Legal

Privacy Notice

Last updated 27 October 2026 · Version 2026-10-27

Koot is built so that your content never reaches our servers. This notice explains the small amount of information we do handle, why, and what you can ask us to do with it.

In plain words. We keep your name, email and organisation to run your account, and basic connection records so devices can find each other. We never receive your messages, files, calls, documents, drawings or tasks. Relay providers, email delivery and hosting are the outside services involved.

01Who is responsible

Gamisya Enterprises, India ("Gamisya", "we") decides why and how the account and connection information described here is handled. Your content is not held by us; your organisation decides what it keeps on its devices. For questions or requests, write to contact@gamisya.com.

02What we collect and why

Information	Why
Signup details: your name, email, optional phone, organisation name, team size, intended use	To verify your email, create and run your trial or account, contact you about it and give support.
Agreement record: which terms version you accepted, when, and from which internet address	To show that the terms were accepted.
Account records: organisation name, seats, status, trial dates; each member's random device ID, display name, role, join and last-seen times, reporting line; invite codes (kept only as irreversible hashes); the internet address used when an invite code is redeemed	To run seats and roles, let the right people in and keep others out.
Connection records: when a device is online, its display name and random device ID, the type of network, and which devices ask to connect to which	To introduce devices to each other. Held in the server's memory while you are connected and written to operational logs (see Retention).
Usage counts: how many times a device ID checked in each day	To understand how much Koot is used and to plan capacity.
Relay usage: how many bytes an organisation sent through relay servers, if cross-network access is on	To apply the relay allowance and plan costs.
Emails we send you: verification code, welcome message, notices about your account	To run the signup and account.

We rely on your consent (which you give when you sign up) and on what is needed to provide the service you asked for.

03What we do not collect

We do not receive the content of your messages, files, calls, documents, drawings or tasks. They are encrypted on your devices and travel between them. The server may hold, for up to 24 hours and only in memory, encrypted task and document updates addressed to someone who is offline; we cannot read them.

We do not use advertising or tracking cookies, and we do not use third-party analytics.

04Where your content lives

On your organisation's devices, in the browser's storage or in folders you choose. Clearing a browser's site data removes that device's copy. Your organisation can set up backups or its own storage; ask us if you would like help.

05Who we share information with

Hosting provider, which runs our servers and database.
Email delivery provider, which sends the messages described above.
Relay providers (at present Metered, ExpressTurn and Twilio), only if cross-network access is on. When a connection goes through a relay, the provider sees internet addresses, timing and the volume of encrypted traffic, not its content.
AI services, only if your organisation connects them. We are not a party to that.
Authorities, where the law requires it, limited to the information we hold (see Report misuse and legal requests).
A successor, if our business is transferred, on the same terms as this notice.

We do not sell personal information.

06Transfers outside India

Relay and email providers may process information in other countries. They are bound by their own terms with us and, for relay, can only see encrypted traffic.

07How long we keep it

Unfinished signups (email never verified): deleted after 30 days.
Account and signup records: while your account is open, then deleted on request within 30 days, or kept for up to 12 months after closure where we need them for accounts, disputes or the law.
Operational logs (connection and administration events): 180 days.
Usage counts: kept as long as the device ID is active.

08Your rights

You may ask us to tell you what we hold about you, correct it, delete it, or stop using it, and you may withdraw your consent. You may also nominate someone to act for you and make a complaint. Write to contact@gamisya.com; we aim to answer within 30 days. If you are a member of an organisation, your organisation's administrator controls your seat and may be the better first contact.

If we cannot resolve a complaint, you may approach the Data Protection Board of India once it is operating.

09Security

Content is encrypted on your devices (ECDH P-256 key agreement, AES-256-GCM). Invite and verification codes are stored only as hashes. We limit how often codes can be requested and guessed, and we separate account records from usage counts. No system is perfectly secure. If a breach affects your information we will tell you and the authorities as the law requires.

10Children

Koot is for workplaces and is not meant for anyone under 18. We do not knowingly collect information from children.

11Browser storage

Koot stores settings, your device's identity and your content in your browser's local storage and IndexedDB, on your device. This is what lets it work without a message database on our side. It is not shared with advertisers or used to track you across sites.

12Changes and contact

We may update this notice and will change the date above. If a change is material we will tell your administrator by email.

Grievance Officer, Gamisya Enterprises: contact@gamisya.com. We acknowledge a complaint within 24 hours and aim to resolve it within 15 days.