Translation API (Basic v2) and Google Input Tools. When you choose to translate a message, the message text is sent to Google Cloud Translation endpoints over HTTPS. Translations are cached at the network edge to minimize external requests.
• Safety Alert Dispatch: When safety reports are submitted, automated alerts are transmitted via private server-side webhook channels or transactional emails to safety@sorrykitty.in for prompt human review.
• Database & Authentication: Supabase Inc., providing managed PostgreSQL database storage, user authentication, and realtime WebSocket updates.
• Hosting & Edge Delivery: Cloudflare, Inc., providing DNS routing, edge CDN hosting, DDoS mitigation, and edge compute functions. Public marketing pages self-host all font files locally so no font requests are made to third-party CDNs.
• Sign-In Provider: Google LLC, used optionally for single sign-on authentication when you choose "Continue with Google".

5. Data Retention & Account Deletion

User accounts, quiz responses, and message histories are retained while your account remains active. Because automated self-serve deletion is currently in development, you may request complete deletion of your account and associated personal data at any time by emailing support@sorrykitty.in. All verified deletion requests are handled manually by the operator.

6. Local Storage & Cookies

Sorry Kitty uses browser localStorage to persist your active session token (sk_user), interface theme preferences, sound toggles, and client-side block lists. We do not use third-party advertising tracking cookies.

7. Grievance Officer & Contact Information

For any privacy inquiries, data access requests, or complaints, you may reach our designated Grievance Officer:

Grievance Officer: Aadarsh Kumar
Email: support@sorrykitty.in
Safety Desk: safety@sorrykitty.in
Location: India
Response Time: Inquiries and deletion requests are reviewed as promptly as possible.