What KalaReach collects, keeps and shares.

Who we are

Kala Holdings Inc. publishes KalaReach. To ask about this policy or about the data we hold, write to support@reach.kala.to. You can delete your account yourself, as described below.

Our address is 262 Chapman Road, Ste 240, Newark, DE 19702, USA.

Mail to the support address passes through Cloudflare, which forwards it to our mailbox.

We keep your message and our replies while your request is open, and we delete them within 12 months of our answer.

In short

• Your terminal sessions run on your own computers. The content of them is transferred between your devices, encrypted, and the relay that forwards it keeps none of it.
• We don’t require you to use an account to pair your devices together and connect them directly. Signing in, making voice calls, synchronizing your settings, backing up your sessions, and recovering your account are all optional.
• We store information about your account, how you use the service, and your connections, as specified below. We also store sealed data, but we cannot read it.
• We don’t use any analytics or advertising, and we don’t track you. However, the apps use Firebase libraries from Google which will report some diagnostic data to Google.

What stays on your computers

The host and kr command both run locally on your computer(s). As such, all of your sessions and session history are stored locally. By default, a host does not connect to any network when started.

Once configured a host will connect only to the services you configure. This includes the relay and discovery server which allow your devices to find each other, the pairing meeting service, your mailbox, the authority feed, the voice broker, the account service, any managed storage and the relay lease service. It may also connect to Mainline DHT and your local network if you enable these. When you configure notifications your host will contact your chosen webhooks, chat services or mail servers. When you enrol plugin repositories your host will contact those repositories, and when you clone a repository it contacts the remote of that repository. When you ask your host to download a model to help it describe sessions, it contacts huggingface.co. When you turn on notifications for a host, your phone registers with our push notification gateway and the host sends notifications to it.

Neither the host nor the kr command send any usage statistics or crash reports.

You decide what leaves a host. You can instruct your host to stop storing content and to clean up the content it kept by using kr privacy on. A list of what has already left your host, which is backup archives and notifications, and whether you can ask for each to be deleted, is available at kr privacy status. You can request the deletion of a backup generation from the storage service at kr privacy delete. You can write a session that has closed to a file of your choosing using kr export.

The apps ask for these permissions:

• Camera and photos - Required to scan a pairing code and to attach photos and video to sessions. Photos and video are sent only to your own hosts, not to us.
• Microphone - Required to make voice calls. On Android we also require permission to run a foreground service to allow voice calls to operate with the screen locked.
• Notifications - Required to notify you of sessions requiring your attention.
• Phone state (Android) - Required to determine if a phone call is in progress so that a voice call that it interrupts ends in a defined state.
• Face ID (on iOS) - Required to confirm that it is you before a host you own does something that needs your say-so.
• Local network (on iOS) - Required to reach a host on your local network, to pair with it and to use it.

This website

These web pages don’t set cookies, load anything from other web sites, or use any analytics. It does store your preferred colour mode (light, dark, system) in local storage as kalareach-theme.

The sign in and account pages at /account do set cookies to manage your session. There is a session cookie to keep you signed in. There are also two short duration cookies, each lasting 5 minutes. One is called __Secure-kalareach.better-auth-passkey and is used when you sign in or register with a passkey. The other is called __Secure-kalareach.state and is used when you sign in with an organisation.

The server that processes your requests logs each request in Cloudflare. See the logs and backups section for what is logged.

What the service receives

The service runs at reach.kala.to on Cloudflare. For each feature, the paragraphs below explain what data is gathered, why, how long it is kept, and who else handles it. Some of the data we receive has no end date, and so no job is set up to remove it at a scheduled time. When you delete your account, our records of how much you’ve been charged for and how much you’ve used will be kept for a period of 7 years, at which point we will delete them. You can see what data will be deleted and what data we will keep by reading Deleting your account and our support page.

Account and sign-in

If you provide an email address when you sign in (even if there isn’t an account for it yet), we use it to send you sign-in codes and to know which account you’re signing in to. The account keeps the address until the account is deleted. Resend sends the email.

When you sign in with an email address we’ll send you an 8-digit sign-in code to prove that you have access to that address. The code works once and allows 5 attempts. We store it as a digest only. A pending code, with the address in its record, expires after 5 minutes; the next time a code is checked, we delete the expired code and the email address in its record. Resend delivers the email.

NOTE: When our app is reviewed in the app stores, they test our app with only one account. When a code is sent to the email address we provide for this purpose only, and that code allows signing in or deleting the test account, that code is displayed on a page we run for a period of 10 minutes, and stored for up to 30 days in our database backups. Nothing sent to any other email address is kept or displayed on that page.

If you create an account by signing in with an organisation we’ll store the name they give us for as long as your account exists so that we can label your account. This value is empty when you sign in with an email address. Your organisation's identity provider provides this information.

We’ll store a record of your session containing the session token, your user agent, and your network address (if the request carries only one), so that we can keep you signed in and guard your account. We store an IPv4 address whole and an IPv6 address as its first 64 bits. A session ends 7 days after it was last renewed, and 30 days after you signed in at the latest. Only some requests renew a session, and none more than once a day. We delete ended sessions with a job that runs every hour. Your session data is hosted on Cloudflare.

If you add a passkey to your account we’ll store the public key associated with it until you remove it or the account is deleted, so that you can sign in with it. We also store the credential ID, name, device type, backup status, transports, and authenticator ID associated with the passkey. We never receive the private key associated with a passkey. Your passkeys are hosted on Cloudflare.

To let you stay signed in to individual apps and hosts we’ll store digests of the tokens for each one, along with when you signed in. Access tokens last 10 minutes and refresh tokens last 30 days. A sign-in ends 30 days after you signed in. When your sign-in ends or you revoke it, we delete its tokens, and we delete its grant record 30 days after the sign-in was due to end. Your app and host sign-ins are hosted on Cloudflare.

To help prevent guessing attacks and flooding we’ll store rate limit counters that use SHA-256 digests of your email address (if you provided one when you signed in), your account, and part of your network address (IPv4 /24, IPv6 /64). Counters for limiting pushes use the same kind of digest of the installation, the host and the network, and a window that collapses repeated alerts keeps the installation and notification identifiers in plain text. We delete a counter with a job that runs every hour once its rate limit window has passed, so a counter lasts up to about 2 hours after you last triggered it. Because a digest of a value that you can guess can be matched to that value, we consider it to be personal data. Your rate limiting data is hosted on Cloudflare.

If you belong to an organisation that uses KalaReach, we’ll store information about the organisation, including its members and their roles, a copy of the directory records it sends us (user name, email address, display name, and external identifier), its policy, and an audit trail of who changed what, so that we can run the organisation’s access and policy. A directory can name a person who has not signed in. The audit trail is kept for 365 days unless an administrator sets a period of between 30 and 3,650 days. There’s no way to delete audit events earlier than this. When a directory record is deleted we keep a tombstone record with its personal fields, and directory records have no end date. Your organisation provides this information in its directory.

If you sign in with an organisation we’ll store the ID token, access token, and refresh token (if your organisation’s identity provider gave us one) that your organisation’s identity provider gave our sign-in library with your account until the account is deleted. Your organisation's identity provider provides this information.

Pairing, discovery and relay

In order to facilitate pairing and prevent abuse, when you pair two devices we receive the first 4 characters of their pairing code, the sealed pairing exchange, and the IPv4 /24 and IPv6 /48 network prefixes of the connections used. The prefix is kept only while the connection is open, and a pairing room that ends deletes its record. We do not receive the 6 secret characters of the pairing code. The service is run by Cloudflare.

In order for your devices to find each other, they publish a discovery record containing their public key and the addresses and home relay (if any) that your device chooses to publish. This information is publicly accessible, and is removed a day after the last time your device republished it. The discovery server, hosted by Hetzner, scans for expired records every 10 minutes.

In order for your devices to communicate when they can't reach each other directly, the relay server hosted by Hetzner forwards encrypted bytes between your devices. It doesn't store any of these bytes, only how many it forwarded.

In order to limit relay usage and charge it against the allowance of the account that pays for it, we store information about the account, the installation that leased the relay, the public keys of the two endpoints, the direction, the byte limit, the start and end time, and the (signed) number of bytes used so far. This information has no end date, except where an account paid for the relay: when that account is deleted, we delete the information 7 years later. Additionally, the relay server itself maintains a journal of these relays, and it keeps an acknowledged receipt for 1 day. Limits on relay use count your network prefix in 60-second windows in memory only. The registry is hosted by Cloudflare and the relay server by Hetzner.

Push notifications

To send a notification to your phone, we need to know who to send it to. So we store a key for each installation of the app on each phone, along with what platform it’s on (iOS or Android) and a Firebase registration token. For each host that you let notify you, we also store two public keys and a digest of the credential that the host uses to send notifications to you. These are tied to your installation of the app, not to your account. When you delete your account, we delete the registration for each installation you used the account with (that is, any installation where you stored a backup, wrote a recovery bundle, or signed in so that the account pays for their relay use). Push notifications will stop working on these installations until the app registers again, and a registration made, or an authorisation renewed, after you delete your account stays. The registration for any other installation does not have an end date. A retired registration token is marked as disabled, and we continue to store it. Google (Firebase Cloud Messaging) delivers the notifications, and Apple does for iOS.

The alert text of each notification is one of six predefined sentences, such as “A KalaReach session needs attention.”; a host cannot add its own text to it. For a host that you have allowed previews for, a notification also carries a sealed preview that only your phone can open. The sealed preview waits until it has been sent or it expires, whichever is sooner, and the maximum time it waits is 24 hours. A record of the notification (including the identifiers, digests and result, but not including the content of the notification) is kept for 30 days after the notification has expired, before it is deleted. Google (Firebase Cloud Messaging) delivers it, and Apple for iOS.

Mailbox, settings sync and backup

Your mailbox contains notifications, receipts, and other announcements for your device. Each item in your mailbox is a sealed envelope with a routing record that we can read. The record names the kind of item (one of five: feed announcements, action receipts, state references, notification previews and sync announcements), who it is for, the sender’s key, the size, the expiry and the arrival time. We can read the routing record but not the item. An item stays until your device acknowledges it, a newer item on the same thread replaces it, or it expires after 1 day at the latest, and its replay identifier stays for a day longer. Your mailbox holds at most 1,000 items or 32 MiB. When your device first reads its mailbox, we keep a claim record that names its key, with no end date. This service is run by Cloudflare.

When you revoke a device for a particular host using a different (remote) device, we store the signed revocation record and the replies from the host in question in order to inform the host about the revocation. The revocations are stored until the host acknowledges or refuses them, and for 7 days after that. If the host is removed, they are deleted at once. A database row for the host and its revision history are also stored, with no end date. This feed is run by Cloudflare.

We store your settings, drafts, and client position, sealed on your device, in order to let you synchronize them across all your devices. We also store information about each settings synchronization request, namely the request identifiers, the account or installation that asked, the collection, a digest, the reply to the request, how many bytes were transferred, and when the request was received and replied to, for 30 days. A record that refuses a request is kept for 30 days after the last moment that request could still have been carried out. The settings, drafts, and client position objects (sealed) are stored until removed by you or one of your devices. If you delete your account, we also delete those of the installations that your account used, except collections shared with an installation that it did not use. A small row for each object ever held, and the public key records of its collection, stay with no end date. This service is run by Cloudflare.

In order to let you restore your account on a new device using a recovery kit, we store your recovery bundle. Each recovery bundle consists of one sealed stream, and we store a locator for the stream and which account wrote it. A new bundle replaces the old one, and deleting your account removes it. Otherwise a bundle is stored indefinitely (no end date). When we delete a bundle with an account, we keep its locator and your account identifier as an erased marker, so that nobody can write to the locator while the marker stays, and we delete the marker 7 years after the deletion. This service is run by Cloudflare.

In order to let you restore your sessions, we store the public part of each backup generation, and the encrypted objects in a collection (Cloudflare R2). You can remove the collection via the account page, or individual generations using kr privacy delete. Once you've removed a backup object, it cannot be read at once, and it is removed after 7 days. Deleting a collection closes it. Seven days after the deletion we remove the public record of each of its generations that you paid for. The record of the account that closed it, a row for each deleted object, your backup setting and the upload records stay, with no end date. Deleting your account is different. It deletes the public records of the generations you paid for and your backup setting, and the objects after 7 days. The index rows, the rows for deleted objects, the upload records and the record of the account that closed each collection stay for 7 years after the deletion and are then deleted. Cloudflare’s own recovery copies can last up to 30 days after that. An index row for each backup object will be stored. This service is run by Cloudflare.

Voice and reasoning

When you initiate a voice call, the voice data between you and the model is sent directly between your phone and the model via WebRTC to OpenAI. That data may be stored by OpenAI for up to 30 days for abuse mitigation, but it is not used in model training or stored by us.

We receive events from our control channel to OpenAI while the call is in progress. These events include transcripts, audio, and the text sent to the model for context (up to 500 bytes per request). We discard the transcript and audio events immediately without writing them to storage, and we retain only the size of the context messages. These are used to run and meter the call. Your call is run on OpenAI.

In order to bill and settle calls, we retain information about each call including call, account, host, and device IDs, the digest of the call offer, call reservation info, start and end times, total seconds, and end reason. This data has no end date. If you delete your account, we delete it 7 years after the deletion. In addition, we store information about each command sent to the call in working storage, including some fields from a few provider events and counts for timing purposes. These are required to run the service, which is run on Cloudflare.

When a signed-in client sends text to the model via our managed reasoning capability (up to 16,384 bytes at a time), we send that text to an OpenAI model and receive back an answer, which we use to meter the cost of the request. We do not store a copy of the text. OpenAI may keep prompts and answers for up to 30 days for abuse mitigation, but it is not used for model training. Both we and OpenAI can view the text you send, but it is not sealed. We do store information about each request including its id, your account id, the reservation id, and the charge for the request. If you delete your account, we delete this information 7 years after the deletion.

Billing and email

When you first buy, we send your account email address and a number that identifies your account to Stripe so that they can create your customer record for a subscription or credit. The checkout page and the billing portal are pages from Stripe which send your credit card information directly to Stripe. We never see your credit card information. Stripe stores information according to their privacy policy. When you delete your account, we delete your customer record at Stripe, which ends your subscription. However, no partial refund will be issued for your remaining subscription time, and any credits you have will be lost. Stripe keeps its own payment and invoice records.

In order to bill customers, enforce billing allowances and display usage totals, we store billing information. This includes your Stripe customer ID, subscription ID, subscription status, subscription offering, balance, allowances, voice seconds, bytes stored, bytes relayed, reservations, payment events, and an account ledger. While your account is not deleted, there is no end date for this information. If you delete your account, your invoices, payment records, and ledger will be retained for 7 years after account deletion, associated with your account identifier and with no name or address, after which time they will be deleted. These records are hosted at Cloudflare, and Stripe keeps its own.

The only automated email sent by the service is a code, either to sign in, to prove an email address, to change your email address, or to delete your account. We do not send any other kind of automated email. These emails are sent via Resend which stores your email address and the code they send, according to their privacy policy.

What we cannot read, and what we can

These are sealed on your devices with keys that we do not hold, or are never sent to us: terminal output, session text, files, photos, drafts, settings, the recovery bundle, backup objects, mailbox items and notification previews.

We can read the email address you use to sign in, the text a client submits for managed reasoning, the context text of a voice call and the metadata of every exchange: network addresses, which endpoints talk, when, how often and how much. Encryption protects content, not the fact of a connection.

Logs and backups

Cloudflare keeps a log of requests for 7 days. Each log entry contains the method, URL and response of the request, as well as additional information about the request that Cloudflare adds. This additional information may contain your network address, user agent and a rough location that Cloudflare derives from your network address. Log lines generated by our own code contain the names of the objects, organisations and storage keys acted on, but do not contain any of their content.

The relay server stores log lines in a journal. These log lines may contain your network address. These log lines are stored for a maximum of 14 days or 512 MiB.

The discovery server stores log lines in a journal. These log lines contain details of publications and lookups and may contain your network address. These log lines are stored for a maximum of 14 days or 512 MiB.

Each day, we make an encrypted export of each table in the account, push and relay databases, and of the ledger, feed, mailbox index, sync and backup objects, without mailbox bodies. The export is sealed, the key to it is held only by us, and we keep it for 30 days.

In addition, Cloudflare stores a point-in-time history of each database that can be used to restore the database to any point in time. These backups are stored for a period of 30 days.

Who else handles your data

Those companies also handle data either for us or for you, and have their own privacy policies.

• We use Cloudflare to host our website and service. They host our servers, databases, object storage, queues and logs. Their Cloudflare’s privacy policy applies.
• We use Google to deliver every push notification you receive. They do this through their Firebase Cloud Messaging service, which is integrated into our apps through their Firebase libraries. These libraries report device and diagnostic information to Google which they use for analytics. This information includes a device identifier and diagnostics from Firebase Messaging, Firebase Installations, and Google Data Transport. Their Privacy and security in Firebase applies.
• We use Apple to deliver iOS notifications that Firebase hands to it, with the same payload. Their Apple’s privacy policy applies.
• We use OpenAI to handle your voice calls and managed reasoning. Its data controls for the API apply.
• We use Stripe to handle payments and provide a billing portal. Their Stripe’s privacy policy applies.
• We use Resend to send your sign-in email. Their Resend’s privacy policy applies.
• We use Hetzner to host our relay and discovery servers in Falkenstein, Germany. Their Hetzner’s privacy policy applies.
• We use Hugging Face to serve the model files which are downloaded to your host on your request. Your host communicates with them, not us. Their Hugging Face’s privacy policy applies.

What you can see and control

• Your account page lists your email address, passkeys, the apps and hosts signed in, the hosts that bill the account and your backup collections. The billing page shows your allowances and offerings.
• From the account page you can end a sign-in, remove a passkey or an app, withdraw a host that bills the account, delete a backup collection and delete the account. To remove a passkey, an app, a backup collection or the account you must have signed in within the last 5 minutes.
• On a host, kr account sign-out removes the host’s sign-in, and the kr privacy commands control what the host keeps.

If you would like a copy of the data we hold on your account please write to us at support@reach.kala.to.

We will send it within 30 days of your request.

Deleting your account

You can delete your account yourself at reach.kala.to/account/delete. We email an 8-digit code to the email address on your account, and you enter it to confirm. You'll be signed out on all devices immediately. Your passkeys, email address, name, public records of the backups you paid for, backup setting, and recovery bundle will be deleted. Your customer record will be deleted at Stripe. We'll end your relay and voice use, and you'll be removed from any organisations you're a member of. The files in any backups you had will become unreadable immediately and be removed after 7 days. If a service we use cannot be reached, we try again until it can, so the last steps can take longer.

Any paid subscription will be stopped immediately; if Stripe cannot be reached, we try again until it can. You won't get a refund for any unused portion, and any credit on your account will be lost. Any debts or open disputes will be recorded and won't prevent your account from being deleted.

We'll also remove the notification registrations and synced settings for any devices that your account used: the ones that stored a backup for it, wrote its recovery bundle, or signed in so that it pays for their relay use. You won't get notifications on those devices until you register the app again, and a registration made, or an authorisation renewed, after you delete your account stays. Settings shared with a device that your account did not use stay.

We'll keep records of what was charged and paid, relay/call/reasoning records, stored object index, closed backup collection records, and a record of the deletion for 7 years after you've deleted your account so we can account for any charges or usage, linked to an account identifier no longer associated with an account, and then delete them. Other records stay because they belong to an organisation or to your device and not to your account. Those that belong to a device have no end date. The organisation's records, and records that name your devices' keys, can still be linked to you. The support page lists them.

If you're unable to sign in to delete your account you can email support@reach.kala.to from the email address on your account asking us to delete it, and we'll perform the same deletion within 30 days.

Children

KalaReach is not meant for anyone under 16.

Who is responsible for your data

The 'data controller' is Kala Holdings Inc., a Delaware corporation (Delaware file number 10634247), of 262 Chapman Road, Ste 240, Newark, DE 19702, USA. You can find more information about us at our website, kala.to. If you have any queries please contact us at support@reach.kala.to. We determine how and for what purposes the personal data that we hold, or that our providers handle for us as this policy describes, is used, and are therefore the 'controller' of it under the General Data Protection Regulation (GDPR) of the European Union and the equivalent United Kingdom law (the UK GDPR).

Your sessions and their history stay on your own computers. Session content that leaves them, such as backups or relayed traffic, is sealed or encrypted, so we cannot read it. If you are using KalaReach as part of an organisation then that organisation is able to set the contents of the directory and policy. Please contact your organisation for further information.

We do not have a representative in the European Union or the United Kingdom.

Why we use your data, and the legal basis

Both the GDPR and the UK GDPR state that we can only use your personal data if we have a legal basis for doing so. Here we explain why we use each of the bits of data we hold about you (listed above) and what our legal bases are. The bases are the same under both pieces of legislation and are:

• To perform a contract with you (Article 6(1)(b)): to provide you with our service we need to store and use your email address, sign in codes and passkeys, the name and the tokens that your organisation’s identity provider gives our sign-in library, your apps’ and hosts’ sign ins, your session, pairing, discovery and relays data, push registrations and notifications, mailboxes, revocations, settings sync data, recovery bundle and backups, voice calls, managed reasoning and billing data. The billing data is specifically to charge your subscription and track your allowances.
• Our legitimate interests (Article 6(1)(f)): we have a legitimate interest in ensuring that our service and your account are secure, avoiding abuse of our service and being able to restore our service in the event of failure. For these reasons we collect and store your session’s network address and user agent, rate limit data, pairing and relay limit network prefixes, the request log, relay and discovery journals, daily export and database history. We also have a legitimate interest in allowing organisations to manage access to and policy within our service, so we keep an organisation’s records: its members and their roles, the directory records it sends us, its policy and its audit trail. Additionally, if you email our support email address we will store that mail in order to respond to you and to keep a record of what we answered. Finally, the diagnostic reports that the Firebase libraries in our apps send to Google rest on our interest in delivering push notifications reliably; Google uses them under its own privacy policy. You have the right to object to these uses; please see below for how to exercise this and other rights you have.
• Under a legal obligation (Article 6(1)(c)): we keep our billing records, which include the payment events and the ledger, in order to meet the tax and accounting obligations that apply to us.
• With your consent (Article 6(1)(a)): your granting our apps permission to use your device’s camera, photos, microphone, notifications, phone state (Android), Face ID (iOS), and local network (iOS) is your consent to that use. You can withdraw this consent at any time using your device’s settings, but this will not affect the lawfulness of using your data prior to withdrawing your consent, and the features that need it will stop working.

Note that signing in, making voice calls, syncing settings and using backup and recovery are all optional, and we will only hold the associated data if you choose to use them.

Where your data goes

Kala Holdings Inc. is a United States company, and the providers named in this policy process data in several countries. For each provider, this section says where it processes data, as far as its own published terms say, and what mechanism those terms use for data that leaves the European Economic Area or the United Kingdom. The mechanisms are the Standard Contractual Clauses (model contract terms approved by the European Commission), the UK Addendum to them (issued by the UK Information Commissioner), the Data Privacy Framework (a certification scheme of the United States Department of Commerce for transfers from the European Union, the United Kingdom and Switzerland) and an adequacy decision of the European Commission (a finding that a country protects personal data adequately). The links go to the terms themselves.

• Cloudflare hosts the service. Its data processing addendum says that Cloudflare and its sub-processors may process personal data outside the European Economic Area, Switzerland and the United Kingdom. For a transfer to Cloudflare that needs a safeguard, the addendum applies the Standard Contractual Clauses and, for UK data, the UK Addendum. It also says that Cloudflare complies with the Data Privacy Framework, and that a transfer made under that framework needs no further safeguard.
• Google delivers push notifications through Firebase Cloud Messaging. The Firebase data processing and security terms say that data may be processed in any country where Google or its sub-processors have facilities. For a transfer that needs a safeguard they rely on the Data Privacy Framework, where it is available, and otherwise on the Standard Contractual Clauses. Google LLC says on its Firebase privacy and security page that it has certified under the Data Privacy Framework.
• Apple delivers notifications to iOS devices. Its privacy policy says that Apple Distribution International Limited in Ireland controls the personal data of people in the European Economic Area, the United Kingdom and Switzerland, that Apple transfers that data under the Standard Contractual Clauses, and that personal data collected worldwide is generally stored by Apple Inc. in the United States.
• OpenAI handles voice calls and managed reasoning. Its data processing addendum names OpenAI OpCo, LLC in San Francisco, California, as the data importer for UK data, and applies the Standard Contractual Clauses with the UK Addendum to UK data. It says that, to the extent OpenAI Ireland Limited transfers data from the European Economic Area and Switzerland to other countries, it does so under agreements that contain the Standard Contractual Clauses, or under an adequacy decision of the European Commission.
• Stripe handles payments. Its data processing agreement says that Stripe may transfer personal data on a global basis, including to Stripe, LLC in the United States. Its Data Transfers Addendum says that for personal data from the European Economic Area, the United Kingdom or Switzerland, Stripe relies first on the Data Privacy Framework, under which Stripe, LLC is self-certified, and otherwise on the Standard Contractual Clauses or the UK Addendum.
• Resend sends the service’s sign-in emails. Its data processing addendum says that its main processing takes place in the United States. It applies the Standard Contractual Clauses to transfers from the European Economic Area and the UK Addendum to transfers from the United Kingdom, and it says that Resend complies with the Data Privacy Framework.
• Hetzner hosts the relay and discovery servers in Falkenstein, Germany. Its data processing agreement says that Hetzner processes the data only in a member state of the European Union or the European Economic Area, and that a transfer to any other country needs the customer's prior consent.

Your rights

Under the terms of the GDPR and the UK GDPR, you have these rights over your personal data. You can:

• Request if we are storing any personal data about you and request a copy of this data.
• Request the correction of data that you believe is incorrect or incomplete.
• Request the deletion of data that we are storing about you. You can delete your account yourself, as described in this policy. We keep some records, such as billing records, and the support page lists what stays.
• Request the limitation of the use of your data in certain circumstances, for example while we check whether it is correct.
• Object to the use of your data where this is based on our legitimate interests. On receiving such a request we will cease to use your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or for the establishment, exercise or defence of a legal claim.
• Obtain your data in a structured, commonly used and machine readable format where this has been provided by you under a contract or where you have given your consent to us to use your data.
• Withdraw your consent where we use your data on this basis.
• At any time complain to a data protection authority. In the European Union you can find your authority at the list of authorities or, if you are in the United Kingdom, you can contact the Information Commissioner's Office.

To exercise any of these rights please write to us at support@reach.kala.to and specify which right you wish to exercise. If you have an account with us, please make the request from the email address used for your account.

We will send a copy of the data that we hold on your account within 30 days of your request.

We will delete the records listed on the support page within 30 days of your request.

We will respond to any request about these rights within one month, as is required under the GDPR and the UK GDPR. If a period stated above is longer than that, we meet the shorter one. Please note that we cannot open sealed data, so a copy does not show its content. If you are outside of these areas you may still have similar rights under your country’s law and can make a request to the same email address.

California

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as the California Consumer Privacy Act defines those terms. Our apps do not include an advertising library and we don’t track you across apps and websites owned by other companies, nor are we paid to provide personal data. Cloudflare, Google, OpenAI, Stripe and Resend have all indicated in their terms that they do not sell the personal information they process on our behalf. The Firebase libraries we include in our apps send diagnostic information to Google, as the section on who else handles your data says. If you are a resident of California, you can write to us at support@reach.kala.to to use the rights that California law gives you.

Governing law

This policy is governed by the laws of the State of Delaware, United States. Nothing in this section limits your rights under the laws of your State or country of residence, including the rights mentioned above and your right to make a complaint to a data protection authority.

Changes to this policy

We change this page when what we collect or keep changes. The date under the heading is the day of the last change.