KagazSetu Privacy Policy
KagazSetu keeps your forms and documents on your own phone, encrypted, and never sells your data.
This policy covers the KagazSetu Android app, the KagazSetu Chrome extension and the websites kagazsetu.com and kagazsetu.in (together, "KagazSetu"). KagazSetu is run by Manish S Goyal, Kolkata, West Bengal 700089, India ("we", "us"). It follows the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
In short (aasaan bhasha mein)
| English | Hinglish |
|---|---|
| Your profiles, photos and documents stay on your phone, encrypted. | Aapka data aapke phone mein, lock ke saath. |
| We do not keep your documents on our servers. | Hamare server par aapke kaagaz nahi rakhte. |
| We never sell your data or use it for ads. | Data kabhi bechte nahi, ads ke liye use nahi. |
| We never save passwords, OTPs or card numbers. | Password, OTP, card number kabhi save nahi. |
| The app never submits a form for you. | Form ka aakhri click hamesha aapka. |
| A child's profile needs a parent's consent. | Bachche ki profile sirf parent bana sakte hain. |
| Health reports and medicine lists never leave your phone. | Health data sirf phone mein, kabhi server par nahi. |
| You can delete everything at any time. | Kabhi bhi sab kuch mita sakte ho. |
What data we handle and where it is stored
Most data never leaves your device. The table shows each kind of data, where it lives and why.
| Data | Where it is stored | Why |
|---|---|---|
| Profile details you enter (name, parents' names, date of birth, address, mobile, education, category) | On your device only, encrypted (AES-256) | To fill forms for you |
| Photos, signatures, thumb impressions, documents (Aadhaar, PAN, marksheets, certificates) | On your device only, encrypted | To attach and resize them for forms |
| Copies of forms you filled, application numbers, receipts | On your device only, encrypted | So you can find them later |
| Health records in the Android app and the Chrome extension: lab reports, readings, prescriptions, medicine list and reminder times | On your device only, encrypted (Android: SQLCipher database with a 256-bit key in the phone's secure storage; Chrome: inside your passphrase-locked vault) | To show your own records, trends and medicine reminders |
| Encrypted backup file | A file you export and keep yourself, only if you choose to | To restore on a new phone or computer; we cannot read it |
| Documents you send to Kaagaz Samjho, and text or photos you send to BhashaSetu for translation | Sent to our AI processing server over an encrypted connection, only after you agree each time | To explain the document in simple language, or to translate it |
| Account details: email or mobile number, plan, purchase receipt | Our server | To manage your membership and restore purchases |
Kaagaz Samjho processing. A document you send for explanation is deleted from our server as soon as the explanation is ready, and within 24 hours at most. It is processed by Anthropic (Claude) through its commercial API, which does not use it to train AI models.
Health data. Health records are never sent to our servers, to Firebase, to any AI service or to analytics. Text in a report is read on your phone (on-device OCR). A report shared to KagazSetu from WhatsApp, Gmail or Files waits in "Review pending" and is saved only when you confirm it. A password for a locked lab-report PDF is kept only in your phone's secure storage. The app shows your records; it does not diagnose or give medical advice. You can delete one member's health data, or all of it, at any time from the app. Android backup is turned off for the app so health data is not copied to cloud backups.
Aadhaar numbers are always shown masked (XXXX XXXX 1234). We do not collect or store your Aadhaar number on our servers.
What we never do
- We never save or fill passwords, OTPs, CAPTCHAs, card numbers or UPI PINs.
- We never press submit on a form. You review and submit it yourself.
- We never sell, rent or share your personal data for advertising.
- We never show ads based on your documents or profiles.
- We never read your encrypted backup.
- We never claim a document is government-verified.
Children's data
KagazSetu is for adults aged 18 and above. Children do not create accounts. A parent or lawful guardian may add a child's profile to their own account to fill school, admission and exam forms.
- Before a child's profile is created, we take the parent's verifiable consent, as the DPDP Rules, 2025 require. We confirm the parent is an identifiable adult through their registered account.
- A child's details, photos and documents stay on the parent's device, encrypted, like all other profiles.
- We do not track children's behaviour, profile them, or show them targeted ads.
- A parent can view, change or delete a child's profile at any time.
Verification, payments and other services
We use a few outside services. Each gets only what it needs.
| Service | What it receives | Purpose |
|---|---|---|
| Google Play Billing | Your purchase, handled by Google | Membership payments in the Android app |
| Razorpay | Payment details, handled on their page; we never see your card or UPI details | Membership payments on the website and Chrome extension |
| Anthropic (Claude API) | A document you choose to send to Kaagaz Samjho, or text or a photo you choose to translate | Simple-language explanation and translation |
| Hostinger (email) | Your email address | Sending purchase receipts and restore codes |
When the app fills a form on a government, exam or university website, that website's own privacy policy covers what you submit to it.
Permissions the app asks for
The app asks for each permission only when you use the feature that needs it. You can turn any of them off in your phone's settings.
| Permission | When it is used |
|---|---|
| Camera | Scanning a document or taking a photo for a form |
| Photos and files | Picking a document or photo you already have |
| Microphone | Speaking a phrase for BhashaSetu translation |
| Notifications | Last-date and expiry reminders, and medicine reminders you set (the notification text does not name the medicine) |
| Biometric (fingerprint or face) | Unlocking the app |
| Internet | Opening form portals, payments and Kaagaz Samjho |
The app does not ask for your contacts, location, call logs or SMS. The Emergency screen opens your phone dialer or Google Maps; Maps uses its own location permission.
Your rights, deletion and contact
Under the DPDP Act, 2023 you can do the following at any time:
- See what personal data we hold about you.
- Correct or update it.
- Withdraw consent you gave, for example for Kaagaz Samjho or backup.
- Delete your account and data.
- Name another person to act for you if you die or cannot act.
- Raise a complaint with our Grievance Officer, and then with the Data Protection Board of India.
Deleting your data. In the app, open Settings and choose Delete account. This removes your account, plan details from our server within 30 days, except purchase records we must keep for tax law. Data on your phone is deleted when you delete it or uninstall the app. You can also request deletion at kagazsetu.com/delete-account without the app.
How long we keep data. Kaagaz Samjho documents: until the explanation is ready, at most 24 hours. Account and plan details: while your account is active. Purchase records: as long as Indian tax law requires.
Security. We use encryption on the device and in transit. No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.
Changes. We will show a notice in the app before any important change to this policy takes effect.
Grievance Officer and contact
- Name: Manish S Goyal
- Email: support@kagazsetu.com
- Address: Kolkata, West Bengal 700089
- Phone: +91 83359 92007
- We reply within 7 working days.
Last updated: 28 Oct 2026