K.C.O AI Privacy Policy

1. Introduction

This Privacy Policy explains how KCO AI ("we", "our", or "us") collects, uses, discloses, and safeguards your information when you use the K.C.O AI Android application (the "App") and its related services.

By downloading, accessing, or using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with any term of this policy, please do not use the App.

This policy applies to information we collect through the App, through our backend services, and through any communications you have with us.

2. Information We Collect

2.1 Information You Provide Directly

• Account information: When you create an account, we collect your email address, display name, and profile picture (if provided). This is used to create and manage your account.
• Optional GitHub connection: If you choose to connect your GitHub account, we collect your GitHub username, profile picture, and the permissions (scopes) you grant. Your GitHub access token is stored securely on our servers and is never exposed to the app or to other users.
• AI provider API keys: If you add your own AI service keys (for example, OpenAI or Gemini), these keys are stored in encrypted form on your device. Keys you provide for our free AI tier are stored encrypted on our servers. We never display your full keys.
• User-generated content: Content you create in the App, such as chat messages, AI prompts, project files, documents, templates, and other data you save or upload.

2.2 Information We Collect Automatically

• Device information: We may collect technical information about your device, such as device model, operating system version, app version, and language settings, to ensure the App works correctly and to diagnose issues.
• Usage data: We track aggregate usage of the free AI tier (for example, the number of AI requests you make per day) to enforce fair-use limits and show you your usage. We do not use this to build advertising profiles.
• Network information: Network type and connectivity status so the App can manage features that depend on an internet connection.
• Crash and performance data: Basic diagnostic information needed to detect and fix errors and improve reliability.

2.3 Information Stored on Your Device

Some information is stored locally on your device and is not sent to our servers unless you choose to sync or upload it. This includes your chat history, app settings, favorite templates, and your saved projects. Your AI API keys are encrypted at rest on your device.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account and authenticate you;
• Provide, operate, and maintain the App's features and services;
• Process AI requests you make, including forwarding prompts to the AI providers you select;
• Store and sync the files and projects you upload to your private storage;
• Manage the optional GitHub connection you authorize;
• Enforce fair-use limits on the free AI tier and display your usage;
• Respond to your support requests and communicate with you;
• Detect, prevent, and address technical issues, fraud, or security incidents;
• Improve the App's performance, reliability, and user experience.

4. Data Sharing and Third-Party Services

We do not sell your personal information. We only share your information with the following categories of third parties, strictly to operate the App:

4.1 Backend Infrastructure

We use Supabase, a cloud service provider, to host authentication, the database that stores your account and app data, and your private file storage. Supabase processes this data on our behalf under a data processing agreement and industry-standard security measures.

4.2 AI Providers

When you use AI features, the prompts and content you submit are transmitted to the AI provider you select (for example, Groq, OpenAI, or Google Gemini) to generate a response. When you provide your own API key, your requests go directly to that provider using your key. For the free AI tier, requests are routed through our secure server-side proxy. These providers may process data under their own privacy policies.

4.3 GitHub

If you connect your GitHub account, we interact with GitHub's APIs using the access token you authorize. The token is stored server-side and used only to provide the connection features you enable (for example, repository and code integration). GitHub's own privacy policy governs your use of their service.

4.4 Legal and Compliance

We may disclose your information where required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of KCO AI, our users, or others.

5. Data Security

We take reasonable and appropriate technical and organizational measures to protect your information from unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using industry-standard TLS/HTTPS;
• Encryption of sensitive data (such as your AI API keys and GitHub tokens) at rest;
• Row-level security and access controls on our database so you can only access your own data;
• Server-side handling of secrets, so sensitive credentials are never embedded in the app itself;
• Restricted access to personal data to personnel and systems that need it.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you the App's services, and otherwise for as long as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Data stored locally on your device (such as chat history and settings) remains on your device until you delete it or uninstall the App.

7. Children's Privacy

The App is not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at the email address below, and we will take steps to delete such information promptly. In jurisdictions where a higher age threshold applies (for example, 16 in the European Economic Area), we apply that higher threshold.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you;
• Correction: Request that we correct inaccurate or incomplete information;
• Deletion: Request that we delete your personal information and account;
• Restriction and objection: Request that we limit how we process your data, or object to certain processing;
• Portability: Request a machine-readable copy of data you provided;
• Withdraw consent: Withdraw any consent you previously gave, at any time.

To exercise any of these rights, contact us using the details in Section 10. We will respond within a reasonable time and in accordance with applicable law.

8.1 Deleting Your Account

You can request deletion of your account and the associated data at any time by contacting us at the email address in Section 10. Upon deletion, your profile, stored files, projects, and linked connections are permanently removed from our systems. Deleting the App from your device also removes locally stored data. Data that we are legally required to retain will be kept only for as long as required and handled securely.

9. International Data Transfers

Your information may be processed and stored on servers located in countries other than your own, including through the cloud providers listed above. We take steps to ensure that such transfers comply with applicable data protection law, for example by relying on the provider's compliance with appropriate safeguards such as the EU Standard Contractual Clauses.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" at the top of this page and, where appropriate, notify you through the App. Continued use of the App after changes take effect constitutes your acceptance of the revised policy.

11. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal information, you can contact us at:

• Developer / Data Controller: KCO AI
• Email: odenyizabeya@gmail.com

We will make every effort to resolve your concerns promptly and fairly.