Last updated: April 2026
Kramana operates kramana.app. This policy explains what data we collect, why, and how you can control it.
Account data. When you create a Kramana account, we collect your email address and, optionally, your first name and last name. If you sign up with Google or Apple, we receive your name and email from that provider. Your password is never stored by Kramana directly — it is hashed and managed by our authentication provider (Supabase Auth).
Profile data. You may optionally provide a WhatsApp number and Instagram handle on your account page. This information is used for communication (e.g., studio ownership verification) and is visible only to you and Kramana administrators. Instagram handles associated with studio listings are displayed publicly on those listing pages.
Authentication data. When you sign in, we store session tokens in browser cookies to keep you logged in. If you use Google or Apple sign-in, OAuth tokens are managed by Supabase Auth and are not accessible to Kramana application code.
Analytics data. We use PostHog to understand how people use the site. This includes pages visited, filters used, map interactions, and session recordings (with all form inputs masked). If you are logged in and have consented to analytics, we associate your anonymous usage data with your account to improve your experience. We do not track you across other websites. We also use Vercel Analytics to measure page load performance.
Attribution data. When you arrive through a tracked link or a recognized external referrer (such as a search engine or social platform), Kramana records a first-party attribution touch. This includes the landing page, the referrer domain, and any campaign identifiers present in the link. Some tracked links carry a personalized token that attaches the visit to a specific internal entity such as a studio, teacher, user, destination, or class. This entity attachment is first-party Kramana data used to understand which shared or outreach links generate interest. Attribution touches are stored in our database as operational records. They are not advertising cookies and are not used for cross-site tracking. When analytics consent is granted, attribution properties may also be mirrored into PostHog for analysis; the entity attachment itself is not sent to PostHog.
Location data.When you visit the “Near Me” page, we read your approximate location from your IP address (provided by our hosting provider, Vercel) to show studios in your area. This data is not stored. If you grant browser location permission, GPS coordinates are used only during your session and are not sent to our servers or saved.
Contact form data. If you submit our contact form, we collect your name, email address, topic, and message. We also record your browser user-agent string, approximate country and region (derived from your IP address by our hosting provider), and a hashed version of your IP address. Raw IP addresses are never stored. This information is kept in our database for support handling, abuse prevention, and rate limiting. Submissions may also be forwarded to our team via email (processed by Resend). Cloudflare Turnstile runs a background check to prevent spam; no personal data is sent to Cloudflare beyond what is needed for verification.
Communications. We may send you emails related to your account, studio claims, or listings (e.g., claim status updates, verification codes). These transactional emails are delivered via Resend.
We use your data for:
• Account creation, authentication, and session management
• Personalized communications (e.g., using your first name in emails)
• Verifying ownership of studio and teacher listings (entity claims)
• Improving Kramana through analytics and bug identification
• Sending transactional emails about your account, claims, or listings
• Responding to support requests
We do not sell, share, or provide your data to any third party for their own purposes.
We use the following services that may process data on our behalf:
Supabase — authentication, database, file storage (Singapore region)
Google OAuth — sign-in via Google (if you choose this method)
Apple OAuth — sign-in via Apple (if you choose this method)
PostHog — analytics, session replay
Vercel — hosting, web analytics, IP geolocation
Resend — transactional emails (confirmation, password reset, contact form)
Cloudflare Turnstile — spam prevention on auth and contact forms
Kramana uses cookies for two purposes:
• Authentication cookies — required to keep you signed in. These are strictly necessary and cannot be disabled.
• Analytics cookies — used by PostHog to record usage patterns and session replays. You can manage these below.
• Attribution cookie — a short-lived cookie (expires in seconds) used to pass attribution context from the server to the page when you arrive through a tracked link or recognized referrer. It is cleared automatically after the page loads and is not used for persistent tracking.
We do not use advertising cookies or cross-site tracking.
Analytics cookies
PostHog usage tracking & session replay
Authentication cookies
Session management & sign-in state
We respect the Do Not Track (DNT) browser signal. If your browser sends a DNT request, analytics will not load. You can also block cookies through your browser settings at any time.
Account data is retained for as long as your account is active. If you delete your account, we anonymize all personal information (email, name, WhatsApp number, Instagram handle, profile image) and remove your authentication credentials. Your account row is preserved in an anonymized state to maintain referential integrity in audit logs (e.g., claim review history).
Contact form submissions are stored as operational support and abuse-prevention records. They are retained independently of any user account. If you request deletion, sender identity fields are anonymized but the submission record is preserved for administrative and abuse-prevention purposes.
Analytics data is retained by PostHog according to their standard retention policy. Session recordings are automatically deleted after their retention period.
You have the right to:
• Access your personal data via your account page
• Correct your data by editing your profile
• Delete your account and associated personal data
• Export your data on request via our contact page
• Opt out of analytics tracking using the cookie preferences above
Kramana is not directed at children under 18. We do not knowingly collect data from children.
We may update this policy from time to time. Changes will be posted on this page with an updated date.
If you have questions about this policy, reach out via our contact page.