Privacy Policy

KUHA ("the app") is a shared, disposable-camera experience for events. This policy explains what personal information we collect when you use KUHA, why we collect it, and the choices you have. We've tried to write this in plain English — if anything is unclear, write to us at hnscorpph@gmail.com.

1. Who we are

KUHA is operated by HNS Corp. ("we", "us", "our"), a company registered in the Republic of the Philippines, with its principal office in Metro Manila. For the purposes of the Data Privacy Act of 2012 (R.A. 10173) and the GDPR (where it applies), HNS Corp. is the data controller for personal information processed through KUHA.

You can reach our Data Protection Officer at hnscorpph@gmail.com.

2. What we collect

We collect only what we need to make the app work. Specifically:

A. Information you give us

• Hosts. Event name, reveal mode, shots-per-guest setting, and a 4-digit host PIN (stored only as a one-way hash — we never see the plaintext PIN).
• Guests. A first name or display name you type when joining an event. You do not need an account to join.
• Photos. Any photo you take inside the app, with the in-app film effects applied. These are uploaded to the event's shared roll.
• Optional account email. If you sign up as a recurring host, we collect an email address to allow account recovery and to send transactional messages (event summaries, security notices). We do not send marketing email without your separate consent.

B. Information collected automatically

• Device identifiers. A random per-install identifier used to maintain your session and prevent abuse. This is not your Android Advertising ID.
• Diagnostic data. Crash logs, OS version, app version, and approximate region (country-level), used to fix bugs.
• Usage events. Aggregate counters such as "events created", "photos taken" — used to understand product health, not to profile individuals.

C. Information we do NOT collect

• We do not collect precise location. KUHA does not request location permissions.
• We do not collect contacts.
• We do not collect microphone audio.
• We do not access photos in your camera roll outside of the KUHA app.
• We do not use the Android Advertising ID and we do not serve ads.

3. How we use data

We use the information described above for the following purposes:

• To run the service. Match guests to events, upload and display photos, enforce shot limits, time-lock the roll for delayed reveal, allow hosts to moderate.
• To keep the service safe. Detect abuse, prevent spam, and respect host moderation actions.
• To improve the app. Diagnose crashes and bugs, decide which features to build next.
• To communicate with hosts. Send transactional emails such as event summaries, PIN-reset codes, and security notices.
• To comply with the law. Respond to valid legal requests and protect our rights and yours.

We do not sell your personal information, and we do not use your photos to train machine-learning models.

4. Who we share data with

We share data only in these limited cases:

• Other event participants. Photos you take are shown to other guests of the same event, with your chosen display name. This is the core function of the product.
• The event host. Hosts can see all photos in their event regardless of reveal state, and can delete photos.
• Service providers acting on our instructions. Cloud hosting and storage (object storage providers in Singapore / Philippines), email delivery, and crash reporting. These vendors process data only to provide the service to us, under written contracts.
• If required by law. We may disclose information when we believe in good faith that disclosure is required by a valid legal process.
• Business transfers. If HNS Corp. is acquired or merges with another entity, your information may be transferred — but it remains subject to this policy or a successor with equivalent protections.

5. How long we keep your data

• Photos and event data. Retained for 30 days after an event is closed by the host, then permanently deleted from our active systems. Backups containing the data are purged within a further 30 days.
• Host accounts. Retained while the account is active. If you delete your account (see Delete Account), all associated personal data is deleted within 30 days.
• Diagnostic and aggregated usage data. Retained for up to 14 months in identifiable form, then anonymized.
• Legal records. We may retain limited records (e.g., abuse reports) longer where required by law.

6. Your rights

Under the Data Privacy Act of 2012 (Philippines) and, where applicable, the GDPR, you have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Ask us to fix inaccurate or incomplete data.
• Deletion. Ask us to delete your account and associated data. See delete-account.html for the in-app and web flow.
• Objection / Restriction. Object to or restrict certain processing.
• Portability. Request an export of your photos in a standard format.
• Withdraw consent. Where we rely on consent, you can withdraw it at any time.
• Complain. Lodge a complaint with the National Privacy Commission of the Philippines (privacy.gov.ph) or your local supervisory authority.

To exercise any of these rights, email hnscorpph@gmail.com. We respond within 15 working days.

7. Security

Photos and personal data are transmitted over TLS 1.2+. At rest, photos are stored encrypted with industry-standard symmetric encryption. Host PINs are stored as one-way hashes (Argon2id) and are never recoverable in plaintext. We follow the principle of least privilege internally.

No system is perfectly secure. If we ever become aware of a personal-data breach that meaningfully affects you, we will notify you and the National Privacy Commission within the timelines required by law.

8. Children

KUHA is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

For users between 13 and the age of majority in their jurisdiction, we recommend reviewing this policy with a parent or guardian. Hosts must be 18 or older.

9. International transfers

Our primary data infrastructure is hosted in Singapore and the Philippines. If you use KUHA outside these regions, your personal data will be transferred to and processed there. Where required (e.g., for users in the EU/UK), we use standard contractual clauses or equivalent safeguards.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we'll update the "Last updated" date at the top of this page and, where appropriate, notify hosts by email. Continued use of KUHA after the effective date constitutes acceptance of the revised policy.

11. Contact us

Questions or requests? Write to us.

HNS Corp.
Data Protection Officer
hnscorpph@gmail.com
Metro Manila, Philippines