Privacy Policy

1. Overview

Kioku LLC ("Kioku", "we", "our", or "us") is the provider of the Kioku personal activity memory and recall service. We believe your capture data, conversations, and screen history belong to you. This Privacy Policy describes how information is collected, used, disclosed, retained, and protected when you use the Kioku iPhone or Mac app, web dashboard at kiokuu.com, or an AI-assistant integration such as the Kioku plugin for ChatGPT.

2. Information We Process

• Account information: When you sign in with Apple or Google, we verify the provider authorization and resolve its namespaced subject to a canonical Kioku account. We store that provider identity, the verified email address returned by the provider, account status, and feature preferences. Email matching is never used to link accounts; adding Apple to an existing account requires an explicit authenticated link.
• Capture content: While capture is running, the Mac uploads bounded microphone and system-audio snippets, screenshots, application and window titles, exact browser URLs and tab observations, timestamps, device and stream metadata, and integrity information. The current iPhone app uploads bounded microphone audio and photos you explicitly take in Kioku, with timestamps and device/stream metadata. Taking a photo does not start audio recording. It does not capture the iPhone screen or import your photo library. A compatibility path may also upload images already present in an older durable queue. Kioku derives transcripts, OCR text, timestamped speaker turns, learned people and voice profiles, facts, episode summaries, action items, and related evidence. This material can include information about you or other people visible or audible in your environment.
• Voice profiles: Kioku automatically computes biometric voice embeddings and uses conservative voice similarity to recognize speakers over time. New people are learned as unnamed voices; you can name, rename, or merge them in People. Spoken names and names on screen do not automatically name new profiles. You can explicitly enroll your own voice with a short microphone-only first-memory recording on iPhone or Mac, after reviewing the disclosure. Kioku uses eligible speech from its first three minutes to learn your voice and show you as Me; recognition can remain inconclusive while the ordinary memory still forms. A person can have several microphone profiles for recognition across devices. Profiles and a small set of good reference embeddings remain until you explicitly forget the voice, withdraw the applicable biometric permission, or delete your account. Recording expiry or deletion removes its source-bound samples and evidence without erasing the independently retained references or a name you supplied. Profiles, references, samples, names, learned facts, confidence, and source evidence are stored account-qualified in Kioku's private structured database. Voice embeddings stay inside Kioku and are not sent to outside AI processors. Settings → My voice lets you re-record or forget your saved owner voice profiles; People provides controls for other voices. Forget removes the applicable profiles and reference embeddings and prevents older pending recordings from restoring them; it does not delete your recordings or memories. A new recording can learn a forgotten voice again. Ambiguous evidence remains unassigned rather than inventing an identity. Manual corrections can update speaker labels in memories and briefs without editing source recordings or sending previously delivered email again.
• AI-assistant requests and responses: When you connect Kioku to ChatGPT or another supported assistant, the assistant can send a narrowly scoped search, time range, or timestamp on your behalf. Kioku may return relevant transcript excerpts, OCR text, application/window context, URLs, episode summaries, action items, archive counts, and capture timestamps. Before assistant-facing content leaves Kioku, an MCP-only safety boundary refuses searches aimed at payment-card data, health information, government identifiers, passwords, API keys, tokens, or authentication codes; replaces matching incidental content with a redaction marker; and removes URL query strings and fragments. This boundary does not rewrite or delete your private archive and does not change owner-authorized dashboard or REST access. Kioku does not persist the text of MCP search queries or a per-query MCP activity log.
• Optional morning email: If you enable email, Kioku stores your chosen account timezone and sends at most one scheduled morning email at 7 a.m. with eligible settled memories from prior days. Content-free notifications are the default; titles and complete briefs require separate content consent. Memories still processing wait for a later morning. Scheduling preferences, delivery snapshots, and receipts are included in account export and deletion. Disabling email cancels unsent delivery; emails already accepted by your email provider cannot be retracted.
• Optional webhook automations: If you add a webhook destination, Kioku stores its HTTPS endpoint and a signing secret in the private structured store. Content-free finalized-episode notifications are the default. If you separately choose full brief content, the event also contains the episode title, times, participants, overview, decisions, action items, links, and open questions.
• Optional ready notifications: If you enable ready alerts on a Mac or iPhone, Kioku stores an opaque installation identifier, the Apple Push Notification service device token, app topic, environment, and lifecycle state. Each alert is generic and carries a different opaque handoff handle; it contains no memory title, people, transcript, summary, action items, memory ID, account identity, timestamp, URL, or credential.
• Subscription, allowance, usage, and AI-cost telemetry: Kioku processes plan, purchase and subscription status, provider transaction references, allowance period, and aggregate prospective wall-clock seconds authorized in one-minute recording leases. Capture events include timestamps, time-zone identifier and UTC offset, the device's preferred language and your optional account memory-language choice (used for new memory titles, summaries, timelines, briefs, and transcript translations; original transcripts remain intact and are shown alongside translations when the languages differ), device/installation identifiers, route class, sequence, app/bundle context, and safe delivery status. The service also receives ordinary network metadata such as IP address for routing, abuse prevention, security, and technical diagnostics; that may correspond to an approximate area. For each AI inference, Kioku records content-free provider and operation type, requested and returned model, processing location, traffic or service tier, safe HTTP status/outcome, available native input/cache-write/cache-read/output/reasoning token counters, and observation time so costs can be reconciled. Missing counters remain unknown rather than being estimated as zero. The isolated billing service receives a random account identifier, not your email, Apple or Google identity, recording, transcript, screenshot, URL, device identifier, AI prompt or response, or other capture content.
• Payment information: Apple processes App Store in-app purchases, including payment method, tax, receipts, refunds, and subscription administration, under Apple's terms. The web purchase provider is merchant of record and processes payer identity, payment method, billing address, tax, invoices, refunds, disputes, and related transaction information under its terms. Kioku receives verified product, transaction, purchase, and subscription state needed to provide the plan, but does not receive complete payment-card details from either provider.
• Access-request information: If you submit the website access-request form, the name and email address you provide are processed separately from your private capture archive.

3. How We Use Information

• Authenticate you and keep each account's archive separated.
• Capture, synchronize, index, search, summarize, and display your personal activity memory.
• Return only the evidence needed to answer a search or recall request you make through Kioku or a connected assistant.
• Automatically transcribe audio, understand screenshots, diarize speakers, and learn people and voice profiles for recall.
• Provide features you configure, such as signed webhook automations and generic memory-ready alerts.
• Protect the service with account controls, short-lived access tokens, and shared durable rate limits.

Kioku does not sell your personal information, use your private archive for advertising, or train a Kioku model on your archive.

You are responsible for telling everyone recorded that recording is active and obtaining their agreement before recording them, as well as any additional notice or consent required by applicable law. Do not record where recording is prohibited.

4. Where Information Is Processed and Who Receives It

• Your Mac: The Mac app captures bounded microphone/system audio and screenshots, attaches authoritative timestamps plus available application, window, display, and browser context, and uploads them. To avoid losing an accepted capture during an ordinary outage, it can keep a bounded, account-scoped, AES-GCM-encrypted local retry queue that is excluded from device backups. Cloud synchronization and understanding require connectivity. The app may continue protected capture while offline only under previously established account and allowance authority; it stops when that authority expires or cannot be established.
• Your iPhone: The current iPhone app captures and queues bounded microphone audio and photos you explicitly take in Kioku, with authoritative timing and device/stream metadata. Camera permission is required to take a photo. It requests no photo-library access and does not capture the iPhone screen. Compatibility code can also repair and replay images already present in an older account-scoped durable queue. Neither Apple app transcribes, OCRs, diarizes, identifies speakers, or builds a local search index. Apple permission dialogs and platform recording indicators still apply.
• Kioku cloud service: Capture events are accepted by Kioku over encrypted connections. Authorization, media decryption, voice inference, and processing run in the service with restricted access. Persistent raw audio, screenshots, and camera photos are encrypted per user before storage and scheduled for pruning after 30 days; the dedicated current-media bucket has a 35-day orphan lifecycle failsafe. Account, authorization, transcript, OCR, browser, memory, people/voice, search, job, and delivery state is queryable in a private structured database. Transport and storage are encrypted, with backups and point-in-time recovery. The database engine and authorized service-provider and Kioku database administrators can access structured plaintext; this is not end-to-end encryption.
• Apple and Google identity services: Apple or Google processes the sign-in you choose under its applicable terms. Kioku verifies the returned provider evidence and maps the namespaced provider subject to your canonical Kioku account; provider email is display and admission data, never account-link proof.
• Apple Push Notification service: If you enable ready alerts on an Apple device, Apple receives that device's push token, the Kioku app topic, a generic alert, and delivery timing. Apple does not receive Kioku memory content or your Kioku account identity in the notification. Focus, Scheduled Summary, device state, and system notification settings control whether an accepted alert is displayed.
• Apple App Store commerce: If you purchase in the iPhone app, Apple processes the transaction and sends Kioku signed transaction and subscription evidence. Kioku binds verified evidence to the signed-in account before enabling the plan. Apple, not Kioku, handles the payment method and App Store refund workflow.
• Cloud understanding: Bounded raw audio, screenshot pixels, and camera photos are sent from Kioku to cloud processors for timestamped transcription, speaker separation, OCR, image understanding, and photo-to-memory association. Settled-episode transcripts, OCR, application and window provenance, exact URLs, browser-tab metadata, and derived textual context may also be sent for summaries and recall features. Voice embeddings and persistent identity matching are computed separately inside Kioku. Named recipients and their terms are disclosed in the Terms of Service.
• Live captions: After you separately allow live-caption processing on your Mac or iPhone, Kioku streams your selected audio source (microphone, or Mac system audio when selected) through its authenticated service to a transcription processor for live transcription, temporary speaker separation, and optional translation. This runs only while the live-caption view is open and your subscription or trial permits recording. Kioku does not persist the live transcript or audio in a separate caption archive; normal recording storage and final memory processing retain their existing policies. Live-caption audio and transcripts for production are processed in the United States. Closing live captions stops future streaming but cannot recall already processed audio. Processor-specific content retention, training, and account-data limits are in the Terms of Service.
• Saved recordings: Kioku automatically chooses a transcription processor for eligible new recordings. Uploaded audio and transcripts may be stored temporarily in the configured United States or European Union region. Kioku requests deletion after processing and when the account is deleted; cleanup can remain pending. The asynchronous transcription service has a documented 30-day automatic deletion period. Additional cloud processors may receive audio for transcription fallback, and transcripts and related text for memory authoring. Voice matching and profile learning run inside Kioku under existing voice permissions. This does not enable live captions or change older recordings. Named processors and their retention terms are in the Terms of Service.
• Additional text processing (owner trial): The service owner's explicitly authorized trial may send transcripts, OCR, application and window provenance, URLs, browser-tab metadata, and derived text to an additional processor for summaries, reconciliation, and related text processing. Other accounts retain their existing processing policy. Voice embeddings and biometric identity matching stay inside Kioku. Disabling stored responses does not provide zero retention: abuse-monitoring logs may include prompts and responses for up to 30 days, or longer when legally required or necessary to protect the service or others. Temporary prompt caching can also retain processed representations. No approved zero-retention arrangement or particular processing region is promised for this trial. The named processor, its training policy, and data-control documentation appear in the Terms of Service.
• Your connected assistant: When you intentionally connect Kioku and make a recall request, the requested evidence leaves Kioku over HTTPS and is processed by that assistant provider under its own terms and privacy policy. Kioku sends no archive content to an assistant until an authorized tool request is made.
• Your webhook destination: If you configure a webhook, Kioku sends signed events to the HTTPS destination you choose. That destination is outside Kioku and processes the event under its own terms. Deleting the webhook stops future deliveries and cancels pending ones, but Kioku cannot retract data the destination already accepted.
• Web purchase service: For web subscription purchases or management, Kioku shares a random billing account identifier and selected plan with its purchase provider; no capture content is sent. The merchant and its buyer terms are identified in the Terms of Service.
• Access-request service: An access-request form sends only the name and email address you enter to its form processor, separately from capture content. Named service details are in the Terms of Service.

Explicit iPhone AI permission: Before the iPhone app starts recording, takes a photo, uploads media, or replays saved capture content, it asks you to allow cloud processing of recordings—which contain biometric voice characteristics—and camera photos for transcription, speaker separation, image understanding, and photo-to-memory association. Transcripts and related text are processed to create memories. Kioku chooses backend processors automatically under the recipient policy described in the Terms of Service, and separately derives voice profiles in its cloud to recognize speakers over time. Choosing Not Now starts no new recording and leaves any already-saved queue on the device subject to the displayed local-storage and quota rules. A material change to the processing permission requires a renewed Allow choice in the updated app, including for queued uploads. You can withdraw it at any time from the iPhone Profile menu; withdrawal stops new capture and future uploads, but cannot recall processing already completed. Account deletion remains available in Settings.

5. AI-Assistant Connections

Connecting Kioku to ChatGPT or another supported assistant uses OAuth authorization. The connection grants read-only access to search your own Kioku archive; it does not let the assistant start or stop capture, edit your archive, send email, or delete data. Access tokens are short-lived, and refresh authorization expires after 90 days unless renewed. You can disconnect Kioku in the assistant's connection settings, and deleting your Kioku cloud account invalidates its Kioku authorization.

Kioku's assistant tools must not be used to seek payment-card data, health information, government identifiers, passwords, API keys, access or refresh tokens, private keys, recovery secrets, or MFA and one-time authentication codes. Targeted transcript and screen searches are refused before archive retrieval. All successful assistant tool results pass through the same restricted-data checks inside Kioku, including transcript text, OCR, links, surrounding context, chronological digests, episode summaries, action items, minute summaries, and final briefs. Matching content is replaced rather than returned; malformed URLs and oversized text fail closed.

Only connect Kioku to an assistant account you trust. Content returned to an assistant may remain in that provider's chat history according to the settings and retention rules of that service.

6. Data Retention and User Controls

• Raw cloud media: Encrypted audio, screenshots, and camera photos are scheduled for application deletion after 30 days. The dedicated current-media bucket adds a 35-day orphan lifecycle failsafe.
• Derived cloud archive: Transcripts, OCR text, metadata, summaries, learned people, voice profiles, facts, and source evidence remain in Kioku's private structured database until you delete your cloud account or the service is discontinued. Kioku does not use inactivity alone to silently delete your archive.
• OAuth authorization: Kioku access tokens expire after approximately 15 minutes. To keep the web dashboard signed in across reloads, that browser profile stores one rotating Kioku refresh credential in local storage for up to 90 days; signing out removes it. Provider tokens and memory content are not stored there. Same-origin script injection, a hostile browser extension, another person using that browser profile, or device compromise could access the refresh credential. AI-assistant refresh authorization separately expires after 90 days or earlier if disconnected or the account is deleted.
• Subscription and AI-cost records: Kioku retains its pseudonymous plan projection, verified App Store or web purchase/subscription references, and idempotent allowance and per-inference content-free model/location/status/token ledgers while the account is active. Account deletion removes the operational account and cascades those active ledgers. A one-way keyed account tombstone remains to stop late provider events from recreating a deleted account. When an App Store purchase or purchase attempt needs post-deletion handling, Kioku also retains a separate content-free, pseudonymous Apple cleanup record: an encrypted random App Account Token; encrypted original and latest Apple transaction identifiers, environment, status, and event/deletion times when present; and keyed reference hashes used to route late Apple events. This narrow record is used only to preserve the deletion fence, handle a late approval, cancellation, revocation, or refund, and complete Apple cleanup. It contains no email, Apple or Google sign-in identity, recording, transcript, screenshot, URL, device identifier, AI prompt or response, or other capture content. No fixed deletion interval is promised for the tombstone or Apple cleanup record; Kioku retains them for the continuing deletion fence and related provider, refund, accounting, security, or legal obligations. Purchase providers may separately retain financial records required by law and their terms.
• Export: You can download the supported structured JSON export from Web Dashboard Settings. It includes structured account and memory data plus a metadata inventory of retained media; it does not include raw audio or image bytes.
• Deletion: You can purge your cloud account from Settings. This removes capture metadata, raw-media objects, transcripts, OCR text, episode summaries, learned people, facts, identity evidence, voice profiles, retained reference embeddings and samples, account preferences, stored OAuth grants, push installations and delivery handoffs, webhook endpoints, and webhook signing secrets from Kioku's live serving systems. Database backup and point-in-time-recovery copies expire under their bounded retention schedule rather than being synchronously rewritten. Deletion does not retract content already transferred to ChatGPT, Apple, a webhook destination, or another provider.
• Controls: You can pause capture, withdraw iPhone AI permission from Profile, disable ready alerts per device, disconnect an assistant, delete webhook destinations, export supported account data, or delete your account. Mac audio/screenshots and automatic voice/person learning remain part of the Mac cloud-capture pipeline; on iPhone, AI processing and every media upload remain blocked until the explicit permission described above is current. Disabling ready alerts cancels future sends best-effort; a generic alert already accepted by Apple cannot be recalled. Deleting a webhook cancels its pending deliveries.

7. Security

Kioku uses encrypted connections, private encrypted structured storage, and per-user application encryption for large media. Structured cloud storage is conventional managed storage, not end-to-end encryption: its database engine and authorized administrators are trusted. The service providers are identified in the Terms of Service. No system is perfectly secure, so please report suspected security or privacy issues promptly through our Support page.

8. Changes and Contact

We may update this policy as Kioku changes. We will update the effective date and provide additional notice when required. For privacy questions or requests, contact privacy@kiokuu.com. For product help, visit kiokuu.com/support.