What we collect, and what we do with it.

We collect only what the site needs to function. We never collect payment details (purchases happen on the retailer’s site, not ours), health records, or government identifiers.

• Account data — your name, email address, and profile picture, received from Google when you sign in with Google (our authentication runs on Supabase).
• Search and browsing activity — the searches you run on Kyaloon and the pages and products you view.
• Buy-link clicks — when you click a Buy button, we record that click so the retailer can attribute any resulting purchase to Kyaloon (this is how we earn affiliate commission).
• Device and usage analytics — standard analytics events (browser type, approximate location, pages visited) collected through our analytics tools.

• Account creation and sign-in — your Google name and email identify your account.
• Product recommendations — your activity on the site personalises what we surface to you.
• Affiliate revenue attribution — buy-link clicks are how retailers know a purchase came from Kyaloon. This is our only revenue source, and it never influences scores — see the Methodology page.
• Platform analytics — aggregate usage data tells us what to fix and what to build.

Retention is per data type. Nothing is kept indefinitely.

We do not sell personal data. It is shared only with the service providers that run the platform, each named below.

• Supabase — our database and authentication infrastructure. Your account data lives here.
• Amazon (Amazon Associates) — receives affiliate click data when you follow a Buy link to Amazon, so purchases can be attributed.
• Vercel — hosts the website and provides aggregate performance analytics.
• PostHog — our product analytics tool — receives usage events (searches, page views).

Kyaloon uses two kinds of cookies: essential session cookies that keep you signed in (set by Supabase authentication), and analytics cookies used by the tools named above to distinguish visits. We do not use advertising or cross-site tracking cookies.

Under the Digital Personal Data Protection Act, 2023, you have the right to access, correct, and erase the personal data we hold about you, and the right to grievance redressal.

• Deletion — email support@kyaloon.com from your registered address asking for your account and data to be deleted. We action deletion requests within 72 hours.
• Access and correction — email the same address to request a copy of your data or to correct it.
• Grievances — our designated Grievance Officer, their contact details, and response timelines are published on the Grievance Officer page.

When this policy changes materially, we update the effective date at the top and, for signed-in users, surface a notice on the site. The current version always lives at kyaloon.com/privacy. See also our Terms of Service.