Privacy Policy

Last updated: September 10, 2026

This policy explains what personal data KotiOne ("we", "us") collects, why, and what rights you have over it. KotiOne is an AI-assisted product discovery tool — you use it to think through product/feature ideas in conversation with an AI, and it keeps track of what you've learned as you go.

What we collect

• Account information — your email address, and (if you sign in with a password) a securely hashed version of your password. We never store your password in plain text.
• Google account information — if you sign in with Google, we receive your email address and name from Google. We do not receive your Google password.
• Your conversations — the messages you send, any files or product specs you upload, and the structured notes (problems, users, risks, evidence, etc.) the AI extracts from them as you use the product.
• Usage data — basic activity on your account (e.g. when a project was created, when a decision was recorded) so the product can function correctly, plus aggregate analytics if you've consented to analytics cookies (see "Cookies" below).

Why we collect it

To provide the core service: running your conversations through an AI model, keeping track of your project's state between sessions, authenticating you, and improving the product. We do not sell your data, and we do not use your conversation content to advertise to you or anyone else.

Who we share it with

We use a small number of service providers to run KotiOne. Each only receives what it needs to do its job:

• Anthropic — processes your conversation content to generate the AI's responses.
• Google — if you use "Continue with Google" to sign in.
• Resend — sends account-related emails (e.g. password reset links).
• Neon and Fly.io — host our database and application respectively.
• PostHog — if you've consented to analytics cookies, helps us understand product usage in aggregate.

We don't sell or rent your personal data to anyone, for any reason.

How long we keep it

Free-tier projects are automatically deleted 45 days after creation. Paid-tier projects are kept for as long as your account remains active. Your account itself (and everything in it) is kept until you delete it — see "Your rights" below.

Cookies

We use one strictly necessary cookie to keep you signed in — this doesn't require your consent under GDPR, since the product can't function without it. If we use any analytics or tracking cookies, you'll be asked to opt in first via a cookie banner, and you can withdraw that consent at any time.

Your rights

Under GDPR and similar laws, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and all associated data — you can do this yourself at any time from Settings in the app, with no need to contact us.
• Export your data in a portable format.
• Object to certain processing, or withdraw consent (e.g. for analytics cookies) at any time.
• Lodge a complaint with your local data protection authority if you believe we've mishandled your data.

Children

KotiOne isn't directed at, or knowingly used to collect data from, children under 16.

Changes to this policy

If we make a material change to this policy, we'll update the date at the top of this page.

Contact

Questions about this policy or your data? Contact us at privacy@kotione.com.

← Back to KotiOne