Privacy Policy

Last updated 14 October 2026. This explains how Kalwings ("we", "us"), based in Telangana, India, handles personal data on app.kalwings.com. We follow the principles of India's Digital Personal Data Protection Act, 2023. Questions or requests: sajeedteam@gmail.com.

The short version: we collect what we need to run the platform, your contact details stay private unless you choose otherwise, you decide who sees each part of your profile, we don't sell your data, and you can export or delete your account yourself.

1. Who this applies to

Students and job seekers, mentors, recruiters and companies, college coordinators, and visitors to the site. Kalwings is for people aged 18 and over. If you believe someone under 18 has an account, contact us and we will remove it.

2. What we collect

• Account: your name and email address (used to sign you in), and your role. If you choose to turn on password login, we store only a salted one-way hash of your password, never the password itself.
• Profile and Talent Passport (students): headline, bio, city, graduation year, college and department, skills, links such as GitHub, what you are looking for, projects, photos and screenshots you upload, experience, achievements, hackathons and certificates, and any evidence links you give us.
• Activity: applications and their status, messages with employers, interviews and offers, challenge submissions, assessment answers and code, mentor session requests, community posts and comments, reports you file, and notifications.
• Organisations: company or college name, website, team members, plan, and drive details. Mentors: role, company, country and domain.
• Technical: your IP address and request timing (kept briefly to stop abuse such as repeated sign-in attempts), error logs without personal content, and an audit log of actions taken by administrators and verified users on sensitive features.

We do not collect your contact details for display, payment card details (there are no online payments yet), government ID numbers, or precise location.

3. Why we use it

• To create and run your account, sign you in, and show your profile where you choose.
• To match you with opportunities and explain why a listing may or may not fit (computed on our servers from your own profile; no external AI service is used).
• To let employers, mentors and colleges do what you ask of them: review an application, run a challenge, host a drive, give an endorsement.
• To send service emails: sign-in codes and notifications about applications, interviews, offers, messages and sessions. You can switch off notification emails in one click; sign-in codes are always sent because you need them to log in.
• To keep the platform safe: verify companies, colleges and credentials, moderate listings and community content, investigate reports, and prevent fraud and abuse.
• To maintain and improve the service and to meet legal obligations.

4. Who can see what

• Your email is private by default. Employers see them only if you switch on "share my contact details" in Profile. They never appear on your Talent Passport, college rosters or reports.
• Talent Passport: you choose, for the whole Passport and separately for projects, endorsements and experience entries, whether it is visible to anyone with the link, only to verified recruiters, or only to you. Private and suspended profiles are excluded from recruiter search. Passport pages ask search engines not to index them.
• Employers you apply to see your application, your Passport (subject to your settings) and the messages in that application. Employers who invite you to a challenge or assessment see your submission for it.
• Your college sees your name, headline, department and progress only if you chose that college and ticked the sharing box. You can withdraw at any time and you disappear from its roster and future reports.
• Campus drives: accepting a drive invitation shares your name, headline, department and Passport link with that company for that drive only.
• Community: posts and comments are visible to signed-in members of the relevant group. College communities are visible only to members of that college. You can report content and block other members.
• Mentors see what you write in a session request and, if you complete a session, may endorse your work with a link as evidence.
• Kalwings staff and moderators can access data needed to verify, moderate and support the platform. Administrative actions are logged.

5. Service providers

We do not sell personal data and we do not run third-party advertising or analytics trackers. We use a small number of providers to operate the service:

• Hostinger for hosting, the database and email delivery (data and the email address and message content of sign-in and notification emails pass through their infrastructure).
• Google, only if you choose "Continue with Google": we receive your name and email from Google to sign you in.
• A code-execution service, only for coding assessments and only when enabled: the code you submit is sent to an isolated runner to be tested.

We may disclose data when required by law or to protect people from harm or fraud.

6. Cookies and similar storage

• A signed, httpOnly session cookie keeps you signed in, plus a small non-sensitive cookie that tells the site you are signed in.
• Your light/dark theme choice is saved in your browser's local storage.
• An offline page and static files are cached by the app's service worker; private pages are never cached.

We do not use advertising or cross-site tracking cookies.

7. How long we keep data

• Your account and profile are kept until you delete your account (Dashboard → Account & data) or ask us to.
• Deleting your account removes your profile, applications, messages, uploads, submissions and community content. Some records may remain where the law requires it, or in an anonymised form, for example an administrator's audit entry.
• Sign-in codes expire in 10 minutes. Rate-limit records and error logs are short-lived technical records that we clear periodically.
• Database backups are kept for about 14 days, so deleted data can persist in backups for up to that long before they are overwritten.

8. Your rights and choices

You can, at any time:

• Access and export your data: Dashboard → Account & data → download.
• Correct your information in Profile and your Passport.
• Delete your account yourself in Account & data.
• Control visibility in Passport settings, contact sharing in Profile, college sharing in Profile, and email notifications in Notifications.
• Withdraw consent for anything based on consent (for example college sharing) without affecting the rest of your account.
• Nominate someone to exercise your rights if you cannot, as provided by the DPDP Act.

If you cannot use the tools above, or want to complain, email sajeedteam@gmail.com. We aim to reply within 7 days and to resolve requests within 30 days. If you are not satisfied you may approach the Data Protection Board of India as provided by law.

9. Security

We use encrypted connections, signed session cookies, one-time sign-in codes and optional passwords stored only as salted hashes, rate limits on sign-in attempts, server-side permission checks on every action, rate limiting, restricted uploads, and an audit log for sensitive actions. No system is perfectly secure. If a breach affects your data we will notify you and the authorities as the law requires.

10. Where data is processed

Our providers may process data in India or other countries. By using the service you understand your data may be transferred as needed to operate it, under the protections described here.

11. Changes

If we make material changes we will update the date above and notify signed-in users in the app or by email. Please also read our Terms of Use and Trust & Safety page.

12. Contact

Kalwings, Telangana, India. Privacy and grievance contact: sajeedteam@gmail.com.