Privacy

Draft

How the backup tool works today, and how private accounts and chat are designed to work when enabled. This is a draft for the closed M2 release.

The local backup tool

Parsing, previews and converted downloads run on your device. Koimo does not connect to Character.AI or access your account there. Files are uploaded only when you explicitly choose to save them to your private library. Keep your original files.

Your account and private library

When accounts are enabled, we use Supabase for authentication, database storage and private files. We store your email, sign-in information, private character definitions, chats and the memories needed to continue them. Access is restricted to your account through server checks and database policies. This is not end-to-end encryption.

Age and location

Koimo chat is for adults aged 18 and over. We check the date of birth you submit without storing the date itself. We keep an age-check timestamp and account status. We derive your country from trusted hosting location information and retain it to enforce provider routing and regional availability. A statement that you are under 18 pauses chat and may require an age review.

Where your chats are processed

Outside the EU/EEA, UK and Switzerland, the configured chat provider is DeepSeek’s official API, and chats are processed in China. In the EU/EEA, UK and Switzerland, chats are processed by DeepInfra in the United States under DeepInfra’s data processing agreement. Your message, character information, relevant history and memory are sent to the provider to generate and classify replies; background memory and rebuild features also require provider processing. Do not include information you do not want a provider to receive.

Protected regions and provider retention

Chats from the EU/EEA, UK and Switzerland are never sent to DeepSeek. Routing checks both the country saved when you signed up and your current location, and a chat that has used the protected route stays on it. DeepInfra states that it does not store prompts or replies after processing and does not train on them. Koimo does not claim that a consent checkbox changes this routing. Provider retention and training terms apply independently; deleting a Koimo account cannot recall requests already sent to a provider. A no-training or zero-retention promise has not been established for DeepSeek.

Safety and usage records

Automated safety checks can replace a reply with an out-of-character response or pause chat. Safety-event records contain categories and identifiers, without message text. Usage records contain token counts, provider/model information, request status and cost estimates. Private-message reports, if enabled later, share text with the operator only with explicit user consent.

Optional export outlines

If you choose to submit an unsupported export outline, we receive the preview you approve: keys, value types, counts and optional file names. Original files and message values are not sent. Names and keys can still contain personal information, so review them first. Outlines are deleted within 30 days; hourly keyed IP hashes used for abuse prevention are deleted within 24 hours. Hosting infrastructure may keep request metadata separately.

Analytics, security and cookies

When configured, PostHog counts page views and product events without character names, chat text or file contents. It uses in-memory analytics persistence, with session recording and automatic interaction capture disabled. Authentication uses necessary session cookies. Cloudflare Turnstile protects account access and may process browser and network information to prevent abuse.

Export and deletion

Keep local backups and download converted files without an account. Account settings let you request deletion of your account, private characters, chats, memories, embeddings and stored originals. Interrupted cleanup is retried. Previously issued file links expire after 60 seconds. Deleted data can remain in database backups until the configured backup retention period expires; the actual project plan and period must be published before accounts open.

Waitlist and changes

If the waitlist is enabled, we store your email and the country from which you join, to notify you about availability and decide which regions to open. We will update this notice when processing, providers or availability change.

Details still to be completed

Before public accounts open, this draft needs the operator’s legal name, business address and privacy contact; the actual hosting regions, backup retention period and provider retention settings; applicable request procedures and regional notices. These details are not yet configured. Do not treat this draft as confirmation that chat is publicly available.

Privacy · Terms · Content policy

Provider references

DeepSeek privacy policy · DeepInfra privacy policy · Supabase backup retention