/ Privacy

Privacy Policy.

Last updated: July 2026 — version 2.2

In short

Kapota is a proximity-first social, commerce, and civic communication platform operated by Kapota, Inc. To make proximity work, we collect approximate location and Bluetooth signals. To make conversations work across languages, we translate messages through a secure pipeline. We do not sell your data, ever. You can delete your account anytime, and your data goes with it.

1. Who we are

Kapota, Inc. ("Kapota," "we," "us," "our") provides a proximity-based platform that connects nearby people, businesses, and cities. This Privacy Policy describes how we handle personal information collected through our mobile applications (iOS and Android), our website at kapota.app, and related services (collectively, the "Service").

2. Information we collect

2.1 Account information

When you create a Kapota account, we collect:

  • Name and display photo
  • Email address
  • Optional profile fields: bio, gender, date of birth (used to confirm you are 18+), profession, interests, languages spoken, preferred language
  • For business accounts: business name, hours, photos, business location, contact info
  • For city accounts: municipal affiliation, official role, jurisdiction

2.2 Location and proximity data

Proximity is the core of Kapota, so we collect location data with your permission:

  • Approximate GPS location — used to find nearby people, groups, deals, and city posts. Stored as approximate coordinates encoded for spatial queries (geohashes), not as continuous tracking history.
  • Bluetooth Low Energy (BLE) identifiers — your device broadcasts and scans for short-range Bluetooth signals to detect users physically near you (~10 meters). BLE identifiers are rotated regularly and not used for cross-app tracking.
  • Coarse location for posts — when you create a group, post a deal, or share a Pulse, the location is associated with that content so nearby users can find it.

You can disable Bluetooth and Location permissions at any time via your device settings. Disabling them limits or disables proximity features.

2.3 Content you create

  • Messages you send (direct, group, and chat)
  • Groups you create or join
  • Pulse posts (personal status updates)
  • City announcements (for city accounts)
  • Deals and marketing flyers (for business accounts)
  • AI prompts you submit to generate Group Cards, marketing flyers, or city flyers
  • Connection requests (waves) sent and received

2.4 Translation data

When you have message translation enabled, the direct messages you send and receive are processed through a translation pipeline that calls Google Cloud Translation. Group messages and city announcements are translated into your preferred language through the same pipeline when you read them, whether or not that setting is on. The text content is sent to Google for translation. Translated copies are stored on the content they belong to — on the message in a direct or group chat, and on the post itself for a city announcement. Each language is translated once, and that copy is shared by everyone who reads in that language: a translation produced for one reader is stored on the content and shown to others who read in the same language. We do not retain translation request logs beyond operational caching.

2.5 AI-generated content data

When you generate AI Group Cards, marketing flyers, or city flyers, your prompt text is processed through generative AI services to produce the image. The generated image is stored on your account. We retain prompt history for usage tracking and rate-limit enforcement only.

2.6 Usage and device data

  • Device type, OS version, app version
  • App interaction events (which features are used, anonymized aggregate)
  • Crash reports and diagnostic logs
  • Push notification tokens (Apple Push Notification Service, Firebase Cloud Messaging)

2.7 Subscription data

Subscription tier (Free, Pro, Premium, City Pro, Business Pro, Business Premium) is associated with your account. Payment processing is handled entirely by Apple App Store or Google Play. Kapota never sees or stores your payment card information.

2.8 Interaction and engagement data

When you use certain features, we record interactions between users:

  • Profile views — when you view another user's profile, that view may be recorded and shown to them if they have a Premium subscription ("see who viewed your profile"). Likewise, other users' views of your profile may be visible to you with a Premium subscription.
  • Read receipts — we record when messages and connection requests are read, which may be shown to the sender (a Premium feature).
  • Connection activity — connection requests (waves), connections, and engagement between accounts.

2.9 Revenue pool data (if applicable)

Certain premium subscribers may become eligible for the Kapota revenue pool. If you qualify and choose to join, we process subscription transaction identifiers, your app store storefront country, and payout-related information under separate Revenue Pool Terms, which you must separately review and accept. Participation is optional and governed by those terms.

3. How we use your information

  • Proximity discovery: matching you with nearby people, businesses, deals, groups, and city posts based on your approximate location and BLE signals.
  • Communication: delivering your messages, translating them when enabled, and storing the conversation history.
  • Content distribution: showing your posts to nearby users and showing nearby content to you.
  • Automated deal delivery (business accounts): if a business enables automation, Kapota automatically creates and sends that business's deals to relevant nearby customers on a recurring schedule, based on targeting the business configures. Businesses authorize this and can disable it at any time.
  • Personalization: filtering discovery by your interests and language preferences.
  • Notifications: alerting you to messages, connection requests, city emergency alerts, and relevant deals.
  • Service operations: maintaining account security, preventing abuse, debugging, and improving features.
  • Legal compliance: meeting regulatory and law enforcement requirements when applicable.

We do not use your data to train third-party AI models. We do not show you ads based on your data. We do not sell your data to anyone, ever.

4. How we share information

4.1 With other users

Your profile (name, photo, bio, interests, languages, approximate distance) is visible to nearby Kapota users when you appear in their discovery feed. You can use Incognito Mode (a Premium feature) to browse without appearing.

4.2 With service providers

We use trusted infrastructure providers under strict data-processing agreements. These include:

  • Google Firebase — authentication, real-time database, push notifications, cloud functions
  • Google Cloud Storage — image and media storage
  • Google Cloud Translation — translation of direct messages, group messages, and city announcements
  • Generative AI providers — image generation for Group Cards and marketing flyers
  • Apple Push Notification Service — iOS notifications
  • App Store / Google Play — subscription management

4.3 For legal reasons

We may disclose information if compelled by legal process, to protect the safety of our users or the public, or to enforce our Terms of Service.

4.4 In a corporate transaction

If Kapota is involved in a merger, acquisition, or sale of assets, your information may transfer to the successor entity, subject to this Privacy Policy. You will be notified.

5. Your rights and controls

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate information through your profile settings
  • Delete your account and associated data via Settings → Account → Delete Account, or by emailing privacy@kapota.app. Deletion is processed within 30 days, with a 7-day grace period during which you can cancel the request.
  • Export a machine-readable copy of your data by emailing privacy@kapota.app
  • Restrict or object to certain processing
  • Withdraw consent at any time (this may limit functionality)
  • Lodge a complaint with your local data protection authority

For California residents (CCPA/CPRA): you have the right to know what personal information we collect, the right to delete it, and the right to opt out of any sale (we do not sell data). To exercise these rights, email privacy@kapota.app.

For EU/EEA/UK residents (GDPR): Kapota is the data controller for personal information you provide. Our legal bases are: contract performance (to provide the Service), legitimate interests (to maintain and improve the Service), and consent (for optional data such as location). Contact privacy@kapota.app to exercise GDPR rights.

6. Data retention

We retain personal data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data: until account deletion + 30-day cleanup window
  • Messages: stored until either party deletes them or accounts are deleted
  • Location/BLE data: aggregated into geohashes; raw GPS coordinates are not retained beyond the active session
  • Logs and diagnostics: 90 days
  • Subscription records: as required by tax and accounting law (typically 7 years)

7. Security

We use industry-standard security: encrypted data in transit (TLS 1.2+), encrypted data at rest, scoped Firestore security rules, secure authentication via Firebase Auth and OAuth providers, and access controls on internal systems. No system is perfectly secure, and we cannot guarantee absolute security. Suspected security issues should be reported to security@kapota.app.

8. Children's privacy

Kapota is not directed to anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has provided us with information, please contact privacy@kapota.app and we will promptly delete it and disable the account.

9. International transfers

Kapota is operated from the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US. By using the Service, you consent to this transfer. For EU/EEA/UK users, transfers are governed by Standard Contractual Clauses where applicable.

10. Cookies and tracking

The Kapota website (kapota.app) uses minimal essential cookies for site functionality. We do not use advertising cookies or third-party trackers on the marketing site. The mobile app does not use web cookies.

11. Changes to this policy

We will update this Privacy Policy as the Service evolves. Material changes will be communicated via in-app notification or email at least 30 days before taking effect. The "Last updated" date at the top of this page indicates when revisions were last published.

12. Contact us

For privacy-related questions, requests, or complaints:

Kapota, Inc. — United States