What we know, and who can see it.

Karmic is a public reputation network. Anyone with an account can give Good Karma or Bad Karma — a signed number and a short public note — to a “Soul”: a page about a person, a business, a product, a brand, a place or a vehicle. Souls exist so that karma has somewhere to land; they can be created by the first person who gives karma, and later claimed by the person or organisation they are about.

Because of this, Karmic necessarily processes information about people who do not have an account. This policy explains what we collect from account holders, what we hold about non-users, and how either group can control it. It is written to comply with India’s Digital Personal Data Protection Act, 2023 (DPDP) and, for people in the European Economic Area and the UK, the GDPR.

Karmic is operated by WebCastle, Kochi, Kerala, India (the “data fiduciary” under DPDP; the “controller” under GDPR). Contact for anything in this policy, including grievances: karmic@webcastle.in.

Account data. Name, email address, password hash (never the password), optional phone number, optional profile photo, and the sign-in provider you use (email, Google or Apple). If you sign in with Google or Apple we receive your name, email and avatar from them.

Your Soul and its attributes. Things you add or confirm about yourself — where you work, what you drive, where you live, your profession, and so on. Every attribute has its own visibility: Public (shown on your Soul page and used to tell you apart from people with the same name) or Private (never shown to anyone but you). You choose per attribute and can change or delete each one at any time from My Soul.

The karma ledger. Every karma event: who gave it, which Soul received it, the sign and amount, the public note, when it happened, and a salted hash of the giver’s IP address (kept for abuse detection; the raw IP is not stored on the ledger).

Contact imports. If you choose to import Google Contacts we read, once, the names, email addresses, photos, organisations and cities of the contacts you select. We keep the names (as unclaimed Souls, or matched to existing ones), the company and city as public hints on those Souls, and a one-way hash of each email address so a friend can be matched to their Soul if they later join. Raw email addresses of non-users and photos are not stored. The Google access token lives only in an encrypted browser cookie for under an hour and is never written to our database.

Invites. When you invite someone by email, we store the address in order to send one invitation and to avoid sending a second. The address is never shown publicly.

Logs and technical data. Request logs (URL, timestamp, status, rough IP-derived rate-limit counters), error reports, and the device / browser type. We do not use advertising trackers.

AI processing records. The text you submit for interpretation (see section 6), the model used, its response, and token counts — kept so we can audit decisions and detect abuse.

For account holders — consent and contract. You create an account, accept the Terms of Use and this policy, and choose what to add to your Soul. Under DPDP this is consent for a specified purpose; under GDPR it is performance of a contract (Art. 6(1)(b)) and consent (Art. 6(1)(a)) for optional features such as contact import.

For public Souls about people without an account — legitimate interest, with safeguards. A Soul about a non-user contains at most a name, public hints (city, profession, employer) supplied by other users, and public karma notes written by identifiable account holders who are responsible for what they write. We rely on the legitimate interest of users in recording and sharing genuine experiences (GDPR Art. 6(1)(f)) and, under DPDP, on the publicly-available and reasonable-expectation grounds together with these safeguards: notes must be factual and fair (Terms §4), moderators can reverse or remove anything, private attributes are never shown, and anyone can have a Soul about themselves removed without creating an account (section 9).

Legal obligation and vital interest. We may process data to comply with law, respond to lawful requests, or prevent harm.

• Public: a Soul’s name, its karma total and good/bad ratio, public attributes, public locations, and every karma note together with the giver’s display name. Notes are public whether the karma is good or bad. Assume anything you write in a note will be read by the person it is about and by anyone else.
• Private: your email, phone, password hash, private attributes, the reasons behind inherited karma, contact-import hashes, invite addresses, and IP-derived data.
• Private attributes influence karma privately. Karma given to a company or a car can flow to the people connected to it. If that connection is one of your private attributes, other viewers see only the number (“+1 Karma”); the reason it reached you is shown to you alone. We do not reveal private attributes through ranking, search, or disambiguation either — same-name people are told apart using public attributes only.
• Discoverability. You can remove your own Soul from search and directories in Settings → Privacy; your Soul page still exists at its address.

Karmic uses large language models to interpret text you submit — a sentence describing karma, or the answer you paste during profile setup — and to classify entities and detect abuse. Requests are sent to OpenRouter (a model gateway) and on to the model provider it routes to; the text you submit is what leaves our servers, together with no account identifiers beyond what is in the text itself.

The AI only proposes. Every proposal is validated against a schema and then decided by Karmic’s own rules engine; nothing goes from a model straight to the database. Profile extraction is never published until you confirm each item, and items that look like personal information are locked to Private by default. Do not paste anything you would not want a third-party model to read.

• Infrastructure providers that host the application, database, cache and queues, under data-processing terms.
• OpenRouter and the model providers it routes to, for AI interpretation (section 6).
• Email delivery providers, for verification codes, invites and removal confirmations.
• Google and Apple, only when you choose to sign in with them or import contacts.
• Authorities, where required by law.

We do not sell personal data and do not share it with advertisers.

• The ledger is retained. Karma events are the record every Soul’s balance is computed from, so they are kept for as long as Karmic operates. When a person is removed or an account deleted, the events are anonymised — detached from the name and profile — not erased.
• Account data is kept while your account exists and removed (or irreversibly anonymised) when you delete it.
• Attributes, locations and relationships are kept until you change or delete them, or delete your account.
• Contact-import hashes are kept until the matching Soul is claimed or removed, or you delete your account.
• Verification and removal codes expire within minutes; invite records are kept to prevent duplicates.
• Logs and AI records are kept for up to 12 months for security and audit, then deleted or aggregated.

If a Soul is about you and you never claimed it, you can have it removed without signing up. On the Soul page follow “This is you and you want it removed?”, enter an email address, and confirm the six-digit code we send. The Soul then stops being shown anywhere, immediately. This is a soft delete: a moderator is notified and reviews it, and the anonymised ledger record remains (section 8). If the request was a mistake, reply to the confirmation email and we will restore it.

If the Soul has been claimed by an account — yours or someone else’s — the email route is not available: delete your own account from Settings, or report the Soul so a moderator can act on impersonation.

Whether or not you have an account, you can ask us to access, correct, erase or restrict personal data about you, to withdraw consent for optional processing (which does not affect what happened before), and to object to processing based on legitimate interest. Account holders can do most of this directly: edit or delete attributes in My Soul, change visibility, turn off discoverability, or delete the account in Settings. For anything else, or to nominate someone to act for you under DPDP, email karmic@webcastle.in. We aim to respond within 30 days. You may also complain to the Data Protection Board of India or, in the EEA/UK, your local supervisory authority.

Karmic is for adults. You must be at least 18 to create an account, and users must not create Souls about people they know to be under 18. If we learn that a Soul is about a minor, or that an account belongs to one, we remove it. Parents or guardians can write to karmic@webcastle.in.

Passwords are hashed with bcrypt. Traffic is encrypted in transit. Short-lived signed tokens authenticate every internal request. Sensitive operations are rate-limited, every important action is written to an audit log, and IP addresses reach the ledger only as salted hashes. No system is perfectly secure; if you believe your account has been compromised, change your password and tell us.

Our providers may process data outside India, the EEA or the UK. Where they do, we rely on their contractual commitments and, for GDPR-covered data, standard contractual clauses or an adequacy decision.

We will post any material change here and update the date at the top. For significant changes affecting account holders we will also notify you in the app or by email before they take effect. Continuing to use Karmic after that date means the new version applies.