Privacy Policy

Last updated: 30 October 2026 (version 2026-10-30)

ᎯᎠ ᎪᏪᎵ ᎠᏁᏢᏔᏅ. ᏲᏁᎦ ᎪᏪᎸ ᎤᏙᎯᏳᎯ ᏗᎧᎿᏩᏛᏍᏗ ᎪᏪᎵ ᎯᎠ ᎠᏓᏃᏁᏗ ᎤᏤᎵ; ᎾᎿ ᎢᏧᎳ ᏧᏓᎴᏅᏛ ᏱᎩ, ᏲᏁᎦ ᎪᏪᎸ ᏓᏳᎪᏓᏁᎵ. ᎯᎪᎵᏯ ᏲᏁᎦ ᎪᏪᎸ

This Privacy Policy explains how Nikatru ("Nikatru", "we", "us", or "our"), a proprietorship of Rajasekar Selvam based in Chennai, Tamil Nadu, India, handles information in connection with our website nikatru.com and our applications and games published across iOS, Android, Windows, macOS, Linux and the web (together, the "Services").

This Policy is a notice: it tells you what we do with personal data. It is not something you agree to by using the Services. Where we rely on your consent, we ask for it separately, by a clear action of yours, and you can withdraw it as easily as you gave it.

1. Information we collect

• Information you give us — for example, your email address when you contact support, send feedback, or (in apps that offer accounts) create an account.
• Product news by email, only if you tick the box — when you create an account, you can tick a box asking us to email you occasional product news and offers. It is never ticked for you, and leaving it unticked changes nothing else. We record your answer, like every consent choice (section 9), but we send no such email today and keep no mailing list; before we ever start, we will ask you again.
• Problem reports — if you use "Report a problem" in an app, on this site or in an extension, we store what you write, the category you chose, a screenshot only if you attach one (text fields and anything marked private are blurred on your device before it is sent), and the basic diagnostics shown to you before you send (app version, platform, device type, language and recent error codes; logs only if you tick that box). We keep an email address with a report only if you are signed in and ask us to reply or to tell you when it is fixed, and we then mail only the address your account has confirmed, only about that report: a receipt if you asked for a reply, and one note when it is fixed if you asked for that (each mail has an unsubscribe link). A report sent while signed out keeps no email address and is mailed nothing: you are shown its number and a link to check its status instead. We delete each report and its screenshot after 90 days, and deleting your account deletes your reports.
• Information collected automatically — the technical details a request from an app carries (app version, platform and language), which our servers need to answer it, and an approximate region worked out at our network edge (see Network addresses, below).
• Crash reports, only if you allow usage statistics — when an app crashes or hits an error, it can send us a report of what went wrong: the error, the app version, your device model, operating system and settings such as language, a random identifier for the installation, and the steps that led up to it. Email addresses, card and phone numbers and long numbers are removed on your device before it is sent. The usage statistics question in the app (below) covers crash reports too: if you say no, or later turn usage statistics off, no crash report leaves your device.
• Usage statistics, only if you allow them — if you agree when asked, we record which features of an app are used and when, so we can see what is working and what is not. These records are pseudonymous, not anonymous: each one carries a random identifier created on your device the first time the app runs, and that identifier stays the same until the app is uninstalled. It is not your name, your email or an advertising ID, and we cannot use it to identify you — but because it is stable, records from the same installation can be grouped together, which is why we describe it as pseudonymous rather than anonymous. We do not collect or store your IP address with these records; an approximate location (country, region, city) is determined at our network edge and the IP address itself is discarded. You can turn usage statistics off at any time in the app's Settings, and turning them off stops collection, crash reports included, from that moment.
• Launch-notification signups — if you ask us to tell you when an app launches, we store your email address and the time you signed up, and nothing else. To stop that form being abused we also keep a short-lived counter keyed to a salted, one-way fingerprint of the network address the request came from. The fingerprint is not reversible to an IP address, it is never stored alongside your email, and it is discarded automatically within an hour. To leave the list, use the link in any launch email we send — one click deletes your address — or enter your address at nikatru.com/api/unsubscribe. If the address is on the list, we email it a link that works for 24 hours; opening it deletes the address and the time it signed up. The form gives the same answer whether or not an address is on the list. To stop the form being used to flood someone's inbox, it keeps the same short-lived counters as the signup form, keyed to a salted, one-way fingerprint of the network address and of the email address entered; neither is reversible; the network-address counter is discarded automatically within an hour and the email-address counter within 24 hours. Our email provider, Resend, delivers that email.
• Network addresses — apart from a pending sign-in verification (below), we do not keep the network address a request comes from with your account or with any record about you. Two things see it, and neither keeps it with your data: Cloudflare, at our network edge, uses it to deliver the request, to stop abuse and to work out an approximate location, and then discards it, apart from Cloudflare's own security logs; and the request log of our own sign-in service records it for security and fault diagnosis and deletes it after 7 days. Our sign-in service records the address on each sign-in, and since 2 October 2026 the database it writes to empties that field on every write, with one exception: a pending sign-in verification briefly holds the network address it was requested from. If you use a second sign-in step, its one-time code is accepted only from the address that asked for it, so that address is kept until the code is used; it is erased when the verification succeeds, or, if it is never completed, within a day of the code expiring, 5 minutes after it was requested. Copies made before that date remain until they age out: a sign-in session opened before 2 October 2026 keeps the address it was opened from until it next refreshes, which happens whenever the app is used; the encrypted backups of the sign-in records taken before that date contain those addresses; and so does the fallback copy Supabase holds (section 4).
• Purchase information — if you buy something, the transaction is processed by the relevant app store or by our payment processor. We receive confirmation of the purchase but do not collect or store your full card or bank details.
• Free trials — if you start a free trial, then so that one person cannot take the same trial again and again, we keep a salted, one-way fingerprint of your email address (written in a standard form, so that variations of one address match) and the customer number Paddle gives you. We keep both after you delete your account, for as long as we offer free trials, and use them only to refuse a second free trial and to refund automatically a charge for one that got through. The fingerprint cannot be turned back into your email address.
• Staying signed in on a new Android phone — when you sign in on Android, the app asks Android to keep a restore key for it, which Android includes in your phone's backup with Google if you have backup turned on. When you set up a new phone from that backup, the app uses the key once to sign you in. The key is encrypted so that only our sign-in service can read it, it is not your password, it stops working after 30 days or once used, and signing out deletes it.

We do not sell your personal information.

Item by item

Every kind of personal data our own servers hold, what it is for and how long we keep it. This table is generated from the inventory our systems are checked against. Your account’s sign-in details (your email address and password, held by our sign-in service) are described above.

2. How we use information

• To provide, operate, maintain and improve the Services;
• To diagnose crashes and technical problems and enhance performance;
• To respond to your support requests and communicate with you;
• To process purchases and provide receipts; and
• To comply with legal obligations and prevent fraud or abuse.

3. Offers and promotions inside our apps

Some of our apps show occasional messages about our own products — a paid upgrade to the app you are already using, or another Nikatru app. These are first-party promotions: we write them, we show them ourselves, and no advertising network, ad exchange or advertising SDK is involved. Nobody pays us to show them to you.

The legal basis we rely on. Where the law where you live requires us to state one, we rely on our legitimate interest in promoting our own products to the people who already use them (GDPR Article 6(1)(f)). The interest is narrow and we would rather name it than gesture at it: telling someone who already uses one of our apps that a paid version exists, or that the same small publisher makes another app, is how a business with no advertising budget reaches the people it already serves. We weighed that against your interests. These messages appear only inside an app you chose to open, they are chosen from what you have already paid for and from nothing else, and you can switch them off in one tap.

What we use to decide what to show you. Your entitlement state — whether you have a paid plan for the app you are using — and nothing else. That decision is made on your device. We do not build a profile of you, we do not use your behaviour inside the app to choose these messages, we do not use any advertising identifier, and we never look at which other apps are installed on your device.

Your right to object, and how to use it. You can object at any time to your information being used for direct marketing, and that right is absolute: if you object, we stop. There is nothing for us to weigh and no reason we could give for carrying on (GDPR Article 21(2)). You do not have to write to us. Open the app's Settings and turn Offers and promotions off — promotions stop immediately, and they stay off, because we record that you objected so that nothing can turn them back on. You can also object by emailing support@nikatru.com. Objecting costs you nothing else: no feature is removed, no content is withheld, and nothing you have paid for changes.

These messages are about Nikatru apps only. We do not promote anyone else's products, we are not paid to show you anything, and we do not share any information with anyone else in order to show them.

Offer codes and inviting a friend. If you redeem an offer code, we keep a record that your account redeemed it, which offer it was and when the free months end; the code itself is kept only in a scrambled form that cannot be read back. If you invite a friend, or accept a friend's invitation, we keep a record of who invited whom — the two accounts, the app, and whether the reward was given — so that each invited person is rewarded once and nobody is rewarded more than five times a year. Before the reward, we check only that the invited account was created no more than 7 days before the invitation was accepted, is at least 7 days old, has a confirmed email address, has started using the app and has never had Pro of any kind (a paid plan, a trial, a free month from a code, or one we gave); otherwise the invitation is recorded as not eligible and neither of you is rewarded. The record is deleted when the invited person deletes their account; if the person who invited them deletes theirs, their name is taken off it. Free months never include the AI features.

4. Third-party services

We rely on trusted third parties to deliver the Services. Who takes your payment, and who is the seller, depends on where you buy:

• In an app from the Apple App Store or Google Play, the store bills the purchase through its own system and sells it under its own terms. We verify the purchase with the store ourselves, on our own servers, so an app knows what you have paid for; no other company records what it entitles you to.
• Everywhere else we sell — this website — outside India, the seller is Paddle, acting as our merchant of record: Paddle takes the payment, issues the receipt and handles sales tax.
• When you buy in India — on this website — Nikatru is the seller and Razorpay takes the payment as our payment gateway, processing your payment details on our behalf.

We also rely on Cloudflare (hosting, and the network edge our website and endpoints run on; browsers also send Cloudflare a report when a connection to our sites fails, under a browser feature called Network Error Logging, and send it nothing about visits that succeed); Hostinger, which rents us the servers our own sign-in service runs on, so it holds the account credentials and sign-in sessions for apps that offer accounts; Supabase, which ran that sign-in service until 27 September 2026 and still holds a fallback copy of the account and sign-in records from before that date until it is retired; Resend, which delivers the email we send you (sign-in and account-verification messages, and the renewal reminders you choose to receive, which list the subscriptions about to renew) and therefore processes your email address on our behalf; and Google, whose Google Workspace hosts our support mailbox, so it holds what you write to us, and whose Google Drive stores our backups, which contain a copy of the account and app records described here; and Oracle Cloud, whose storage holds a further, encrypted copy of those backups and runs none of the Services. Where an app offers them, Sign in with Apple and Sign in with Google are optional ways to sign in: if you choose one, Apple or Google shares with us the email address and name on that account, as you allow, and you can change the name in the app's Settings. Google also sends a link to the profile picture on your Google account; our sign-in service stores it with your account, our apps do not show or use it, and it is deleted with your account. We do not sell anything directly from this website today; the arrangements above are the ones that apply when we do. Each provider processes data under its own privacy policy. We encourage you to review the policies of the app store you use.

Anthropic provides the AI model behind our AI features, such as the help assistant that answers questions about an app. When you use one, what you write is sent to Anthropic, a company based in the United States, to produce the answer. We do not keep it. Anthropic deletes it within 30 days of receiving or producing it, unless it must keep it longer to enforce its usage policy (up to 2 years for a request it flags) or to comply with the law.

We do not use advertising networks or advertising SDKs, we do not sell or share data with data brokers or advertisers, and no Nikatru app carries third-party advertising. The only promotional messages in our apps are our own, about our own products; section 3 explains how they work and how to turn them off. Usage statistics and crash reports are likewise not sent to a third-party analytics product: they are received and stored by software we run ourselves. Usage statistics run on infrastructure provided by Cloudflare as our hosting provider; crash reports are received by a server we operate ourselves on Hostinger.

Your own AI key. Using an AI feature with your own AI provider’s key (for Anthropic, OpenAI or Google Gemini) is not available in any Nikatru app yet: no app lets you add a key today. Before one does, we will update this Policy to say where the key is kept and where what you send goes.

5. Sharing of information

We share information only as needed to operate the Services (for example, with the payment processor to complete a purchase), to comply with the law or a valid legal request, or to protect our rights and the safety of users. We do not sell or rent personal data to third parties.

6. Data retention

We keep information only for as long as necessary for the purposes described here or as required by law. You can ask us to delete information associated with you by emailing us (see Contact).

We keep backups so that we can recover from a failure, and if a backup is ever restored we re-apply every erasure made since. Not every backup copy is deleted on a fixed schedule yet; once each one is, this section will state the longest time any backup is kept. The nightly copies in our own storage, listed above, are deleted after 30 days.

7. Security

We use reasonable technical and organisational measures to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Our servers keep operational logs. Each of our servers logs the requests it handles: when each one ran, whether it succeeded, and the lines our own code writes, which can include your account’s identifier. These logs never record your network address or your email address. We keep them to investigate faults and security incidents, and because Indian law requires us to keep such logs, and each log is deleted 400 days after it is written.

8. Age requirement

Our Services are for adults. You must be at least 18 years old to use the Services or to create an account, and no Nikatru app, extension or site is designed for or directed to anyone younger. India's Digital Personal Data Protection Act, 2023 treats every person under 18 as a child, and 18 is the single floor we apply everywhere we operate rather than a different age per country.

We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us information, contact us and we will delete it.

9. Your rights, and how to complain

You have the right to get a copy of the personal data we hold about you and a summary of how we use it; to have it corrected or completed; to have it erased; to withdraw a consent you gave; to nominate someone to use these rights for you if you die or cannot act yourself; and to complain, to us and then to the Data Protection Board of India. The law where you live may give you more, and we honour that too.

How to use them. In an app, open Settings, then Your privacy rights: there you can download a copy of everything our servers hold about your account at once, name your nominee, and delete your account. Anyone, signed in or not, can also send a request at nikatru.com/privacy-rights or email support@nikatru.com. When you ask to use a privacy right, we keep the request, what you wrote and the address our answer goes to, for 400 days after we close it, as the record that we answered. A request sent without signing in counts only once you confirm it from the email we send, so nobody can make one in your name. We acknowledge every request within 48 hours and resolve it within 30 days; a complaint is answered sooner (see How to complain, below).

Your nominee. In the app you can name one person, by their name and email address, to use your rights if you die or become unable to act. We tell them nothing until they contact us, and deleting your account deletes the nomination.

Usage statistics can be withdrawn without contacting us. Open the app's Settings and turn Usage statistics off; collection stops immediately, and so do crash reports. We keep a record of each consent decision (that a decision was made, when, and which version of this Policy you were shown) so that we can demonstrate the choice was yours. That record contains no IP address and no device fingerprint.

How to complain

Write to our Grievance Officer, Rajasekar Selvam, Proprietor, at support@nikatru.com (other ways to reach us are on the Contact page). We acknowledge a complaint within 24 hours and resolve it within 15 days. A complaint you send from an app (Settings, then Your privacy rights) or from nikatru.com/privacy-rights is acknowledged automatically, with its reference number: in the app as soon as we receive it, and, if you send it without signing in, on the page you reach when you confirm it from our email. If we do not resolve it, or you are not satisfied with our answer, you can complain to the Data Protection Board of India. Under the Digital Personal Data Protection Act, 2023, a complaint goes to our Grievance Officer first; once our process has ended, you can file it with the Board, which takes complaints online.

10. International users

We operate from India. Most of the providers in section 4 are based outside India: among them, Cloudflare, Google, Apple, Anthropic, Resend and Oracle in the United States, Paddle in the United Kingdom and Hostinger in the European Union. So your information is transferred to, and processed in, those countries and wherever those providers run their services. India’s Digital Personal Data Protection Act, 2023 allows this unless the Government of India restricts transfers to a country; if it restricts one we use, we will stop sending your information there.

11. Changes to this Policy

We may update this Policy from time to time. We will post the revised version here with a new "Last updated" date, and every earlier version stays available. If a change affects something you consented to, we ask you again in the app before the change applies to your data.

12. Cookies and local storage

Our own pages set no cookies. They keep two things in your browser. When you choose an app on the Pricing page, the page stores that app’s name in your browser’s local storage so that the checkout opens for the right app. It says nothing about you and never leaves your browser. When you choose Sign in with Apple on one of our web pages, the page keeps a one-time sign-in code and the details it needs to carry on (such as a code you entered to redeem) in your browser’s session storage, for that tab only, so that it can finish the sign-in when Apple sends you back. The page deletes it as soon as you come back, whether or not the sign-in worked, and your browser clears it when you close the tab; the sign-in code is sent only to our own sign-in service, to complete that sign-in.

Checkout runs code from our payment providers. When you start a purchase, the Pricing page loads Paddle’s checkout script (Paddle.js, from cdn.paddle.com) and opens Paddle’s checkout (buy.paddle.com) in a frame. For a purchase in India, our checkout page loads Razorpay’s checkout script (from checkout.razorpay.com), which opens Razorpay’s checkout (api.razorpay.com) and also loads Razorpay’s fraud-detection code (from cdn.razorpay.com). None of this loads until you start a checkout. Paddle and Razorpay may set their own cookies and keep similar data in your browser, and they read details of your browser and device, to take the payment and to judge whether it is fraudulent (fraud scoring). They do this under their own privacy policies, as the seller (Paddle) and as our payment gateway (Razorpay) described in section 4; we do not receive those cookies.

Signing in on our web apps runs a check from Cloudflare. When you sign up, sign in or ask for a new verification email in one of our web apps (an app you use in your browser, not one you install), the page loads Cloudflare’s Turnstile check (its script, from challenges.cloudflare.com). It reads details of your browser and device to tell a person from an automated program, and gives the page a one-time pass; our sign-in service checks that pass with Cloudflare and learns only whether it is valid. Cloudflare may keep data of its own in your browser for this check, and does this under its own privacy policy, as our hosting provider described in section 4.

Our web apps set no cookies either. Like an installed app, a web app keeps its working data in your browser’s local storage, on your device: your sign-in session, your settings and choices (such as language, theme and the consent choices you made), a random install identifier (used with usage statistics only if you allow them), anything waiting to be sent while you are offline, and a copy of your own app data so that the app works offline. Signing out ends the session, and you can clear the rest in your browser’s settings.

13. Contact us

Questions about privacy? Email support@nikatru.com or see our Contact page.