What we keep, and what we will never do with it.

The family account: family name, the parent's email and password (hashed with bcrypt), whether you have confirmed that email, a family code, the referral code your family was given and which family invited you — that family can see your family's name and the day you joined, nothing else — a note you may have written when signing up before 14 September 2026, and each member's name, avatar, colour, date of birth (used to fit habits to a child's age and to wish her a happy birthday inside the app — never outside it) and 4-digit PIN (also hashed).

What the family creates: habits and completions, pocket-money transactions, savings, fixed deposits and fund holdings, goals, budgets and spending categories, wishes and shopping requests, perks and redemptions, routines, streak freezes, challenges — including the case a child made for one in her own words — cheers, meals and meal votes, calendar events, lessons passed and lessons a parent writes, family posts and reactions, and the awards a family invents.

Health entries, only when a parent turns the tracker on: the condition chosen for a child and the note describing it, blood-sugar readings with their times and how they were taken, carbohydrates counted, insulin doses with the pen used, the pens themselves, food eaten outside planned meals, the times of day each person is reminded to check, and the two notes a parent types — the doctor's plan and what to do for a low.

A parent's own programme, if they start one: which programme, which child it is about, the day it began, and two numbers each evening — how many flare-ups there were in the house and how many hours the child slept. It records nothing else about the child at all. There is no notes field, no rating and no description, because a parent must not be able to write a sentence about a child that the child could never read.

Money a parent takes back: if your family switches the deduction module on, we keep the amount, the parent's reason in their own words, the parent's name, and whether it was reversed. A reversal adds a row; it never erases the first one, because the child saw it happen.

Private messages between family members: the text itself, stored so it can be delivered and read again. Taking a message back marks it withdrawn and removes the text, and the marked row stays so the other person is told something was withdrawn rather than left doubting their memory.

A record of things that happened to the account: every sign-in and failed sign-in, PIN resets, balance adjustments made by hand, members removed, email and password changes, and refused password prompts. A parent can read this at Settings → Security. It is not deleted, and when a member is removed their name stays in the line recording the removal.

Consent: when you agree to these documents or confirm you are a child's parent, we record your name, the child's name, the wording in force, the date, the IP address you did it from and a short description of your browser. These records are never edited or deleted — that is what makes them worth anything.

Anything you send us for help: what you or your child typed into Settings → Help, every message back and forth with staff, and the answer. Staff read these by design, including tickets tagged as health.

Billing: your plan, its status and renewal date, any discount granted to your family and the label on your bill, plus a staff note about why you are on the plan you are on. There is no payment provider connected to Kulraise at all, so no card or bank detail is ever stored, because none is ever taken.

Email: a record of every message we sent you or decided not to send — your address, which email it was, whether the provider accepted it and what it said if not. We do not keep the subject or the body, because a filled-in email carries names, a join code and sometimes a reset link.

Technical basics needed to run it: a session cookie; a push subscription and browser description for each device where reminders or alerts were switched on; a per-day note of which reminders were sent to whom, and a note of which birthday or anniversary greeting each member has already seen so it is shown once; the IP address on a password-reset request; the hashed, expiring link that confirms your email; and short-lived counters keyed to an IP address or email so that somebody cannot sit and guess a password.

If you import a calendar, the titles and times of those events are copied into Kulraise and kept like any other event.

Everything above is kept for as long as the family account exists and is deleted with it.

Some of it is deliberately never edited or removed while the account lives, because a record you can quietly change is not a record: the consent trail, the family's own audit trail, deductions and their reversals, support conversations, discounts granted and withdrawn, and the email delivery log.

Deleting a member removes everything that belongs to them — every habit, transaction, reading, dose, goal and message. Their NAME survives in a few places that describe things which really happened: the line saying they were removed, a support ticket they opened, a deduction applied to them, and a family post about them. We think that is right, and you should know it before you press the button rather than after.

Three things are pruned on a schedule, and none of them is anything a family wrote inside the app: the server's own performance readings, which are about the machine and mention no person, kept for thirty days; the invite list described below, which forgets anyone who has not replied in ninety days; and a message sent to one of our addresses, kept under its own rule below.

No advertising, no ad trackers, no analytics that follow anyone around, and no selling or sharing of family data with anyone.

No profiling of children. Health entries are used for your family's own screens and the report you print for your doctor, and for nothing else.

No staff access to the CONTENT of your family — a reading, a note, a message, a dose — unless a parent creates a support key. Keys are scoped, expire, are revocable in a tap, and every single use is written to an audit trail you can see.

Staff actions are logged whether or not a key exists. Opening your family's account page writes a row naming your family and the staff member who did it, and that record is kept. Somebody looking at your account can always be shown to have looked.

No dosing advice. Kulraise records the numbers a person decided; it never calculates one.

No family in our marketing. When we tell people about Kulraise — by email, WhatsApp or this site — nothing from any family using it is used: not a name, an amount, a reading, a screen, or the fact that you are here. Every family, name and figure we publish is invented; if one matches a real person, that is coincidence, not your data.

If you asked one of us, face to face, to be told about Kulraise, we write down your name, the email address or WhatsApp number you gave us for it, when we met and which of us you spoke to, what you agreed to and in which words, a keyed hash of each contact, the secret behind the links in your emails, and a note of each message we send you — which one it was, whether it went and whether it was delivered, never its text. That is the whole record, and it is kept apart from every family's data: nothing in it comes from the app, and nothing in it goes into the app.

It is used to send you the one invite you asked for — on WhatsApp if you gave a number, by email otherwise — and, only if you press the button in an emailed invite saying so, an occasional note about what is new by email: a few a year, never more than four. Nobody can say yes to the notes on your behalf, not even the person you spoke to. Email is sent through our mail provider from an address that is not read. WhatsApp messages go through MSG91 and Meta, who see the text of the message — which is why an invite carries only your first name, the code and a link, and why nothing about any family ever travels that way.

To stop, reply STOP on WhatsApp, press the stop button behind the link in any email, or tell the person you spoke to, and nothing more is sent — not an invite, not a note, on any channel. Your name, address and number are then deleted; the keyed hash of each is kept, for as long as we keep an invite list, so that nobody here can add you again by mistake. If you never sign up, you are deleted ninety days after your last reply — and nothing more is sent after three messages with no reply, whatever the calendar says. If you do sign up, the row is deleted and your family's account is where your data lives from then on, under the sections above.

To complain or to ask what we hold, tell the person you spoke to — you met one of us, which is the only way onto this list — write to the address under Getting in touch below, or go to the Data Protection Board of India. Our invites come from an address that is not read; the one under Getting in touch is.

A message sent to any address at our domain reaches the people who run Kulraise, through a mail router (Cloudflare) that hands it to our own server and keeps a delivery log of its own but not the message. We keep the address you wrote from, the name on it, the address you wrote to, the subject, the date and the text of the message, as plain text. An attachment is not kept — we count that one arrived, and drop the file. If we answer, the reply goes through our mail provider (MSG91), and the reply and when it was sent are kept beside your message.

It is used to answer you, and for nothing else. Writing to us does not put you on the invite list, and it is not matched against any family: whoever wrote is a person who wrote, and a reply can only go back to the address it came from.

A message is deleted ninety days after it is marked as dealt with, and any message a year after it arrived, whatever its state. To have it deleted sooner, say so in the message itself and the person who reads it deletes it then — the record of that keeps a reference number and nothing of what you wrote. To ask what we hold, or if you are not satisfied, go to the Data Protection Board of India. Deleting a family (below) does not reach a message you sent us; this rule does.

A child's account is created and controlled by a parent or guardian, who consents on the child's behalf. Children have their own PIN so their pocket money and health log are not open to the whole household.

Health data is sensitive personal data under India's Digital Personal Data Protection Act 2023 and, where it applies, the UK/EU GDPR. It is stored to provide the service to your family, kept for as long as the account exists, and deleted with it.

A parent can delete any member from Settings → Family, and with them every habit, transaction, reading, dose and message belonging to that member. Their name remains in the record of the removal itself, and in anything that describes something which happened — a ticket they opened, a deduction applied to them.

Low and high alerts are sent to the parents of that family only, on devices where a parent switched notifications on.

Access and portability: the bank statement and the 30-day health summary download as CSV from inside the app, and a full copy of your family's data can be requested at any time.

Correction: everything is editable in the app by a parent — readings, doses, goals, wishes and the plans you have typed.

Erasure: a parent deletes the family from Settings → Delete family. It needs no reason, no email to us, and nobody at Kulraise can refuse it. It is scheduled for seven days so that a press nobody meant can be undone — every parent is told immediately, any of them can cancel, and the date is on every screen until it happens; the same screen will also do it straight away for anyone who would rather not wait.

What deleting the family removes: everything above, except a message you sent to one of our addresses, which is kept and forgotten under its own rule in the section before this one. Every habit, transaction, reading, dose, message, award and calendar entry; your own audit trail; the consent records; the support conversations; the emails we have a record of sending you. Deleted, not marked deleted, and no shadow copy is kept for anything, marketing included — the people we write to about Kulraise are adults who asked us in person, never anyone taken from this database. Backups are kept for fourteen days and then age out, so a deletion is complete within a fortnight rather than instantly, and a backup is never restored to undo one. Those backups are compressed database dumps held on the same server, not encrypted and not held off-site — moving them off the box is open work, and this sentence will change when it is done.

What survives a deletion, so that you know before rather than after: our staff's own record of any time a Kulraise person opened your account — the who, the what and the when — with anything naming your family stripped out of it. That trail is the promise that staff can always be shown to have looked, and it would be worth nothing if leaving erased it. And one line recording that a deletion happened, when it was asked for and when it ran, holding no name, no email, no address and not even which parent asked.

Withdrawing consent: turn the health tracker off and no further readings or doses are recorded; delete the member or the family to remove what is already there.

Notifications: push is off until someone turns it on for a device, and can be turned off again on that device.

Data is held in a PostgreSQL database on a server the family that runs Kulraise controls, in India, with daily compressed backups kept for fourteen days on that same server.

Traffic is served over HTTPS only. Session and staff cookies are HttpOnly and marked Secure whenever the connection is encrypted.

Staff can see account-level facts — family name, the parent's email, plan, discount, counts of habits or readings, and what you wrote when you signed up — without a support key. They cannot see the content of a reading, a note, a message or a dose without one.

There is one documented exception, and it is the only one: an owner can break glass for a family locked out of their own account. It is owner-only, audited, and the family is told in plain words that it happened.

The health features are a family log and a habit tracker. They do not diagnose, do not suggest doses or treatment, and never replace your doctor or diabetes team. Targets, ratios and routines come from them.

The timings shown next to a pen — for example that a regular human insulin is given some minutes before food — are the values a parent entered after being told them by a clinician. Kulraise repeats them; it does not decide them.

For a data request, a correction or a complaint, use Settings → Help inside the app, which reaches the people who run Kulraise directly. If you are not a member of a family — a parent who finds a child in a family that is not theirs, or anyone with a question about this page — write to hi@krsnaha.com, which a person reads. Under the DPDP Act you may also complain to the Data Protection Board of India if you are not satisfied with the response.