Privacy Policy

Kairo is an iOS app (with limited Android support) for building daily habits with your friends, with an alarm you turn off by completing a mission. This policy explains what we collect, why we collect it, who we share it with, and the choices and rights you have.

Kairo is operated by an independent developer based in Brazil. You can reach us about privacy at eder.rosaaa@gmail.com.

In short: we collect what we need to run your habits and alarms, your account, your subscription, and the social features. The photos you take as proof, including alarm mission photos, are checked by AI, stored, and shown to your friends, and on the public globe if you choose to post there. You can delete your account and all associated data at any time from Settings → Account → Delete Account.

• Account and identity: Your email and password if you sign up with email, or your email, name, and profile photo from Sign in with Apple or Google (Apple may provide a private-relay email), plus an internal user ID and authentication ID, to create and secure your account.
• Profile and onboarding answers: Your handle, display name, avatar configuration, country (derived from your device time zone, not GPS), age range, gender, sleep and wake habits, target wake time, chosen wake mission, and how you found Kairo, to personalize onboarding, your wake-up plan, and the social experience.
• Social graph: Friend requests, friendships, the people you follow, blocks, and abuse reports, to power friends, leagues, and the activity feed, and to keep the community safe.
• Usage and app activity: The habits and challenges you pick and the days you complete them, rooms, tasks, coins, alarms, wake-up logs (time, success, time to complete, mission type), streaks, league membership and XP, and alarm lifecycle events, to deliver the core product and track your progress.
• Photos and posts: The photos you take to prove a habit or to complete an alarm mission, and the photos you choose from your library (Kairo Gold). They are checked by AI, stored, and shown to your friends, and on the public globe if you choose to post there (see “Photos and AI” below).
• Chat messages: The messages and photos you send your friends in the chat, to deliver them. Chat is only between friends.
• Apple Health (read only): Steps, sleep, and workouts, only for the habits you pick that your phone proves, to mark those habits as done. Kairo never writes to Apple Health.
• Contacts (optional): If you allow it, your contacts' email addresses are compared in scrambled (hashed) form to find friends already on Kairo. Your contacts never leave your device in readable form.
• Screen Time: If you use Screen Control, your screen time and the apps you choose to block are handled by Apple's Screen Time on your device. That data never leaves your phone, and Kairo never receives it.
• Device and technical data: Device model, iOS version, app version, locale, time zone, push token, and permission states (notifications, camera, alarm, Screen Time), and crash reports, to deliver alarms and notifications reliably and to diagnose problems.
• Subscriptions and purchases: Transaction IDs, entitlement, and trial or renewal status from Apple and RevenueCat, to manage your subscription and unlock Kairo Gold.
• Notifications: An Expo push token, to deliver alarm, league, friend, chat, and engagement notifications.
• Analytics: Product analytics events and device properties via PostHog, to understand how features are used and improve the app.

When you prove a habit with a photo, or complete an alarm mission that asks for one, the photo is sent to OpenAI, our AI provider, which checks it and returns a pass or fail result. A photo counts as proof only after it passes.

Photos that count as proof are stored with the result of the check. Your friends see them, and if you choose to post to the world in Discover, your habit posts also appear on the public globe, placed near a city in your time zone and never at your exact location.

OpenAI processes these images solely as our service provider, to perform the check we request. Their handling of data submitted through their API is governed by OpenAI's API terms.

We do not sell your personal data. We share it only with the service providers (sub-processors) we rely on to run Kairo. Each link below goes to that provider's privacy policy.

• Apple: Sign in with Apple, in-app purchases, and push notification delivery.
• Google: Google Sign-In authentication.
• Supabase: Database, authentication, file storage (including photos), and server functions (data hosting).
• RevenueCat: Subscription and purchase management.
• PostHog: Product analytics (PostHog Cloud, United States).
• OpenAI: AI that checks proof photos and alarm mission photos.
• Groq: AI inference for an in-app assistant chat.
• Expo (EAS): App infrastructure and push notification delivery.
• Sentry: Crash reports and error diagnostics.
• Mapbox: Maps for the Discover globe.
• Vercel: Website hosting.

You can access, correct, or delete your personal data at any time:

• Delete everything: open the app and go to Settings → Account → Delete Account. This permanently removes your account and the data associated with it.
• Access or correct: most profile data can be edited in the app; for anything else, email us.
• Notifications: turn off push notifications in your iOS Settings, or disable specific categories (such as friend or engagement notifications) in the app.
• Permissions: you can turn off Kairo's access to the camera, Apple Health, contacts, photos, or Screen Time at any time in your iPhone Settings.
• The public globe: your habit posts appear there only if you choose to post to the world in Discover.
• Analytics and activity feed: you can opt out of sharing your activity to the feed in the app's settings.

To make a privacy request, email eder.rosaaa@gmail.com. We may need to verify your identity before we act on it.

• Account, profile, social, and usage data: kept until you delete your account, after which it is removed (subject to the limited exceptions below).
• Analytics events: retained by PostHog according to our analytics configuration.
• Subscription and transaction records: retained as long as needed for billing, tax, and fraud-prevention purposes.

After you delete your account, we may retain limited records where required to comply with the law, resolve disputes, or prevent fraud and abuse.

Kairo is operated from Brazil, and several of our providers (including Supabase, PostHog, OpenAI, Groq, RevenueCat, Expo, and Vercel) store and process data on servers in the United States. When your data is transferred internationally, we rely on those providers' safeguards and applicable legal transfer mechanisms.

Kairo is not directed to children under 13, and we do not knowingly collect personal data from children under 13. The minimum age to use Kairo is 13. If you believe a child has provided us with personal data, contact us and we will remove it.

Depending on where you live, you may have additional rights:

• European Economic Area and UK (GDPR): rights to access, rectification, erasure, restriction, portability, and objection, and to lodge a complaint with your data protection authority. Our legal bases are performance of our contract with you, your consent, and our legitimate interests in operating and improving Kairo.
• Brazil (LGPD): rights to confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing, and to withdraw consent at any time.
• California (CCPA/CPRA): rights to know, access, correct, and delete your personal information, and not to be discriminated against for exercising them. We do not sell or share your personal information as those terms are defined under California law (Do Not Sell or Share My Personal Information).

To exercise any of these rights, email eder.rosaaa@gmail.com.

We may update this policy as Kairo evolves. When we make material changes, we'll update the date at the top and, where appropriate, notify you in the app. Continued use of Kairo after an update means you accept the revised policy.

Privacy and data requests: eder.rosaaa@gmail.com.

Terms of UseEULAAccount Deletion