Privacy Policy

Katigate and the Nepali Calendar app are built and operated by the same team. “We” and “us” mean that team. “You” means the person using the website or mobile app, whether signed in or not.

You can read the calendar, panchang, rashifal, sahit, holidays, and converter without signing in or providing any personal data. The categories below apply only to the parts of the service you choose to use.

• Account information: when you sign up with email and password we store your email and a hashed password. When you sign in with Google we receive your Google account email, name, and Google user id; we do not receive your Google password.
• Profile data you choose to provide: name, preferred language, preferred timezone, date of birth, time of birth, place of birth, and rashi. We use these to personalize the calendar, generate your kundali, and target rashifal pushes.
• Personal content you create: custom events, birthday reminders, kundali charts, dashboard customization, and feedback messages you submit.
• Push tokens: when you allow notifications, we register the token your browser or phone gives us so the alerts you opted into can reach you.
• Technical signals from each request: the page requested, IP address, browser user-agent, and your language/timezone preference. We use these for security, abuse prevention, and aggregate analytics.
• Radio listening: we do not record which stations you play. Fetching the station list is an ordinary request covered by the technical signals above, and playback connects your device directly to the station’s own server, so we never see it.

We use a small number of first-party cookies and browser storage entries. None of them are used for cross-site tracking. Cookies from Google services are described in Section 5.

• Authentication cookies that keep you signed in. They are HttpOnly and Secure, and sent only to our service.
• Preference cookies for your language, theme, and timezone, so pages render correctly on first paint.
• Short-lived browser storage used to remember a dismissed banner, a deep-link target, or your last push token.

We use the data above only for these purposes:

• To run the features you asked for: show your calendar with your own events, generate your kundali, deliver the reminders you scheduled, and sign you back in next time.
• To send the notifications you opted into: rashifal, birthday and event reminders, replies to your feedback, and occasional product announcements.
• To keep aggregate analytics (usage counts, active users, language and timezone splits) so we can improve the product.
• To prevent abuse and protect accounts: rate limiting, login throttling, and removal of invalid push tokens.
• To respond to feedback and support requests.

We rely on a small number of third parties. Their own privacy policies also apply.

• Google Firebase (Cloud Messaging; Crashlytics on the mobile app): push delivery and, on mobile, crash diagnostics. https://firebase.google.com/support/privacy
• Google Sign-In: when you choose “Continue with Google”. https://policies.google.com/privacy
• Google Analytics: aggregate product analytics. https://policies.google.com/privacy
• Google AdSense: advertising on some pages. https://policies.google.com/technologies/ads
• Cloudflare Turnstile: the "I am not a robot" check on the feedback form (website and app). It looks at browser and device signals to tell people from bots, sets no advertising cookies, and we receive only a pass/fail result. https://www.cloudflare.com/turnstile-privacy-policy/

We do not sell your data and we do not pass profile data to advertisers.

The Friends features are opt-in and only available to signed-in accounts (guest accounts are excluded). When you use them we store:

• A friend code: a short, random, lifetime identifier issued to your account the first time you open Friends. Every issued code is reserved permanently, including after account deletion, so a code you shared can never point to somebody else. The reservation record stores the code and a timestamp, not your identity.
• Friend requests and the friendship graph. Both sides must accept; a scanned QR or a tapped invite link only creates a request.
• Relationship labels (family, couple). Upgrading a label needs the other person's consent; removing it never does.
• Group membership, group names, and shared occasions (title, date, time, reminder lead) for groups you create or join.
• Preset birthday wishes you send or receive, and a per-day record used only to rate-limit them.
• Your date of birth's MONTH AND DAY are visible to accepted friends so they can be reminded and send a wish. Your birth YEAR is never shared.

Accepted friends see your name, photo, a masked email (for example r***@gmail.com), and your birthday month and day. Invited group members additionally see the group's name and its occasions. Nicknames and emoji you assign to a friend are private to you and are never shown to that friend. Moderators can see friendships, groups, group names and occasions when reviewing a report; service providers that operate notifications and ads process only what is needed for that.

An invite link (https://katigate.com/r/<code>) can carry a friend code through an install:

• On Android, if you install from Play after opening an invite link, Google's Install Referrer passes the code to the app on first launch. We read it once and store it locally on your device.
• A pending invite code is kept in local app storage until you confirm it, cancel it, or it is rejected. A link never sends a friend request by itself. You always confirm first.
• The landing page reveals nothing about who invited you: no name, photo, or email.
• We do not send app-owned email invitations. Sharing goes through your device's own share sheet, which may offer Mail as one of its targets.
• The camera is used only if you choose to scan a QR code. Typing the code manually always works instead, and we never store camera images.

Push is opt-in. After you grant browser or system permission we register a push token tied to your account so the alerts you scheduled can reach you. You can revoke the permission at any time from your browser or device settings, and deleting your account removes every push token attached to it.

Some pages on the website show ads delivered by Google AdSense. Google chooses placement and content; we do not pass your account data into the ad request.

• Google may use cookies and similar technologies to show ads relevant to your interests.
• Where required by law, Google’s consent screens will ask you to choose ad preferences.
• You can manage personalized ads at https://adssettings.google.com or with your browser’s privacy controls.

Retention is feature-driven.

• Profile, kundali, custom events, birthday reminders, and dashboard customization: kept until you delete the item, or you delete your account.
• Feedback messages: kept until you delete your account, then anonymized or removed.
• Push tokens: kept while valid; invalid tokens are removed automatically.
• Aggregate analytics: retained without per-user identifiers.

You can act on your own data without contacting us:

• Edit: sign in and use the Profile page to update your name, date of birth, rashi, language, and notification settings. Use the Custom Events, Birthday Reminders, Kundali, and Dashboard pages to manage the content they hold.
• Delete your account: open Profile and use the Delete Account form. We remove your account and the personal content tied to it, and clear your sign-in cookies.
• Export: not currently offered as a self-serve export. Reach out through the Feedback page if you need a copy of your data and we will arrange it.

We cannot promise perfect security, but we do the following:

• HTTPS for every public endpoint.
• Authentication cookies are HttpOnly and Secure and cannot be read by JavaScript.
• Passwords are stored hashed, never in plaintext.
• Public endpoints are rate-limited; login has a per-IP limiter to slow credential stuffing.
• Database and admin access are restricted to operators.

The service is a calendar and reference tool for a general audience. We do not knowingly collect personal information from young children (under 13). Personal features such as kundali or birthday reminders may include data about family members, and a parent or guardian is responsible for any account or content created on behalf of a minor. If you believe a child’s personal information has been provided to us without appropriate consent, contact us through the Feedback page and we will remove it.

Our service may be hosted on servers outside Nepal, and the third-party services we use may process data in their own global regions per their policies. By using the service you agree to that transfer.

When we change this policy in a way that materially affects you, we will update the effective date at the top of this page and, where appropriate, show a notice in the app. Continued use of the service after a change means you accept the new policy.

Use the Feedback page (linked in the More menu and in the footer) to reach us about privacy questions, data requests, or anything in this policy.