Privacy notice
- Your video and audio are never recorded, stored or seen by us. They travel directly between your own phones, encrypted.
- We hold only what Kammy needs to work: your account, your phones and cameras, noise alerts, your plan and security logs.
- Crash reports, usage statistics and personalised ads are off unless you switch them on.
- You can see, correct and delete your data in the app (Menu → Privacy & your data), and reach our Grievance Officer at info@keralogik.com.
- Who we are
- What we never collect
- What we collect and why
- Optional processing
- How video and audio work
- Consent and withdrawal
- Children
- Who processes your data
- Transfers outside India
- How long we keep it
- How we protect it
- If something goes wrong
- Your rights
- Your duties
- Grievances and complaints
- Language
- Changes to this notice
- Contact
1. Who we are
Kammy is an app that turns Android phones into baby, pet and home monitors, and shows your own IP cameras alongside them. It is provided by Keralogik, Kerala, India (“we”, “us”). For the personal data described here, Keralogik is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025.
This notice covers the Kammy Android app and this website. The website does not use cookies, analytics or trackers.
2. What we never collect
- Video and audio from your cameras. Streams go directly between your devices and are never recorded or stored by us. When a direct connection is impossible, the stream passes through an encrypted relay that cannot see its contents (section 5).
- IP camera usernames and passwords. Stored only on the phone where you entered them, in Android’s encrypted storage.
- Your location, contacts, photos or files. Kammy does not ask for them.
- Payment card details. Google Play handles payment; we only learn which plan you have and when it ends.
3. What we collect and why
We process the following only with your consent, given on the consent screen before you sign in. Each item is needed for the purpose next to it; without it that part of Kammy cannot work.
| Personal data | Where it comes from | Purpose |
|---|---|---|
| Account: name, email address, a Firebase account ID, and either your Google account ID or a password (stored only as a hash by Google Firebase) | You, when you sign in with Google or email | Signing you in; linking all your phones to one household; greeting you by name; answering your requests |
| Devices: phone make and model, an ID the app generates, a push-notification token, online status and when it was last seen | The app, on each of your phones | Listing your phones and cameras; showing which are live; waking a camera remotely; delivering alerts |
| Cameras: the names you give them, their type (baby, pet, home…), settings such as remote control and noise-alert sensitivity, and for IP cameras the local network address, port, stream path and make | You | Showing and connecting to your cameras |
| Pairings: which of your phones may start which camera, and when that was allowed | You, by scanning a code on the camera | Making sure only phones you approved can switch a camera on |
| Noise alerts: which camera heard a noise, how loud, and when (the sound itself is never sent) | Your camera phone | Notifying your other phones; showing recent activity |
| Connection data: network addresses exchanged to set up each stream, how it connected, and how much data was relayed | Your phones, during a session | Connecting your phones to each other; keeping relay use within plan limits |
| Subscription: your plan, trial and expiry dates, and purchase events | Google Play, via RevenueCat | Giving you what you paid for |
| Security logs: for each request to our servers, the IP address, time, action and result; records of consent you gave or changed | Our servers | Detecting and investigating misuse or unauthorised access; proving consent; meeting the record-keeping duties in DPDP Rules 6 and 8 |
Ads. If you use the free plan, Kammy shows ads from Google AdMob. To serve any ad, Google processes your device information and IP address. These ads are not personalised unless you allow it (section 4). Google acts as its own Data Fiduciary for ads; see how Google uses data from apps that use its services.
4. Optional processing
These are off until you switch them on, on the consent screen or later in Menu → Privacy & your data. Kammy works the same without them.
| Choice | What is processed | By whom | Purpose |
|---|---|---|---|
| Send crash reports | Crash details, device model, Android version, an installation ID | Google Firebase Crashlytics | Finding and fixing bugs |
| Share usage statistics | App events (for example: signed in, walkthrough finished, camera added, stream started), an app-instance ID, device model and approximate region derived from your IP address. Not your advertising ID. | Google Analytics for Firebase | Understanding which features are used |
| Personalised ads | Your advertising ID and ad interactions | Google AdMob | Choosing ads based on your interests |
Turning crash reports off also deletes any reports still waiting on your phone. Turning usage statistics off resets the analytics data held for your installation.
5. How video and audio work
When you open a camera, your two phones set up a direct WebRTC connection, encrypted end to end with DTLS-SRTP. Our servers only pass the short setup messages that let the phones find each other. If your network blocks direct connections, the encrypted stream is relayed through Cloudflare’s TURN service, which forwards it without being able to decrypt it. Nothing is recorded, by us or by Cloudflare.
Noise detection runs on the camera phone. Only the fact that a room was loud, and how loud, leaves the phone.
6. Consent and withdrawal
Before you sign in, Kammy shows you a summary of this notice and asks you to confirm you are 18 or older and to agree. The optional choices are separate switches, all off by default. We keep a record of which version you agreed to, what you chose and when, so we can show your consent was given.
You can withdraw consent as easily as you gave it:
- Optional processing: switch it off in Menu → Privacy & your data. It stops straight away.
- Everything: Menu → Privacy & your data → Withdraw consent and delete account, or ask us at info@keralogik.com. We stop processing and erase your data, except what the law requires us to keep (section 10).
Withdrawal does not affect processing that happened before it. When this notice changes in a way that affects what we collect or why, the app asks for your consent again.
7. Children
Kammy accounts are for adults only. Everyone must confirm they are 18 or older before signing in, and we do not knowingly process the personal data of anyone under 18 as a user. We do not track, monitor the behaviour of, or target advertising at children. If you believe a child has created an account, write to info@keralogik.com and we will delete it.
Many families use Kammy to watch over a baby or child. That video goes only between the parent’s own devices and is never received, stored or seen by us. Watching a camera in your own home is a personal and domestic activity of yours.
8. Who processes your data
We do not sell your personal data, and we do not share it with anyone for their own marketing. We use these service providers, under contracts that require them to protect it. Each one processes only what it needs for its stated purpose.
| Provider | Role | What for | Where |
|---|---|---|---|
| Google Firebase Authentication | Data Processor | Sign-in (name, email, password hash or Google account ID) | United States and other Google regions |
| Google Firebase Cloud Messaging | Data Processor | Delivering wake-ups and noise alerts to your phones | United States and other Google regions |
| Google Firebase Crashlytics | Data Processor | Crash reports — only if you allowed them | United States |
| Google Analytics for Firebase | Data Processor | Usage statistics — only if you allowed them | United States |
| Cloudflare | Data Processor | Hosting our servers and database; relaying encrypted streams when needed | Global network; usually the data centre nearest you |
| RevenueCat | Data Processor | Managing subscriptions (your account ID and purchase events) | United States |
| Google AdMob | Data Fiduciary in its own right | Ads on the free plan; personalised only if you allowed it | United States and other Google regions |
| Google Play | Data Fiduciary in its own right | Taking payment for subscriptions | United States and other Google regions |
We may also disclose personal data when the law requires it, for example to comply with a lawful order of a court or government authority in India.
9. Transfers outside India
Our providers process data in the countries listed above, mainly the United States. The DPDP Act permits this, except to countries the Central Government restricts. We will follow any such restriction, and any conditions the Government sets for transfers, as they are notified.
10. How long we keep it
| Data | Kept until |
|---|---|
| Account, devices, cameras, pairings, subscription status | You delete your account or withdraw consent |
| Noise alerts | One year after the alert, then erased automatically |
| Pairing codes and connection-setup messages | Minutes — erased once used or expired |
| Security logs | One year after each entry, then erased automatically |
| The consent you currently rely on | As long as your account exists, then one year |
| On account deletion: a record of the deletion and a copy of the household data erased | One year after deletion, then erased automatically |
| Crash reports and usage statistics (if allowed) | Firebase Crashlytics keeps crash reports for 90 days; we set Google Analytics to keep event data for 2 months |
Why one year after deletion? DPDP Rules 6(1)(e) and 8(3) require every Data Fiduciary to keep personal data, traffic data and logs of its processing for at least one year, so that misuse can be investigated, and to erase them after that. During that year we use this copy for nothing else. After it, it is erased without you having to ask. Google may take up to a further period, as its own policies describe, to clear deleted data from its backups.
11. How we protect it
- Encryption: all traffic uses TLS. Streams are end-to-end encrypted with DTLS-SRTP. Our database is encrypted at rest by Cloudflare. Camera passwords are encrypted with the Android Keystore.
- Access control: every request must carry a valid, signed sign-in token. Each household’s data is held separately and can be reached only with that household’s token. Remote start needs a pairing code scanned on the camera itself.
- Monitoring: access is logged and kept for one year so unauthorised access can be detected, investigated and stopped from happening again.
- Resilience: our database keeps point-in-time recovery, so data can be restored if it is damaged or lost.
- Minimisation: we do not ask for data we do not use, and our servers never hold video, audio or camera passwords.
- Providers: each provider is bound by contract to keep your data secure.
12. If something goes wrong
If a personal data breach affects you, we will tell you without delay, through the app or by email. We will say what happened and when, what it means for you, what we are doing about it, what you can do to protect yourself, and who to contact. We will also report it to the Data Protection Board of India: at once, and with full details within 72 hours, as Rule 7 requires.
13. Your rights
Under the DPDP Act you have the right to:
- Access (section 11): a summary of your personal data and what we do with it, and who else processes it. In the app: Menu → Privacy & your data → See a copy of your data.
- Correction and completion (section 12): correct your name in the app, and rename cameras and phones on their cards. Ask us for anything else.
- Erasure (section 12): delete your account in the app, or ask us.
- Grievance redressal (section 13): see section 15.
- Nomination (section 14): name someone to exercise your rights if you die or cannot act. In the app: Menu → Privacy & your data → Nominate someone, or email us.
- Withdraw consent at any time (section 6).
How to ask: use the app, or email info@keralogik.com from the email address on your Kammy account and say what you want. Your account email address is the identifier we need. If you write from another address, we may ask you to confirm the request from your account email. We act on requests within 30 days. Every reply includes our Grievance Officer’s contact details. Full step-by-step instructions are on Your data & rights.
14. Your duties
The DPDP Act (section 15) asks you not to impersonate anyone, not to suppress material information, not to file false or frivolous complaints, and to give accurate information when asking for a correction.
You are also responsible for using Kammy lawfully. Only point cameras where you are entitled to, and tell people who may be recorded or watched, such as a nanny or house guests, where the law requires it.
15. Grievances and complaints
If you have a concern about how we handle your personal data, write to our Grievance Officer (below). We will acknowledge it promptly and resolve it within 30 days, and in any case within the 90 days the DPDP Rules allow. If you are not satisfied with our response, you may complain to the Data Protection Board of India under section 13(3) of the DPDP Act, through the Board’s digital office.
16. Language
This notice is in English. You may ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to info@keralogik.com.
17. Changes to this notice
We will post any change here with a new version date. If a change affects what we collect or why, the app shows you the new notice and asks for your consent again before continuing.
18. Contact
Keralogik, Kerala, India
Email: info@keralogik.com
For questions about your personal data, rights requests and grievances.