Your notes stay on your iPhone.

01Your notes stay on your device

Your notes, each with its date, time and time zone, your profile name, categories, projects and settings are stored in a local database on your iPhone. So are up to five recent searches, which Premium chapters you opened while subscribed and the subscription details the App Store last confirmed (plan, price, renewal date, trial and store customer ID). The app reads this data locally to provide its features. Reports (weekly, monthly, seasonal and yearly chapters, weekly prep and career review) are calculated on the device from your own notes. No text leaves the phone for that.

If you delete the app, the local database is deleted with it. Exports and device backups are separate copies under your control; Kipo has no backup or restore service.

02What is not collected

There is no sign-up. The profile name you enter stays in the local database. The app does not request your email address, phone number, contacts, photos or precise location. Subscription and analytics services use the identifiers described below. The app does not use advertising SDKs and shows no ads. The terms, this policy and support open in a Safari view inside the app; Kipo passes nothing to those pages.

03Optional features and the data they use

Face ID lock. If you turn on the lock, the app asks iOS to verify you with Face ID or your passcode before opening. The check is done entirely by iOS. Kipo never receives or stores biometric data. This lock covers the interface and app-switcher preview; it does not encrypt the database.

Reminders. The evening nudge and the weekly recap are local notifications scheduled on the device. They are not sent through a push service, and no notification content leaves the phone. If usage analytics is on, tapping one sends an event that says only which of the two it was; the weekly recap's chapter then counts as a report opened from a reminder.

Widgets. Home-screen widgets read a small snapshot, up to three of today's notes with the day's and the week's counts, that the app writes to a local storage area shared with its widgets. The app maintains this copy even if you have not added a widget. When the Face ID lock is on, new snapshots omit note text unless you turn on "Notes in widget" in Settings; counts remain visible. iOS may display the previous snapshot until the widget refreshes.

Export. Markdown and CSV files are generated on the device and handed to the iOS share sheet. They contain every note in your journal with its date, category and project; a CSV file also gives each note's time, where it has one, and time zone. You choose where they go. Kipo does not send them anywhere itself, and it removes its temporary copy once the share sheet closes.

04Subscriptions (RevenueCat and Apple)

Premium is sold as an auto-renewable subscription through the App Store. Purchases are processed by Apple under Apple's terms and privacy policy. To check which subscription is active, Kipo uses RevenueCat, a subscription service. RevenueCat receives:

• a randomly generated app user ID, without a Kipo account identity;
• App Store purchase receipts and subscription status;
• basic device and app information (app version, device model, iOS version).

RevenueCat does not receive your notes or anything you typed. See RevenueCat's privacy policy for how they handle this data.

05Optional usage analytics and error reports (PostHog)

To understand which parts of the app are used and to find crashes, Kipo sends usage events to PostHog, an analytics service, hosted in the European Union. The events are a fixed list — for example "a note was saved", "a report was opened from a widget", "a reminder was tapped", "the paywall was shown", "a yearly plan was bought" — together with:

• a random device identifier generated by the analytics library (not your Apple ID, or advertising ID). This makes analytics pseudonymous, rather than anonymous;
• app version and build, iOS version, device model, language and time zone;
• approximate location derived from the network IP address, such as city, region and country. Our PostHog configuration removes coordinates and postal codes and discards the IP address from stored events. Network services still receive the IP address when handling a request.

App-defined usage events exclude note text, category and project names, search queries and entry identifiers. Error reports contain a shortened technical message and stack trace. Quoted text is removed from messages, but this filter cannot guarantee removal of user text from every unexpected error or stack trace. Session replay and automatic console capture are disabled.

Requests go through a proxy on our own domain (m.kipo.today) to PostHog's EU servers. See PostHog's privacy policy.

06Data retention

Deleted notes, categories and projects are hidden from the app but retained as deleted rows in the local database. Widget copies are updated after relevant changes. Subscription records are kept by Apple and RevenueCat under their own policies. Analytics events: kept by PostHog according to our plan and deletion practices, tied to the random device identifier.

07Children

Kipo is not directed at children under 13 and does not knowingly collect personal data from them.

08Your rights

You can read, edit and export your journal on your phone. For questions or requests about personal data, including analytics, contact privacy@kipo.today. Kipo does not currently provide a screen showing the analytics device identifier.

09Changes

If this policy changes, the new version is published at this address with a new effective date.

10Contact