Privacy policy
Kynosis keeps your archive so you can find it again. This page says exactly what that involves: what we collect, who helps us process it, how long it stays, and how to take it back.
Who is responsible
Kynosis is made and run by Natalia Siricenko, an individual developer (“we”). She is the controller of the personal data described here. Questions about privacy go to privacy@kynosis.com.
Without an account
You can use Kynosis on one iPhone without signing in. Your saves then stay on that device only and we receive nothing about them, apart from the web page previews your phone fetches directly from the sites you save.
What we collect when you sign in
- Account: your email address, your name if you give it, and an identifier from Sign in with Apple or Google if you use them.
- Your archive: the links, text, notes, images, audio and files you save, and the tags, collections, summaries and answers made from them.
- Purchases: your plan, the App Store transaction identifier and its expiry date. We never see your card or Apple ID password.
- Devices: the name of each signed-in device and when it last synced, so you can sign it out.
- Usage metering: how much of the daily AI allowance you used, so the limit can be enforced.
- Diagnostics (off by default): if you turn on “Share diagnostics”, crash, hang and performance reports from Apple’s MetricKit, with the app version and device model — never the content of your saves.
- Support: what you write to us and anything you attach.
How we use it
- To run the service: store your archive, sync it between your devices and the web app, and back it up.
- To make tags, summaries, transcripts, digests and answers to your questions, when you save something or ask.
- To send the sign-in and password-reset codes you ask for, and service messages about your account.
- To verify purchases with Apple and apply your plan.
- To keep the service safe: rate limits, abuse prevention, and fixing errors.
We do not show ads, we do not track you across other apps or websites, and we do not sell or rent your data. Your archive is never used to train a model of ours.
Who processes it for us
We use a small number of providers, each bound by a data-processing agreement and only allowed to use your data to provide their service to us:
- Railway — application hosting and database.
- Cloudflare — file storage (R2), DNS and network protection.
- Resend — delivery of sign-in and reset emails.
- AI model providers — Google (Gemini API), OpenRouter and Novita AI — only for Kynosis Pro accounts: they receive the text of a save or a question only to return a tag, summary, digest or answer, and receive no account details. Nothing a Core account saves is ever sent to an AI provider.
- Apple — payments, subscriptions and Sign in with Apple. Google — Sign in with Google, if you choose it.
Some of these providers process data outside the European Economic Area. Where they do, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.
Legal basis
We process your data to perform our contract with you (running the account and the features you use), to meet legal obligations (for example, tax records of purchases), and in our legitimate interest in keeping the service secure. Diagnostics are sent only with your consent, which you can withdraw in the app at any time.
How long we keep it
- A save you delete stays in Trash for 30 days, then is erased permanently.
- If you delete your account in the app (You › Account › Delete account), it is closed at once and everything is erased within 30 days.
- Server logs are kept for up to 30 days. Records of purchases are kept as long as tax law requires.
Your rights
You can see, correct, export and delete your data. Export the whole archive as Markdown and JSON from You › Export your archive; delete your account from You › Account. You can also ask us for a copy of your data, to correct or erase it, to restrict or object to processing, or to move it elsewhere — write to privacy@kynosis.com and we will answer within 30 days. If you are in the EU you may also complain to your data-protection authority; in Ireland that is the Data Protection Commission (dataprotection.ie).
Security
Data is encrypted in transit (TLS) and at rest. Access to production systems is limited to the people who run the service and is logged.
Children
Kynosis is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us data, write to us and we will delete it.
Changes
If we change this policy in a way that matters, we will say so in the app and update the date at the top before the change takes effect.