Privacy Policy

Effective 2026-09-27 · Version 2026-10-02 · Contact tanqt18biz@gmail.com

This English version is provided for convenience. The Simplified Chinese version is the binding text; if the two differ, the Chinese version prevails.

Scope: Malaysia · Singapore

Contact: tanqt18biz@gmail.com (also the contact for Malaysian PDPA matters and the Data Protection Officer contact under the Singapore PDPA)

The short version

• We do not sell your data, and we do not hand it to anyone outside the platform to use for their own ends.
• What we collect is mostly what makes Kira work: your account, what you post, who you interact with, and whether the app is behaving.
• You can export or delete your data from Settings at any time. Deleting an account has a 30-day cooling-off period, so you can change your mind.
• The full text follows. It is detailed because Malaysian and Singaporean law require it to be, not because there is anything to hide.

1. Who we are and who this Policy applies to

Kira (operated by TECH CAT LABS (a business registered in Johor, Malaysia, registration no. 202403103398 / 003594732M), "we", "us") is an event and social platform for the cosplay and related creative community. This Policy explains what personal data we collect, why, how we use it, who we share it with, where it is stored, how long we keep it, and the rights you have.

• Kira is for users aged 18 or over; you declare that you are 18 or older when you register. We do not target minors and do not knowingly collect their data.
• Registration may be by invitation during some periods. Accounts that joined early with an invite code carry a publicly visible "✦OG" mark, and we keep a record of which batch of invite codes you joined with, to manage invitations and that mark.
• Ticking the consent box at registration means you consent to the processing described in this Policy. We record when you made your 18+ declaration and gave your consent.

2. Basic data we collect

• Account data: e-mail and password (how you sign in; the password is stored salted and hashed, and we cannot read it), phone number (verified by SMS code when you register, then used to recover your account and for security notices), username, nickname, avatar/cover image, profile details you choose to provide (region, bio, role profiles, friend card, etc.), the time of your 18+ declaration and consent, and the invite-code batch you joined with (if any).
• Content data: posts, Looks, comments/danmaku, chat messages, voice notes and media you upload.
• Transaction records: Starlet purchases (payment is handled by Apple or Google; we receive only receipt data for verification, never your card number), records of cheers (tips) and of exclusive content you unlock, and creator-earnings applications, earnings and withdrawal records (including the payout account details you give us for withdrawals).
• Safety records: reports, blocks, sanctions and appeals, used for platform safety and dispute handling.
• Reports and enquiries: reports you file (including the reported content and your note), enquiries you send to creators or sellers, and e-mails you send us.
• Invitation requests: the e-mail address, phone platform, region and the optional nickname and source you give when you request an invitation on the Kira website (kira.fans), used only to review and send invitations; deleted within 12 months of submission unless the address has registered an account.
• Device and technical data: device model, OS version, app version, language, push token, a per-install device identifier, IP address (which may reveal your approximate country or city), crash and performance diagnostics.
• We do not collect your precise (GPS) location, and we do not read your contacts, your photo library (other than files you choose to upload) or other apps.

3. Usage and engagement data

To operate the product and provide data features to you and to creators, we record how you use and interact within Kira, including:

• Profile visits: who visited your profile page and whose you visited (with time and entry source). Note: "invisible browsing" (a membership feature) is a display-layer privilege — when enabled, you do not appear in the other person's list, but the visit record itself is still created and kept (for billing, safety and features). Invisible does not mean unrecorded.
• Content reach and engagement: how often and how widely your content is viewed or shown; the fact of your views, likes, comments, shares and other interactions. Posts show a public view count to all users.
• Notification data: acceptance, opening and tapping of system push notifications.
• Search and discovery: app opens, search terms, entry sources, follow sources. Search terms are kept only briefly (days); afterwards only the anonymous fact that a search occurred is retained.
• Retention: raw event records are kept for at most 90 days; statistics aggregated from them (such as visitor summaries and reach counts) are kept long-term as product data, always subject to the deletion right in section 7.

4. How we use this data

• to provide and improve product features (including data features such as "who viewed me" and creator dashboards, some of which are membership features);
• to perform our agreement with you: account management, invitation management, Starlet and cheer settlement, reviewing creator-earnings applications and paying creator earnings;
• for platform safety: anti-abuse, anti-fraud, handling reports and enforcing community rules, verifying age declarations;
• for product analytics and experience optimisation: we use third-party analytics and crash-reporting tools to process internal product telemetry; that telemetry is not used to show your behaviour to other users;
• to promote the Service: showing examples of public content from the Service on app-store pages or in promotional material (see Terms of Service section 4); you can contact us at any time to ask us to stop using your content;
• to communicate with you: service notices, security alerts, policy changes;
• to comply with legal obligations and lawful requests from authorities.

5. Who we share data with

We do not sell your personal data, and we do not give it to third parties for their own purposes. To run the Service we engage the processors below; they may process data only for the purposes we specify and are bound by the corresponding data-processing terms. The list is the one in use today; we may move to a different provider of the same kind of service, with the same purposes and limits:

• Supabase: login and identity authentication (e-mail, phone number, secure storage of login credentials).
• eSMS (Malaysia): delivery of SMS verification codes. To get the code to you we pass it your phone number and the message text; it processes them only to send that message.
• Oracle Cloud (Singapore region): hosting of application servers and databases.
• OVH (European Union): storage of encrypted backups.
• Expo: delivery of push notifications.
• Sentry: crash reports and error diagnostics.
• PostHog: product usage analytics (internal telemetry).

We also use the following services, which process data under their own terms and privacy policies:

• Telegram: instant delivery of operational notices, such as reports and enquiries, to our operations staff; these may include an excerpt of the reported content, the usernames involved and links. We use it only to handle those notices.
• Google (Gmail): our contact mailbox is hosted on Gmail, so e-mails you send us (including rights requests and deletion requests) are processed by Google.
• Apple App Store / Google Play: app distribution and payment processing for in-app purchases.

• Other users: your public profile, public content, the "✦OG" mark and the display data described in section 3 (such as visitor lists and view counts) are visible to other users as the features are designed. You can control some of these through your privacy settings.
• Legal requirements: we may disclose data where required by law, by a lawful request from a court or regulator, or where necessary to protect the rights and safety of us, our users or the public.
• Business changes: in a merger, acquisition or asset transfer your data may be transferred as part of it; we will notify you before the transfer.

6. What we do not do (firm commitments)

• We do not sell your personal data, and we do not give it to third parties for their own purposes. "Data products" means only statistics and insight features provided to you or to creators within Kira, and never includes providing personally identifiable data to third parties outside the platform.
• We do not serve advertising based on third-party profiling (if advertising is ever introduced, this Policy will be revised and the change announced prominently).
• Kira is not for anyone under 18, and we do not knowingly process minors' data; if we find an account belonging to a minor, we deactivate it and delete its data as described in section 7 (except records the law requires us to keep).
• We do not collect precise (GPS) location.

7. Your rights (PDPA)

• Access/export: from your registered e-mail address, write to tanqt18biz@gmail.com to request a copy of the personal data we hold about you (including the usage and engagement data in section 3).
• Correction: you can correct your profile data at any time.
• Deletion: you can delete your account in the app (30-day cooling-off period, reversible) or, if you cannot log in, request deletion by e-mail from your registered address — see the Account Deletion page. Once deletion completes, your identity data is anonymised, the content and media you posted are deleted (chat messages you sent to others excepted — see the Account Deletion page), and your engagement records (including rows about you in visitor/reach aggregates) are deleted or de-linked.
• Withdrawing consent: withdrawal means stopping use of Kira and deleting your account; some records kept to meet legal obligations (such as safety-sanction audit trails and transaction records) are retained, de-identified and with restricted access, for the statutory period.
• Exercising rights or complaints: contact tanqt18biz@gmail.com. We answer within the period the applicable law allows (the Malaysian PDPA and the Singapore PDPA each set one), and sooner where we can; you also have the right to complain to the personal-data protection authority where you live.

8. Storage, cross-border transfer and security

• Your data is stored on cloud servers under our control located in Singapore; encrypted backups are stored in the European Union. By using Kira you consent to the transfer and storage of your data outside Malaysia and Singapore for these purposes. We take a provider's data-protection standards into account when choosing it, and handle your data in line with the PDPA's cross-border transfer rules.
• Backup retention: encrypted backups expire automatically after at most 30 days; after account deletion, copies in backups also expire within that period and are never restored into the Service.
• Encryption in transit (TLS); access to data is permission-controlled and audited; keys and credentials are kept separately from code. We take reasonable technical and organisational measures to protect data but do not promise absolute security.
• If a data breach affects your rights, we will notify you and the regulator as required by applicable law.
• Operational notices travel through Telegram and e-mail is processed by Gmail; their servers may be in countries or regions other than Singapore and the EU.
• Retention: account and content data are kept while your account exists and handled as in section 7 after deletion; reports, sanctions and transaction records (including earnings and withdrawals) are kept, de-identified and with restricted access, for the period applicable law requires and only to meet legal obligations and handle disputes; e-mails and operational notices are kept until the matter is resolved, for no longer than 24 months.
• Specific providers and regions may change with operational needs: replacing a provider with one offering the same kind of service and no lower protection only requires updating this Policy; a new category of recipient or a new purpose is handled as a material change under section 10.

9. Service status and responsibility (protective terms)

• Kira is provided "as is" and "as available"; we do not warrant uninterrupted, error-free operation or that data will never be lost.
• User content is the responsibility of the person who posts it; offline transactions, photo shoots, rentals and other dealings between users are at the users' own risk (in-app reminders apply), and Kira is not a party to any transaction between users.
• To the fullest extent permitted by applicable law, we are not liable for indirect, incidental or consequential loss. The remaining liability terms are in the Terms of Service.

10. Changes to this Policy

We may revise this Policy at any time. Material changes (such as new data types, a new category of recipient or new purposes) are notified to you before they take effect, prominently in the app or by e-mail; where applicable law requires your consent to a change, we ask for it in the app before applying the change to your data, and for other changes, continuing to use the Service after they take effect means you accept them. If you do not agree, you may stop using the Service and delete your account. Non-material changes are notified by updating the effective date, and your continued use is acceptance.