Privacy policy

The short version

• Kyku keeps what it needs to help you. No ads, no analytics, no tracking, and we don’t sell your data.
• To answer you, what you say goes to AI models run by other companies, such as OpenAI, xAI and Google, through Vercel.
• Saved passwords and cards are encrypted. The AI never sees them. They are unlocked only to be filled into the browser Kyku uses, on the site they belong to, and a card only for a purchase you approved.
• You can download a copy of your data or delete your account at any time in the app, under Settings › Your data. A few things are not erased yet, and they are listed under Download or delete.

Who we are

Kyku is made by Hamed Rahimi in Toronto, Canada. Hamed is responsible for your personal information at Kyku, and he is who answers at hello@kyku.app. “We” on this page means Kyku.

What Kyku collects

Your account

• The name and email address Apple shares when you use Sign in with Apple. If you choose Hide My Email, we only see Apple’s relay address.
• Your phone number, if you sign in with one.
• For each sign-in, when it happened and the IP address and device type it came from.

What you tell Kyku, and what it does

• Your conversations: anything you type, dictate or share into the chat, and Kyku’s replies.
• What Kyku does along the way: its searches, the pages it reads, the steps it takes in a browser, and screenshots of those pages.
• An activity log with a line for each job: what you asked, what Kyku did and what it said back.
• Records Kyku keeps for you: tasks, goals, bookings, purchases, decisions, routines and notes, with amounts and merchants where there are any.
• Reminders you set, and routines Kyku learns from doing a job you’ve asked for before.
• SOUL.md and MEMORY.md: how Kyku works with you and what it remembers about you, which you can read, edit, download and delete in the app. Kyku keeps them up to date only from what you write to it, never from your email, web pages or anything else it reads, and rewrites MEMORY.md each night. Anything that looks like a password, card number or code is never kept.
• Your time zone, quiet hours and whether Kyku checks in in the morning. Your time zone comes from your iPhone.
• The options Kyku showed you in a reply (names, prices, ratings), kept with that reply’s line in the activity log.
• Your settings: language, spending rules, and the purchases you approved or turned down.
• What you send the team: feedback, a reply you mark as not helpful (with its text), and anything you ask Kyku to pass on.

What you save in the vault

• Logins for websites: the site, your username and your password, including any you import from a password manager’s export file.
• Payment cards: the number, expiry date, cardholder name and billing postal code. The security code (CVC) is never saved: the app asks for it each time you buy, and it is kept encrypted only until that checkout is filled in, then erased, never longer than the purchase’s approval lasts.
• Addresses and contact details you save for filling in forms.

What you connect

• Apple Calendar, Reminders and Contacts. When you connect one, your iPhone sends Kyku a copy: events from a week back to two months ahead (title, time, place, notes and calendar name); your open reminders and their lists; your contacts’ names, phone numbers, email addresses, birthdays, nicknames and companies. The app refreshes the copy while you use it, and disconnecting deletes it.
• Google: Gmail, Google Calendar and Google Contacts. Kyku can search and read your mail, change its labels, send mail you approve, read and add calendar events, check when you’re free, and look up contacts. It fetches what a job needs when you ask, and doesn’t copy your mailbox into its database.
• Another mailbox, over IMAP. We keep its server, your username and the password you give us. Use an app-specific password, like the one iCloud makes for you.
• Other apps you connect in Settings › Connectors, like Notion or Slack. Kyku reads what a job needs and, only with your approval, sends, creates or changes things there. Disconnecting deletes the connection.

Payments

• You pay for a Kyku plan on Stripe’s page, and we never see that card. Stripe tells us which plan you chose, whether the payment went through, and the phone number and email address you entered, so we can match the payment to your account.
• We record what each job cost us to run, so we can keep track of your plan’s monthly allowance.

On your iPhone

• Photos stay on your phone. When you add one to the chat, the app reads the words in it on the phone and sends only those words.
• Dictation is turned into text on your phone when your iPhone can do that. When it can’t, Apple’s speech recognition does it.
• When Kyku asks for Face ID or your passcode before spending money, the check happens on your phone. We never see your face, your Face ID data or your passcode.
• The app keeps your chats, library and settings on the phone, and your sign-in in the iPhone’s Keychain.
• While a job is running and you leave the app, it gives us a token for the Lock Screen progress (a Live Activity) so we can keep it up to date. We drop the token when you come back.

Other people

Your contacts, mail and calendar mention other people. Kyku uses what’s there only to do what you ask.

What we don’t collect

There is no advertising identifier, no analytics or crash-reporting tool, and no third-party tracker in the app or on kyku.app. The website’s only cookies are the ones that keep you signed in.

How we use it

• To do what you ask: answer, look things up, fill in forms, book and buy with your approval, and remind you.
• To remember you, so your SOUL.md, MEMORY.md, records and routines make the next job faster.
• To write to you first, rarely: Kyku may send one short message at the start of your morning when something needs your attention. It never writes during your quiet hours, stops after two go unanswered, and you can turn it off in Settings.
• To run your plan: the trial, your allowance and billing.
• To keep Kyku safe and working: stopping abuse of sign-in, fixing problems, and answering you when you write to us.

We don’t sell your personal information, share it for advertising, or use it to train AI models.

How the AI works

Kyku runs on AI models from other companies, reached through Vercel’s AI Gateway. Today OpenAI does the browser work and answers on the Standard plan. xAI answers during the trial and on the Frontier plan, until that month’s allowance is used up. Google’s model writes the one-line summary in your activity log, reads each message you send for things worth remembering, and rewrites MEMORY.md each night. TypeSafe AI’s Jev puts the options Kyku shows you in order and decides whether a watch’s news is worth a message. While testing, we may assign an account a particular model, which can also come from Anthropic, Alibaba or Z.ai; Anthropic then also makes a quick check of how hard each request is. Web searches go through Exa.

The models get what a job needs: your message and the conversation so far, your SOUL.md and MEMORY.md, your time zone, the records and connected data Kyku looks up, the pages and screenshots it works with, and your phone number if you signed in with one.

We have not set up zero data retention with these providers, except TypeSafe AI, where we ask for it on every request. What they keep, and for how long, is governed by their own terms for their APIs.

Your saved passwords, card numbers, card security codes and one-time codes are never sent to an AI model. The model works with a stand-in, the real value is decrypted on our server and handed straight to the browser, and screenshots are blacked out around the fields that hold it.

The browser Kyku uses

Kyku works on websites in cloud browsers run by Kernel. When a job needs a login or a card, it is decrypted on our server and put straight into that browser, only on the site it was saved for, and a card only for a purchase you approved. The sites you sign in to this way are remembered in a browser profile that belongs to your account, so Kyku stays signed in next time. That profile is deleted with your account. You can watch Kyku’s browser, or take it over, from the app.

Kyku asks before it buys anything, and in the app you approve with a slide and Face ID or your passcode. The one exception is one you set yourself: automatic approval under an amount you choose, in your spending rules. It is off unless you turn it on.

Who else handles your data

These companies handle personal data for Kyku, each only for the part of the job it does.

Vercel

Hosts Kyku. Every request to an AI model goes through its AI Gateway. Stores your conversation history (messages, what Kyku did, screenshots) in Vercel Workflow, and files and screenshots in Vercel Blob (and, for accounts from before October 2026, an older profile whose facts have moved into MEMORY.md). Holds your Google connection (Vercel Connect).

Neon

Our database.

OpenAI, xAI, Google

The AI models that read and answer your requests, through Vercel. See “How the AI works”.

Anthropic, Alibaba, Z.ai

AI models we may assign to an account while testing, through Vercel.

Exa

Web searches, through Vercel.

Kernel

The cloud browsers Kyku uses to work on websites for you, including the saved logins and cards it fills in.

TinyFish

Reads some public web pages for Kyku. It is sent the page’s address and nothing about you.

Google

Gmail, Google Calendar and Google Contacts, when you connect them.

Composio

Connections to other apps you connect through Kyku. It keeps the sign-in for each, and what Kyku asks those apps and what they send back passes through it.

Duffel

Live flight prices. When you ask about flights, Kyku sends the airports, dates, cabin and how many travellers (with children’s ages). Never your name, contact or payment details, and nothing is booked or bought through Duffel.

Stripe

Payments for Kyku plans.

Apple

Sign in with Apple, and updates to the progress Kyku shows on your Lock Screen (Apple Push Notification service).

Cloudflare

Receives email sent to kyku.app, and runs the clock that fires your reminders.

Resend

Sends email from us.

Open-Meteo

Weather forecasts. It is sent a place name, never who is asking.

TypeSafe AI

Jev, a small model that answers quick ranking and yes-or-no questions for Kyku, through Vercel: which options best fit what you asked, and whether a watch’s news is worth a message. It gets only a short snippet (your latest message, the options’ names and prices, or the watch’s news), and we ask for it to keep nothing.

Email you send to hello@kyku.app is also forwarded to the founder’s own mailbox.

When Kyku visits a website for you, that website sees the visit as it would any other, coming from Kernel’s browser. Pictures in the app’s cards, like an airline’s logo or a product photo, load straight from the site that hosts them. To put a picture on a card, Kyku’s server may also open the page the card links to, such as a hotel’s or restaurant’s page, and read the picture that page names for link previews. That request comes from our server and carries nothing about you.

These companies process data outside Canada, including in the United States, where it is subject to local law. We will also share information when the law requires it. If Kyku is ever sold or merged, your data would go with it, and we’ll tell you before a different policy applies to it.

How long we keep it

• Your account and everything Kyku keeps for you: until you delete the item or your account. Nothing here expires on its own.
• Notes Kyku takes from your messages: until you forget them or delete the chat they came from. A replaced note is deleted after 90 days, a forgotten one straight away (its empty placeholder after 7 days). Deleting a side chat forgets what Kyku learned in it.
• Apple Calendar, Reminders and Contacts: each sync replaces the last copy, and disconnecting deletes it.
• Recordings of browser work, which Kyku uses to learn a routine: 24 hours.
• Sign-in codes: 5 minutes. The link the app uses to sign you in on the web: 1 minute.
• A card’s security code, entered for one purchase: until that checkout is filled in, and never longer than the purchase’s approval lasts.
• Email you send us: kept in our inbox. The raw copy of each message is deleted after 30 days; the message itself stays.
• What Kyku’s work cost: kept for our books. Once you delete your account, those records no longer point to you.

Download or delete

In the app, go to Settings › Your data. Download a copy gives you one file with your account, plan, records, reminders, spending rules, purchases, the list of what’s in your vault (never the passwords or cards themselves), your mailboxes (without their passwords), routines, chat titles, activity log, files, feedback, SOUL.md, MEMORY.md, the notes behind them, and your time zone, quiet hours and check-in settings. It doesn’t yet include the full text of your conversations or the copy of your Apple data. Email us if you want those.

Delete account deletes your account, records, reminders, vault, mailboxes, Apple data, activity log, files and screenshots, SOUL.md, MEMORY.md and the notes behind them, and Kyku’s older profile of you. It also deletes your browser profile at Kernel, disconnects Google, removes connections made through Composio, stops any work still running, and clears Kyku from that phone. If a paid plan is still running, cancel it first (ask Kyku in the chat), so it stops charging you.

Some things are not deleted with your account yet:

• Your conversation history in Vercel Workflow. Deleting your account stops the work, but doesn’t yet erase that stored history.
• Email you sent to hello@kyku.app.
• What Kyku’s work cost, with nothing pointing to you.
• Short links Kyku made for you, which hold a web address and nothing that names you.
• What Stripe keeps about your payments, under its own policy.
• What the AI providers and other companies above have already received, under their own terms.

If one of the outside services is down when you delete your account, your account is still deleted, and we clear what’s left there by hand. To ask us to remove anything on this list, write to hello@kyku.app.

Security

• Everything travels encrypted, and Kyku only connects to mail servers over an encrypted connection.
• Vault items and mailbox passwords are encrypted with AES-256-GCM before they are stored, each one tied to your account so it can’t be read as anyone else’s.
• Saved passwords and cards never go to the AI, into our logs, or into your records. They go only into a browser that has never run code the AI wrote.
• Sign-in attempts are limited, to stop guessing.

We don’t read your conversations. We look at your data only when you ask us for help, to fix a problem, to stop abuse, or when the law requires it. No system is perfectly secure: if a breach puts you at real risk of harm, we will tell you, and the Office of the Privacy Commissioner of Canada, as the law requires.

Children

Kyku isn’t made for children, and you must be 16 or older to use it. Kyku doesn’t ask your age, so if you think a child under 16 is using it, write to hello@kyku.app and we’ll delete their account.

Your rights

Under Canada’s privacy law (PIPEDA) you can ask what we hold about you and for a copy of it, ask us to correct it, and withdraw your consent by disconnecting something or deleting your account, though Kyku may not be able to do some jobs without it. If you have a concern, tell us first. If we don’t resolve it, you can complain to the Office of the Privacy Commissioner of Canada.

Depending on where you live, you may have other rights too, such as asking us to delete or limit what we hold, or to give it to you in a form you can take elsewhere. Wherever you live, write to hello@kyku.app and we’ll answer within 30 days. We don’t sell or share personal information for advertising, so there is nothing to opt out of.

Google data

Kyku’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Changes

When this policy changes, we’ll post the new version here and update the date at the top. If a change matters, we’ll tell you in Kyku before it applies.

Contact

Hamed Rahimi, Kyku, Toronto, Ontario, Canada. hello@kyku.app