Privacy policy

Who is responsible

Kynosis is made and run by Natalia Sirichenko, an individual developer (“we”). She is the controller of the personal data described here. Questions about privacy go to [email protected].

Natalia Sirichenko, 47 Coill Diarmada, Castledermot, Co. Kildare, R14 Y563, Ireland · +353 87 333 1370

Where your data is

We run Kynosis from Ireland and keep everything in the European Union wherever we can. Our servers and our database are in the EU, with Contabo GmbH, a German hosting company. Where an EU provider exists for a job, we use it: our second email provider, Brevo, is French.

Not everything can stay in the EU, and we say so plainly. Files and encrypted backups are kept in Cloudflare R2; Cloudflare is a US company with a worldwide network, and we are moving our storage to its EU jurisdiction. Server AI is only for Pro accounts that switch it on, and it runs through OpenRouter (a US company), which passes each request to a model maker in the US or the EU. Resend (US) sends our sign-in emails, and Apple and Google handle their own sign-in and payments. We cannot tell where you are, so these protections are the same for everyone.

Your archive starts on your phone

Everything you save stays on your iPhone or Android phone, on every plan, with or without an account. We receive nothing about it, apart from the web page previews your phone fetches directly from the sites you save. An account on its own holds only your email, name and plan.

Kynosis Pro lets you choose to use our servers, one thing at a time, in You › Data and privacy. Each is off until you switch it on: Kynosis Cloud (your archive is stored with us so it syncs between your devices and the web app), summaries, tags and takeaways written by a server model, and assistant answers from a server model. The last two send text for an answer and do not need Kynosis Cloud: nothing is stored with us for them. A different account signing in on the same phone starts with all of them off and does not see or upload another account’s saves.

What we collect

• Account: your email address and an identifier from Sign in with Apple or Google if you use them.
• Your archive (only if you switch on Kynosis Cloud): the links, text, notes, images, audio and files you save, and the tags, collections, summaries and answers made from them.
• Waitlist (only if you join it on kynosis.com): your email address, the date and the language of the page you joined from. We use it only to write to you, in that language, when a spot opens, with an invite code. If you also tick the box for news and offers, we may write to you about Kynosis news and offers too; the box is off unless you tick it, we keep the date you agreed, and every such mail has a link that stops them at once.
• News and offers (only if you tick the box): a yes to marketing e-mail, with the date, kept with your account or your waitlist address. You can switch it off in the app or on the web, or with the unsubscribe link in any such mail; account and sign-in mails are not marketing and still arrive. We send no such mail without your yes.
• Purchases: your plan, the App Store transaction identifier (iPhone) or the Google Play purchase token (Android) and its expiry date. We never see your card or Apple ID password.
• Devices: the name and model of each signed-in device, an identifier of that install so one device appears once, the network address of its last request, and when it last synced, so you can sign it out.
• Account security (only if you use them): the public half of each passkey; an encrypted secret and hashed recovery codes for two-step verification; a key Apple vouches for that proves a request comes from the genuine app (no personal data); a short list of recent sign-in events with the first two parts of the network address.
• Usage metering: how much of the daily AI allowance you used, so the limit can be enforced.
• Statistics (off by default): if you turn on “Share statistics”, once a day the app sends a few ranges (for example “6–20 saves”, plan, app and system version, iOS or Android). It carries no account, device number, address or content, is not tied to your sign-in, and is only added to a counter.
• Crash reports (off by default): if you turn on “Share crash reports”, crash, hang and performance reports from Apple’s MetricKit, with the app version and device model — never the content of your saves. On Android the report comes from the app itself: the error and where it happened, the app and Android version and the phone model, never the content of your saves
• A link that could not be read (only when you tap “Report this link”): the name of the site (for example “example.com”, never the page, the title or any text) and a short reason. It is added to a counter and is not tied to you.
• Support and messages from the team: what you write to us in the app or by e-mail, the conversation that follows (our replies, signed with a first name), the app version and platform, and anything you attach. For Pro: the thumbs you give a summary or an answer and the line you may add, your votes on the request board, and your answer (or “not now”) to the two questions we ask once, on day 3 and day 14. A report of a wrong or harmful AI text carries only what you choose to attach.
• Voice and dictation (only when you tap the microphone): on Android the phone’s speech service may send the audio to its provider (usually Google) to turn it into words; Kynosis itself never receives the audio. A voice note is a file kept on your phone.
• Invitation link (Android): on the first start the app reads, once, the invitation code carried in the Google Play install link, through Google Play’s Install Referrer; it reads nothing else from it and it is used only to open your invitation.
• App check (Android, when it is switched on): when you create an account, the app asks Google Play Integrity whether it is the genuine app on a genuine phone and shows us a one-time answer. We keep no part of it.

How we use it

• If you switch on Kynosis Cloud, to store your archive, sync it between your devices and the web app, and back it up.
• If you switch on server AI, to make tags, summaries, transcripts, digests and answers to your questions, when you save something or ask.
• To send the sign-in and password-reset codes you ask for, and service messages about your account.
• To verify purchases with Apple or Google Play and apply your plan.
• To answer you, keep the conversation in one place, thank you when something you asked for is built, and see which summaries and answers help.
• To keep the service safe: rate limits, abuse prevention, and fixing errors; we email you when a new device signs in to your account or when someone keeps guessing its password.

If you add your own AI key (You › Assistant › Your own AI key), the text goes from your iPhone straight to the provider you chose, under their terms; the key stays in your phone’s secure storage (the Keychain on iPhone, the Keystore on Android) and we receive neither it nor the text. We do not show ads, we do not track you across other apps or websites, and we do not sell or rent your data. Your archive is never used to train a model of ours.

Who processes it for us

We use a small number of providers, each bound by a data-processing agreement and only allowed to use your data to provide their service to us:

• Contabo GmbH (Germany, EU) — our servers and database.
• Cloudflare — file storage and encrypted backups (R2), DNS and network protection, including the Turnstile check on the web sign-in page.
• Resend — delivery of sign-in and reset emails. Brevo (France, EU servers) — a second email provider, used only if Resend cannot deliver.
• OpenRouter (AI model routing) — only for Kynosis Pro accounts that switch server AI on: it receives the text of a save or a question only to return a tag, summary, digest or answer, and receives no account details. It passes each request on to the maker of the model it runs — only makers based in the US or the EU (such as OpenAI, Anthropic, Google or Mistral), and only providers that neither keep prompts nor train on them. Nothing a Core account saves is ever sent to an AI provider.
• Have I Been Pwned — when you choose a password, the first five characters of its hash (never the password, never your email) are sent to check whether it appears in a known data breach.
• Google — Google Play takes the payment for Android subscriptions; our server checks each purchase with the Play Developer API and receives subscription events through Google Cloud Pub/Sub; Play Integrity (when switched on) tells us whether a sign-up comes from the genuine app. We receive the purchase token, product and expiry, never your card.
• Paddle (UK, EU) — the seller of record for web purchases: it takes the payment, collects and pays the sales tax and sends the invoice. We receive your plan, the subscription status and the e-mail used for the purchase, never your card number. Apple — payments, subscriptions and Sign in with Apple. Google — Sign in with Google, if you choose it. The web sign-in page loads Apple’s and Google’s own sign-in scripts from them, so those companies see that your browser opened it.

Some of these providers process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

Legal basis

We process your data to perform our contract with you (running the account and the features you use), to meet legal obligations (for example, tax records of purchases), and in our legitimate interest in keeping the service secure. Anything that leaves your iPhone because you switched it on (Kynosis Cloud, server AI, crash reports, statistics) or asked for (reporting a link) rests on your consent or on the contract for the feature you chose, and you can switch it off again in the app at any time.

How long we keep it

• A save you delete stays in Trash for 30 days, then is erased permanently. You can erase your whole cloud copy yourself at any time (You › Data and privacy › Delete my cloud copy); that is immediate, and files follow within hours.
• When Pro ends (cancelled, refunded or a renewal that could not be charged), your cloud copy stays readable for 30 days so you can download it to your iPhone, then it is erased. We email you when it starts and a week before.
• If you delete your account in the app (You › Account › Delete account), it is closed at once and everything is erased within 30 days.
• A waitlist address is removed 60 days after we send the invitation, or after 12 months if you were never invited, or at once if you ask.
• Conversations with the team, thumbs and the lines typed with them are kept for 24 months after their last activity and then deleted (they are deleted with your account too). Server logs are kept for up to 30 days. Records of purchases are kept as long as tax law requires. The cost of AI use is kept as amounts per day; when an account is erased, the link to the person is removed from them.
• Backups of our database are kept for at most 35 days and then deleted, so data you erase can remain in a backup for that long; it is never restored for use, and erased accounts are removed again if a backup is ever restored.

Your rights

You can see, correct, export and delete your data. Export the whole archive as Markdown and JSON from You › Export your archive; download everything we hold about your account as a JSON file from You › Data and privacy; delete your account from You › Account. You can also ask us for a copy of your data, to correct or erase it, to restrict or object to processing, or to move it elsewhere — write to [email protected] and we will answer within 30 days. We make no decisions about you by automated means that have legal or similarly significant effects; tags, summaries and answers only organise your own saves. If you are in the EU you may also complain to your data-protection authority; in Ireland that is the Data Protection Commission (dataprotection.ie).

United Kingdom: the same rights apply under UK data-protection law; you may complain to the Information Commissioner’s Office (ico.org.uk). United States (including California): you can ask us what personal data we hold, to correct it, to delete it, and to have a copy; we do not sell or share personal data for advertising and do not use it for profiling, and we will not treat you differently for asking. Write to us as above; we answer within 45 days.

Cookies and storage in your browser

kynosis.com sets no cookies and loads nothing from other companies. The web app at app.kynosis.com keeps your sign-in in your browser’s storage, and its sign-in page uses Cloudflare Turnstile to tell people from bots, which may set a security cookie. Both are needed for the service to work, so they need no consent; there are no analytics or advertising cookies.

Security

Data is encrypted in transit (TLS). Passwords are stored only as salted hashes, and sign-in tokens and one-time codes only as hashes. Secrets we must read back (for example two-step verification secrets and webhook signing keys) are encrypted in our database, and backups are encrypted before they leave our servers. Files in Cloudflare R2 are encrypted at rest by Cloudflare. Access to production systems is limited to the people who run the service and is logged. If a breach ever puts your data at risk, we report it to the Data Protection Commission within 72 hours and tell you without undue delay.

Children

Kynosis is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.

Changes

If we change this policy in a way that matters, we will say so in the app and update the date at the top before the change takes effect.