Privacy notice

KitnaKaafi is designed to collect the minimum amount of information required to run.

What the promise covers, exactly

The promise on the home page — nothing you type leaves your browser — is a promise about the calculators. It is absolute there, and it is the reason this site has no accounts and no Copy Link buttons.

It is not a claim that nothing on the site transmits anything, because two things deliberately do, and always have: the contact form and the newsletter. Both are opt-in, both are described in full below, and neither is ever pre-filled from anything you typed into a calculator. Scenario values do not cross that line on their own — if a number is ever transmitted, it is because you typed it into a form that named it.

We are stating the boundary now, while there is nothing on the other side of it worth arguing about. A promise that quietly narrows later is worth less than a narrower promise kept.

Calculator inputs

Every calculator on this site — the flagship in-hand projector, SIP, Lumpsum, SWP, FD, PPF, EPF, NPS, the home loan and retirement gap calculators, the cross-border RNOR and PFIC screens, and the Intelligent Mode Kaafi Score dashboard — stores your inputs only in your browser tab's memory(sessionStorage). We do not put them in the URL, do not send them to any server, do not store them in any database, and do not log them anywhere. When you close the tab, they are cleared automatically. There are also “Clear my data” controls where relevant, so you can wipe your inputs mid-session (for example, before handing your device to someone else).

Response headers we set

As additional defence in depth, we set Referrer-Policy: no-referrer on every page — your browser will never send our URL to any external site you navigate to from here. We also disable browser ad-tech surfaces we do not use (Chrome's Topics API, FLoC, ad-interest groups, attribution reporting) via a strict Permissions-Policy header, and enforce HTTPS-only browsing via Strict-Transport-Security.

Cookies · explicit

KitnaKaafi does not set any cookies. No analytics cookies, no advertising cookies, no cross-site tracking, no fingerprinting. The site does not use any browser-storage mechanism other than your tab's sessionStorage (which we've already explained above, and which never leaves your tab).

You will not see a “cookie banner” on this site because we have nothing to consent to. If your browser's developer tools show any cookie on this domain, please tell us via the grievance process — we'll treat it as a bug.

Third-party processors we use

Some services on this site — the contact form, the newsletter, the site itself, and the optional AI explainer — are operated with the help of the data processors listed below under Section 8(3) of the DPDP Act. Each is bound by our processor agreement and processes data only on our instructions.

Cross-border transfer: Vercel, Upstash and the AI model providers (Anthropic, OpenAI, Google) process data in the United States. The AI providers receive only tokenised placeholders and coarse bands — never a rupee amount — under zero-retention / no-training contractual terms. The agent service that orchestrates the AI explainer runs in India (asia-south1, Mumbai). Under Section 16 of the DPDP Act, transfer outside India is permitted unless the Central Government notifies a country to the contrary. No such notification currently applies to the United States.

The AI explainer (optional)

KitnaKaafi has an optional AI feature that narrates a projection you are looking at — it explains the numbers in plain words. It isdisabled by default, and every calculator on this site works fully without it. If you never turn it on, nothing in this section applies to you.

When you do use it, your actual amounts never leave your browser. Before any request is sent, a transform running on your own device replaces every rupee figure with an opaque placeholder — your ₹1,20,000 becomes [[AMT_3]] — tagged with a coarse band such as ₹10–25L. The AI service sees only these placeholders, the bands, and dimensionless ratios (for example, “the equity sleeve carries 36% of your income”). It never sees a rupee amount, and never sees anything that identifies you.

A band leaks something — we say so. A band is a bracket, not a point, but it still narrows a value to a range, and a band combined with several rounded ratios narrows it further than a band alone. This is the honest cost of the design, and we do not bury it. It is mitigated, not claimed away: every band spans at least a factor of two so it can never pin a single figure, ratios are rounded to one or two significant figures, and bands are never combined into a single key.

The map that turns [[AMT_3]] back into ₹1,20,000 is written to your browser tab's memory and is never transmitted. Neither KitnaKaafi nor any AI provider ever holds it, so neither can reverse the placeholders back to your real figures — only your own browser can, at the moment it displays the answer to you.

Retention. A conversation's working state is held for at most 45 minutes and then discarded; while it lives, it is stored as tokenised text, a configuration hash, and a salted hash of your IP address — never a rupee amount, never your actual IP. Diagnostic traces are redacted at source. The audit trail we keep for compliance holds only hashes and version identifiers — never the text of your conversation.

Contact form

When you send a message through /contact, we collect your email address (required, so we can reply), your name (optional), a topic, and the message itself. This data is emailed to us and is not stored in any database or shared with third parties. We use your email only to reply to your message; we do not add it to any marketing list. To spam-throttle the endpoint, we store a hashed version of your IP address for up to 24 hours; the original IP is never recorded.

Newsletter

When you subscribe to our weekly newsletter through the footer form or the /newsletter page, we collect only your email address (data minimisation per the Digital Personal Data Protection Act, 2023). We use double opt-in — you must click a confirmation link before you are added to the list, so nobody can subscribe you without your consent. Your email is used only to send you the weekly newsletter; we do not share it with anyone or use it for any other purpose. Every email includes a one-click unsubscribe link; using it removes your address from our lists.

Subscriber storage and email delivery is handled by Brevo (a European email service provider). Their privacy policy covers how they process the data on our behalf.

If you are in the United States

The cross-border calculators are written for people living in the United States, so state consumer-privacy laws apply to them — California's CCPA as amended by the CPRA, and the comparable statutes in Colorado, Connecticut, Virginia, Texas, Oregon, Montana and others. Three statements cover most of what they ask:

• We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no “Do Not Sell or Share” link because there is nothing behind it.
• We do not profile you in any way that produces legal or similarly significant effects, and we do not do targeted advertising.
• The only personal information we hold is what the table above describes: an email address if you subscribed, and the content of a message if you used the contact form. Nothing you type into a calculator is collected, in any state or country.

The rights to know, delete, correct, and appeal a refusal are exercised through the pre-written templates on the grievance page — the same mailto pattern as the DPDP rights, because a form endpoint for privacy requests would itself be a new place we collect data. Response window: 45 days, extendable once by a further 45 for a complex request, with notice inside the first 45.

Sensitive personal information as those statutes define it is not collected here at all, so the right to limit its use has nothing to operate on.

Your rights under DPDP Act, 2023

As a data principal you have the right to access, correct, and erase any personal data we hold about you, and to lodge a grievance about how we handle it. To exercise any of these rights — with pre-filled request templates so you don't have to know the statute chapter and verse — please use the dedicated grievance page:

→ Grievance redressal & rights request page

Direct contact for the Grievance Officer: Nitin Goswami · nitin.goswami@gmail.com.

Response time commitment

We commit to acknowledge any formal grievance within 15 days and to resolve it within 30 days, per Section 8(9) of the DPDP Act, 2023. If your grievance is not resolved within the statutory window, you may escalate to the Data Protection Board of India (constituted under Section 18 of the Act) — see the grievance page for the exact escalation path.

Not investment advice

KitnaKaafi is an illustrative calculator. It does not know you and does not give personalized investment recommendations. For your specific situation, please consult a SEBI-registered investment adviser.