Privacy Policy

Effective 2026-07-07 · Version 1.0

1. About this policy

Kuhukoo is a social media scheduling product operated by Taaj Labs, a brand of Taaj Singh OPC Private Limited (India). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that data. It applies to all users of kuhukoo.com, dev.kuhukoo.com, and the Kuhukoo application.

2. Information we collect

• Account information — your name, email address, and a securely hashed password (or Google account identifier if you sign in via Google).
• Platform authorization — OAuth tokens for platforms you connect (Facebook, Instagram, Threads, TikTok, YouTube). Tokens are encrypted at rest with AES-256-GCM.
• Content — images, videos, captions, and metadata you upload to schedule posts.
• Usage data — aggregate analytics about how you use Kuhukoo (which features, when you post) for product improvement.
• Communications — emails you send us or receive from us (welcome, password reset, connection alerts).

3. How we use your information

• Provide and improve the Kuhukoo service.
• Publish your content to the platforms you've connected, on the schedule you've chosen.
• Send transactional email (account, security, service notifications).
• Aggregate analytics to improve features and reliability.
• Detect and prevent abuse or fraud.

4. Sharing with third parties

• Platforms you connect — we share what's needed to publish your content (video, caption, hashtags). We never share more than the specific post being published.
• Email delivery — Resend (email delivery infrastructure) processes transactional email.
• Payment processing (when applicable) — Razorpay (India) or similar processes subscription payments. We never store your card details.
• We do not: sell your data to advertisers, share data with data brokers, or use your content to train AI models.

5. How we protect OAuth tokens

Platform access tokens are encrypted with AES-256-GCM before storage in our database. Only the running application can decrypt them, using an environment secret held outside the database. Tokens are refreshed automatically by our background workers, and deleted when you disconnect an account.

6. Data retention

• Account data: retained while your account is active.
• Deleted account data: purged from active systems within 30 days of the deletion request; from backups within 90 days.
• Published content records: retained for 12 months for audit and support.
• Audit logs: retained 12 months for security investigations.

7. Your rights

You have the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in machine-readable format.
• Object to specific processing.
• Withdraw consent for platform connections.

Contact contact@taajlabs.com to exercise any of these rights, or use the Data Deletion form.

These rights are honored globally, with additional protections for users in the EU (GDPR), California (CCPA), and India (DPDP Act 2023).

8. Cookies and tracking

We use session cookies only for authentication (required for the app to work). We do not use advertising cookies, third-party trackers, or analytics beacons on user-authenticated pages.

9. Children

Kuhukoo is not directed at users under 18. We do not knowingly collect data from minors. If we learn that a minor has provided data, we delete it.

10. International transfers

Our servers are located in the European Union (Hetzner, Germany). Data may be processed in India for support and administration by Taaj Singh OPC Pvt Ltd employees. Both jurisdictions have adequate protections in place.

11. Changes to this policy

We'll email you 30 days before making material changes.

12. Contact

• General (Kuhukoo team / Taaj Labs): hello@kuhukoo.com
• Legal: legal@taajlabs.com (fallback: contact@taajlabs.com)
• Security concerns: security@kuhukoo.com (also see /security)
• Postal: Taaj Singh OPC Private Limited, Ludhiana, Punjab, India