1. Who we are
Karma Inc. ("Karma", "we", "us"), a company incorporated in Delaware, USA, operates the website www.karma-app.com (the "Site") and the Karma mobile application (the "App"), together the "Services". Karma Inc. is the "data controller" of the personal information collected through the Services.
US mailing address: Karma Inc., 1272 S Governors Ave, Unit #2036, Dover, DE 19904, United States.
UK office: Karma US-UK Ltd, Workspace, Barley Mow Centre, Chiswick, London W4 4PH, United Kingdom.
Questions about this policy or your data: support@karma-app.com.
2. What this policy covers
This policy explains how we handle personal information collected through the Site (including our waitlist) and through the App. It applies from the moment you visit the Site, join the waitlist, download the App, or create a Karma account.
3. Information you give us
| What | When | Why |
|---|---|---|
| Email address, and optionally your city or country | When you join the waitlist on the Site | To let you know when Karma launches, share occasional pre-launch updates, and plan launch locations |
| Account details: name, email address, date of birth, and sign-in credentials | When you create a Karma account | To create and secure your account and confirm you are 18 or over |
| Profile information: profile photo, bio, skills and interests, and general area | When you set up or edit your profile | To show other users who you are and improve matching |
| Identity verification data: a government-issued ID and a selfie | When you verify your identity | To confirm you are a real person and that your profile matches your ID (see "Identity verification" below) |
| Help requests and offers: the text of what you need or can offer | When you post a request or offer to help | To find you a match (see "AI-powered matching" below) |
| Messages and shared media: in-app chats and any photos you send or upload | When you message a matched user or add photos | To let you coordinate with your match, and to keep the community safe |
| Contact details and message content | When you email us (e.g. support or partnership enquiries) | To respond to you |
4. Information we collect automatically
- Location. Matching is local, so the App uses your location. With your device-level permission we collect precise location to suggest requests and helpers near you; if you decline, we use approximate location (from your IP address or the area you set in your profile). Other users never see your precise location; they see only an approximate distance or neighbourhood. You can change location permissions at any time in your device settings; the App will still work, with less relevant matches.
- Technical and usage data. IP address, device and browser type, operating system, device identifiers, pages or screens viewed, interaction events, and crash reports, to keep the Services secure, fix problems, and understand how they are used.
- Push notification tokens. If you enable notifications, we collect the device token needed to deliver them (matches, messages, and important account updates). You can turn notifications off at any time in your device settings.
5. AI-powered matching
When you post a help request or offer, we use artificial-intelligence models, including services provided by Anthropic, to summarise and categorise the text and to suggest likely matches based on your request, profile, and approximate location. These are suggestions only: you and your match each decide whether to connect, and no decision with legal or similarly significant effect is made about you solely by automated means. If you have questions or concerns about a match, contact us at support@karma-app.com.
6. Identity verification
To keep the community safe, we ask users to verify their identity before meeting others. Verification is carried out by our specialist provider, Persona, which processes your ID document and selfie on our behalf to check that they match. We receive and store the verification result (verified or not) and a reference number; we do not store copies of your ID document in our own systems. The provider retains verification data in line with its own retention rules and data-processing terms.
7. Legal bases (UK & EU GDPR)
If you are in the United Kingdom or the European Economic Area, we process your personal information on the following legal bases:
- Contract: to provide the Services you signed up for: your account, profile, matching, messaging, and notifications about your matches.
- Consent: for precise location, the waitlist and marketing emails, marketing push notifications, and analytics cookies/identifiers on the Site and in the App. You can withdraw consent at any time via your device settings, the unsubscribe link in any email, your cookie choices, or by contacting us.
- Legitimate interests: for identity verification, safety and content moderation, preventing fraud and abuse, securing the Services, and responding to enquiries.
- Legal obligation: where we must keep or disclose information to comply with law.
8. Cookies & analytics
We use Google Analytics for Firebase (a Google LLC service) to understand how the Site and the App are used, for example, which pages or screens are viewed and how people arrive. We also use Firebase Crashlytics in the App to collect crash reports so we can fix bugs. These tools use cookies and similar identifiers and process technical data such as your IP address and device information. We have configured analytics to avoid collecting more than we need, and we do not use it for advertising.
Where required by law (including in the UK and EEA), analytics runs only after you accept it: via the cookie banner on the Site, and via the consent screen when you first open the App. You can decline or withdraw acceptance at any time, block cookies in your browser settings, and learn more about Google's practices at policies.google.com/privacy. Strictly necessary cookies and identifiers, needed for the Services to function, are always active.
9. Who we share information with
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it with:
- Other Karma users: when you are matched, the other user sees your profile (name, photo, bio, verification status), your approximate distance or neighbourhood, your request or offer, and the messages and photos you send them. Never your precise location, email address, or ID details.
- Platform.sh: hosts the Site.
- Google LLC: provides the App's core infrastructure: Firebase Authentication (sign-in), Google Analytics for Firebase and Firebase Crashlytics (analytics and crash reporting), Firebase Cloud Messaging (push notifications on Android), and the Google Workspace tools (including Google Sheets) where waitlist emails are stored.
- Apple Inc.: delivers push notifications on iOS.
- Persona: verifies your identity, as described above.
- Anthropic: powers matching, as described above.
These providers process data on our behalf under their applicable data-processing terms. We may also disclose information if required by law, to protect our rights or users' safety (including sharing information with law enforcement where we believe someone is at risk), or as part of a corporate transaction (e.g. financing or acquisition), in which case this policy will continue to apply to it.
10. International transfers
We are based in the United States, and your information is processed on servers that may be located in the US or other countries. If you are in the UK or EEA, we rely on appropriate safeguards for these transfers, including the EU–US Data Privacy Framework and its UK Extension (to which Google is certified) and, where applicable, Standard Contractual Clauses.
11. How long we keep your information
| Data | Kept for |
|---|---|
| Account and profile data | Until you delete your account, then removed from our systems within 30 days (except where law requires longer) |
| Messages and shared photos | While your account is active; deleted within 90 days of account deletion, except messages retained for a safety investigation |
| Identity verification result | While your account is active; underlying documents are held by our verification provider under its own retention rules |
| Location data | Precise location is used in real time and not stored as a movement history; derived approximate-area data is kept while your account is active |
| Waitlist emails | Until you unsubscribe, or up to 12 months after the App launches, whichever is sooner |
| Enquiry emails | Up to 24 months after our last exchange |
| Technical logs and analytics data | Up to 12 months |
12. Your rights and choices
You can delete your Karma account at any time in the App (Settings → Account → Delete account), which removes your profile and data as described in the retention table above. If you no longer have the App, you can request deletion from our Delete account page. You can also edit your profile, change location and notification permissions in your device settings, and unsubscribe from emails via the link in any email.
Depending on where you live, you also have rights over your personal information, including the right to access it, correct it, delete it, restrict or object to its processing, receive a copy in a portable format, and withdraw consent at any time. Exercising these rights is free, and we will not discriminate against you for doing so. To make a request, email support@karma-app.com; we will respond within the timeframe required by applicable law (one month for UK/EU requests, 45 days for California requests).
California residents: the California Consumer Privacy Act (CCPA/CPRA) gives you the rights to know, delete, and correct the personal information we hold about you, and to opt out of "sales" or "sharing" of personal information. We do not sell or share personal information as defined by the CCPA.
UK and EEA residents: you can complain to your data protection authority: in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, your local supervisory authority. We'd appreciate the chance to resolve any concern first.
13. Children
The Services are for adults. You must be at least 18 years old to use the App or join the waitlist, and we do not knowingly collect information from anyone under 18. If you believe a minor has given us personal information or is using the App, contact us and we will delete the information and close the account. See also our Child safety standards.
14. Security
We use appropriate technical and organisational measures to protect your information, including encryption in transit (HTTPS) and at rest, and access controls limiting who at Karma can view user data. No online service is 100% secure, but we work to protect your data in line with industry standards.
15. Changes to this policy
We may update this policy as the Services evolve. We will post the new version here with an updated date, and for significant changes we will notify you in the App or by email before they take effect.
16. Contact
US mailing address: Karma Inc., 1272 S Governors Ave, Unit #2036, Dover, DE 19904, United States.
UK office: Karma US-UK Ltd, Workspace, Barley Mow Centre, Chiswick, London W4 4PH, United Kingdom.
Email: support@karma-app.com