This Privacy Policy explains how KAIROA LTD collects, uses, stores, and shares personal information when you use Kairoa, including the Kairoa website at https://kairoa.app, any Kairoa-operated subdomain of kairoa.app, Kairoa applications, Kairoa+, and related support and communications (together, the “Service”).
Kairoa is intended for individuals using the Service for personal hobbies, interests, and everyday note-taking.
1. Who we are
KAIROA LTD is the controller of personal information covered by this Privacy Policy.
KAIROA LTD
Company number: 16728435
Registered in: England and Wales
Registered office: Business Incubation Centre Enterprise Hub, De Havilland Campus, Hatfield, Hertfordshire, England, AL10 9EU
Website: https://kairoa.app
Privacy contact: hello@kairoa.app
KAIROA LTD does not currently have an establishment or appointed privacy representative in the European Economic Area (“EEA”). An EEA representative’s details will be added here if and when one is appointed.
2. A short privacy summary
- You can use non-Kairoa+ features without creating an account. In that case, notes and preferences may remain only on your device or in your browser.
- If you create an account or use Kairoa+, we process account information and may store and sync your notes, images, drawings, tags, preferences, and related metadata through Appwrite Cloud.
- Kairoa does not currently use third-party advertising or analytics SDKs.
- Kairoa does not sell personal information, use note content for advertising, or train artificial-intelligence models on note content.
- RevenueCat processes identifiers, device information, and purchase information to provide subscriptions.
- Synced content is protected while being transmitted, but it is not end-to-end encrypted. This means authorised KAIROA LTD personnel and our cloud provider may be technically able to access server-held content where necessary.
- You control what you put in your notes and whom you share it with.
- You can export your notes and request deletion of your account.
- Marketing is optional, is not intended for anyone known to be under 18, and can be turned off at any time.
3. Information for younger users
Kairoa is not for children under 13. If you are aged 13 to 17, you must have permission from a parent or legal guardian to use Kairoa.
In simple terms:
- Your notes belong to you.
- Notes stored only on your device are not sent to Kairoa unless you use a feature that uploads or syncs them.
- If you turn on Kairoa+ syncing, your account information and synced notes are sent to our cloud provider.
- Do not put someone else’s private information in a note or recording unless you have permission.
- Be careful when sharing a note. A recipient may be able to copy or save it.
- We do not send marketing to users we know are under 18.
- You can ask us what information we hold about you or ask us to delete it by emailing hello@kairoa.app. A parent or guardian may help you.
Parents and guardians should review this Policy and the Kairoa Terms of Use and End User Licence Agreement with younger users.
4. Personal information we collect
4.1 Information you provide
Depending on how you use the Service, you may provide:
- Account and identity information: email address, Appwrite user ID, display name, authentication method, session information, and information returned by Apple or Google when you choose their sign-in service.
- User Content: note titles and bodies, tags, images, drawings, files, audio recordings where that feature is available, shared or collaborative content, and content placed in the trash.
- Content metadata: note and file identifiers, creation or modification times, deletion markers, image references, sync revisions, and sharing permissions.
- Preferences: theme, accent colour, text scale, motion preference, and other app settings that you choose to sync.
- Purchase information: selected plan, subscription status, entitlement, transaction and renewal dates, store, discount code, purchase or restore status, and a Kairoa payment-audit record.
- Marketing preference: whether you confirmed that you are 18 or over and voluntarily opted in to marketing, together with the date and method of that choice.
- Communications: information you include in support requests, content reports, complaints, privacy requests, feedback, and other correspondence.
4.2 Information collected automatically
When you access the website, sign in, sync, or use online features, we and our service providers may automatically process:
- IP address and approximate location derived from it;
- device type, operating system, browser type, app version, and language or time-zone settings;
- request date and time, requested path, response status, duration, and similar server or access-log information;
- authentication, account, database, storage, and security events;
- random or account-linked service identifiers;
- subscription SDK events, last-seen time, Apple receipt information, Google purchase tokens, and similar transaction validation data; and
- cookies, local storage, session storage, or similar technologies needed to remember a session, store local notes and preferences, secure the Service, and provide requested features.
4.3 Information from other sources
We may receive information from:
- Apple or Google, when you use their sign-in or payment services;
- RevenueCat, including subscription status, transaction information, entitlements, and customer identifiers;
- another user, when they invite you to collaborate or include information about you in shared content; and
- authorities or other people, when they make a lawful report or request concerning the Service.
4.4 Sensitive information in notes
Kairoa does not ask you to place health information, political opinions, religious beliefs, biometric or genetic information, information about sex life or sexual orientation, or other legally protected sensitive information in a note. However, because Kairoa is a general-purpose note-taking service, you may choose to include such information.
We do not use sensitive note content for advertising, profiling, or an unrelated purpose. We process it only to provide features you request, keep the Service secure, comply with law, or establish, exercise, or defend legal claims. Do not upload sensitive information about another person unless you are legally entitled to do so. Where applicable law requires a separate condition or express consent for particular sensitive-data processing, we will request it or will not carry out that processing.
5. Why we use personal information and our legal bases
For UK and EEA data-protection law, we rely on the following legal bases:
| Purpose | Information typically used | Legal basis |
|---|---|---|
| Provide local, account, sync, sharing, export, and Kairoa+ features | Account information, User Content, metadata, preferences, and technical requests | Performance of our contract with you, or steps requested before entering it |
| Authenticate users and maintain sessions | Email address, verification code records, user ID, Apple/Google sign-in data, session identifiers, IP address, and device information | Performance of contract; our legitimate interests in secure account access |
| Process and administer subscriptions | User ID, selected plan, entitlement, store, receipts or purchase tokens, transaction dates, discount code, and payment records | Performance of contract; compliance with tax and accounting law; legitimate interests in preventing payment fraud |
| Operate, troubleshoot, protect, and maintain the Service | Technical data, access and security logs, account events, and limited content where necessary | Our legitimate interests in providing a reliable and secure service, preventing fraud and abuse, and protecting users and KAIROA LTD |
| Enable sharing and collaboration | User Content, recipient or membership information, permissions, and activity metadata | Performance of contract; legitimate interests in providing user-requested collaboration |
| Moderate content and investigate reports | Report details, account information, relevant User Content, security logs, and communications | Compliance with legal obligations; legitimate interests in safety, enforcing our Terms, protecting rights, and preventing unlawful use |
| Respond to support, complaints, and privacy requests | Contact details, messages, account information, and information needed to verify and answer the request | Performance of contract; compliance with legal obligations; legitimate interests in supporting users and resolving disputes |
| Send essential service communications | Email address, account and subscription status, and security or service events | Performance of contract; compliance with legal obligations; legitimate interests in keeping you informed about the Service |
| Send optional marketing to adults | Email address, confirmation that you are 18 or over, marketing choice, and suppression preference | Consent, or a permitted existing-customer exception where all legal requirements are met |
| Establish, exercise, or defend legal claims and complete corporate transactions | Information relevant to the claim, audit, transaction, or due diligence | Legal obligations and our legitimate interests in protecting and operating the business |
Where we rely on legitimate interests, we consider the necessity of the processing, its likely effect on you, and safeguards that reduce privacy impact. You may object as explained in section 14.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before it.
If information is required to create an account, provide syncing, complete a purchase, or satisfy law, failing to provide it may mean that we cannot provide the relevant feature.
6. Local storage, cookies, and similar technologies
Kairoa uses browser local storage and similar device storage to save local notes, trash, tags, preferences, authentication-session information, and other feature state. This lets non-Kairoa+ features work without an account and supports requested functionality.
The website and Appwrite may use cookies or equivalent identifiers that are strictly necessary for authentication, security, load balancing, fraud prevention, and delivery of the Service. Kairoa does not currently use non-essential analytics, behavioural-advertising, or cross-site tracking cookies.
If we introduce a non-essential cookie or similar technology, we will update this Policy and, where required, ask for consent before using it.
You can clear local data using the Service or your browser or device settings. Doing so may sign you out or permanently delete information that was never synced.
7. Marketing
Marketing email is optional. During sign-up, a user is shown a separate, unticked choice that:
- confirms the user is 18 or over; and
- asks whether the user wants marketing email from Kairoa.
Agreeing to marketing is not required to create an account or use the Service. We do not send marketing to anyone we know is under 18.
You can withdraw your choice through the marketing setting in the Service or through the unsubscribe facility included in each marketing email. We may retain a minimal suppression record after you unsubscribe so that we respect your choice.
Essential messages—such as login codes, receipts, subscription notices, security alerts, changes to legal terms, and replies to your requests—are not marketing and may still be sent where necessary.
KAIROA LTD has not yet selected a marketing-email provider. We will not begin marketing through a provider until we have assessed it, entered appropriate data-protection terms, updated this Policy if needed, and configured the required consent and unsubscribe controls.
8. When we disclose personal information
We may disclose personal information to:
- Appwrite Cloud, which hosts the website and provides authentication, database, file storage, email-token delivery, logs, and related backend infrastructure;
- RevenueCat, which manages subscriptions and processes customer identifiers, device information, purchase history, receipts or tokens, and entitlement information;
- Apple and Google, when they provide sign-in, app distribution, purchases, refunds, or subscription management;
- collaborators and recipients you choose, when you share content or invite someone to work with you;
- a future marketing-email provider, but only after the steps described in section 7;
- professional advisers, insurers, auditors, and vendors that need information to support KAIROA LTD and are subject to appropriate confidentiality or data-protection obligations;
- courts, regulators, law-enforcement bodies, emergency services, and other authorities where disclosure is required or permitted by law or is reasonably necessary to protect a person, rights, safety, or the Service; and
- a buyer, investor, lender, or successor in connection with a genuine financing, merger, reorganisation, sale, or transfer, subject to appropriate safeguards.
We do not sell personal information. We do not share personal information for cross-context behavioural advertising or use User Content to deliver targeted advertising.
Service providers may process information only for authorised purposes under their agreements with us, unless they separately act as an independent controller—for example, Apple or Google in parts of their direct relationship with you.
9. International data transfers
The Appwrite project currently used by Kairoa is configured in Frankfurt, Germany. Appwrite Sites may also use distributed network and edge infrastructure to deliver the website securely and efficiently.
RevenueCat is based in the United States and states that its customer data is stored using Amazon Web Services in the United States. Apple, Google, and other providers may process data in countries described in their own privacy documentation.
When personal information is transferred from the UK, EEA, or another jurisdiction that restricts international transfers, we use an available lawful mechanism appropriate to the transfer. This may include:
- a government adequacy regulation or decision;
- the UK International Data Transfer Agreement or UK Addendum;
- European Commission Standard Contractual Clauses;
- a provider’s binding legal commitments; and
- supplementary technical and organisational safeguards where appropriate.
You may contact hello@kairoa.app for more information about a relevant transfer mechanism.
10. Sharing and recordings
When you share a note, file, or recording, the selected recipient may receive the personal information it contains and may be able to copy, download, edit, re-share, or retain it. Check the recipient and permissions before sharing.
If you record audio, you are responsible for giving any notice and obtaining any consent required by the law that applies to the recording. Do not secretly record someone where doing so is unlawful.
Kairoa does not currently provide a searchable public-note directory or public content feed.
11. How long we keep information
We use the following retention periods or criteria:
| Information | Typical retention |
|---|---|
| Notes and other account content | While the account exists or until you delete the content, subject to sharing, backups, and legal holds |
| Valid account-deletion request | We aim to remove account content from active systems within 24 hours after verifying the request |
| Appwrite database backups | Daily backups retained for up to 7 days on the current Appwrite Pro plan; deleted active data may remain inaccessible in a backup until that backup expires |
| Appwrite application audit logs | Up to 7 days on the current Appwrite Pro plan |
| Appwrite Sites request logs | Up to 7 days on the current Appwrite Pro plan |
| Unverified account record created by an email-code request | Up to 30 days |
| Local notes and preferences | Until you delete them, clear app/browser storage, uninstall the app where this removes its data, or the device/browser removes them |
| Subscription and accounting records | Normally 6 years after the relevant transaction or the end of the relevant financial period, or longer where law, an audit, chargeback, or dispute requires |
| Support requests and ordinary complaints | Normally up to 2 years after closure; longer where needed for an active dispute, safeguarding matter, or legal claim |
| Content-safety and abuse records | For as long as reasonably necessary to investigate, protect users, prevent repeated abuse, comply with law, or establish or defend claims |
| Marketing consent records | While marketing continues and for a reasonable period afterward to demonstrate compliance |
| Marketing suppression record | For as long as reasonably necessary to ensure that we continue to honour the opt-out |
RevenueCat, Apple, Google, and other independent controllers may apply their own retention periods. Where a provider acts for us, we will request deletion or return in accordance with our agreement and applicable law.
We may retain information longer where required by law, a court order, tax or accounting obligations, fraud prevention, safeguarding, a security incident, or a legal claim. When exact retention cannot be fixed in advance, we consider the amount and sensitivity of the information, the purpose, security and legal risks, and applicable requirements.
12. Account deletion and export
You may use available in-platform tools to export notes or request account deletion. You may also contact hello@kairoa.app.
We may need to verify your identity before completing a privacy or deletion request. Account deletion does not cancel a subscription billed through Apple, Google, or another billing platform; cancel that subscription separately.
Deleting an account may not delete:
- local copies on your or another person’s device;
- copies lawfully retained by a collaborator or recipient;
- minimal suppression, transaction, security, or legal records; or
- temporary backup copies that will expire through the ordinary backup cycle.
13. Security
We use measures designed to protect personal information, including encrypted transmission, authentication and session controls, role-based or permission-based access, provider security features, limited personnel access, logging, backups, and procedures for responding to incidents.
However, no service can guarantee absolute security. Synced notes are not end-to-end encrypted. KAIROA LTD and Appwrite may be technically able to access server-held information where necessary to provide, secure, support, or troubleshoot the Service; respond to a lawful request; investigate abuse; or act with your authorisation.
Protect your email account and devices, use available device security, check sharing permissions, and keep independent exports of important information. Contact hello@kairoa.app promptly if you suspect unauthorised access.
14. Your privacy rights
Your rights depend on where you live and may be subject to legal exceptions.
14.1 UK and EEA rights
You may have the right to:
- request access to your personal information and a copy of it;
- correct inaccurate or incomplete information;
- request deletion;
- restrict processing;
- receive information you provided in a portable format and, where technically feasible, have it transmitted to another controller;
- withdraw consent at any time;
- object to direct marketing; and
- object to processing based on legitimate interests.
You have an absolute right to object to the use of your personal information for direct marketing.
You may also complain to a supervisory authority. In the UK, this is the Information Commissioner’s Office (“ICO”):
- Website: https://ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
If you are in the EEA, you may complain to the data-protection authority where you live or work or where you believe an infringement occurred.
14.2 Rights in other countries and US states
Depending on applicable law, you may have rights to:
- know or confirm whether we process your personal information;
- access, correct, or delete it;
- obtain a portable copy;
- opt out of its sale, use for targeted advertising, or certain profiling;
- withdraw consent; and
- appeal a refusal to act on a request.
Kairoa does not sell personal information or use it for targeted advertising. We do not discriminate against a person for exercising a privacy right.
14.3 Exercising your rights
Email hello@kairoa.app or use an available in-platform control. Describe your request and the account or email address concerned.
We may ask for information reasonably needed to verify your identity and authority. An authorised agent may make a request where applicable law permits, but we may require proof of authority and direct identity confirmation.
We will respond within the period required by applicable law. If we deny a request, we will explain why and how to appeal where required.
15. Automated decisions and artificial intelligence
Kairoa does not currently use artificial intelligence to process note content. We do not make decisions producing legal or similarly significant effects about you solely through automated processing.
If this changes, we will update this Policy and provide any notice, explanation, consent, or human-review right required by law before using the new processing.
16. Changes to this Policy
We may update this Policy when the Service, providers, laws, or our practices change. We will update the effective date and provide additional notice through the Service or by email where a change is material or the law requires it.
If we want to use personal information for a materially different purpose, we will provide appropriate notice and obtain consent where required.
17. Contact us
Questions, privacy requests, and complaints may be sent to:
KAIROA LTD
Business Incubation Centre Enterprise Hub
De Havilland Campus
Hatfield, Hertfordshire
England, AL10 9EU
Email: hello@kairoa.app
We encourage you to contact us first so that we can try to resolve your concern.