Privacy
Most privacy policies are written to protect the company. This one is written to tell you exactly where your data is, because for KimtOS the honest answer is short.
The short version. Everything you create in KimtOS — your notes, tasks, PDFs, clipboard, recordings, whiteboards and AI chats — is stored in your own browser and is never sent to us. We could not read it if we wanted to. If you create an account, we hold your name, email and which plan you are on. That is the whole relationship.
What stays on your device
All of your app content lives in your browser's own storage (IndexedDB), on the machine you are sitting at. It is never uploaded to us. That covers:
- Notes, tasks, and PDF Library documents and annotations
- Clipboard history, saved files, whiteboards and screen or camera recordings
- Everything you type into the AI apps — chats, transcriptions, OCR'd images, denoised audio and grammar checks
- Your wallpapers, settings and which apps you have installed
The AI models run inside your browser tab using WebAssembly and WebGPU. Your audio, images and text are processed on your own hardware. There is no server to send them to, so there is nothing for us to leak, sell, or be compelled to hand over.
You can inspect, export or delete all of it yourself at any time, from the AnubisDB app or Settings, without asking us.
What we hold, if you create an account
An account is optional and only needed to unlock the Pro apps. If you make one, our database holds exactly this and nothing more:
| What | Why |
|---|---|
| Your name and email address | To identify your account and email you about it |
| A hash of your password, or your Google/GitHub account id if you signed in that way | To let you sign back in. We never store your actual password. |
| Your plan and subscription status, plus your Dodo Payments customer id | To know whether the Pro apps are unlocked |
| Sign-in session tokens (hashed), and the browser they were issued to | To keep you signed in and let you sign out everywhere |
| The country you sign in from (for example "Egypt"), worked out from your IP address at that moment | To know which countries KimtOS is used from, and to alert you when a sign-in comes from a new place. The country only — we never store the IP it came from. Your account keeps just the latest country; each browser you have signed in from also keeps the country it was seen from, which is what powers the new-device alert. |
| Support messages, if you contact us | To answer you |
| Your uninstall-survey answer, if you choose to send one | To understand why people leave. Entirely optional, and linked to your account only if you were signed in on kimtos.com when you sent it — otherwise it is stored with no identity at all. |
We run no product analytics. We do not track which apps you open, what you do in them, or how long you spend. There is no tracking pixel, no session recording, and no advertising network anywhere in KimtOS.
When KimtOS talks to the network
A local-first app is not an offline app, and we would rather list every exception than imply there are none. KimtOS makes a network request in these cases, and only these:
- Your account and billing — when you sign in, or manage your subscription. This sees your account and plan, never your content. When you sign in, our server also looks up the approximate location of your address (via ipapi.co) so we can email you a security alert if a sign-in comes from a new device or place, and so we know which country your account is used from. We keep only the coarse location and the country, never your IP.
- Downloading an AI model — the first time you use an on-device AI app, its model file is downloaded once and then cached; after that the app works offline. Every model is served from our own cdn.kimtos.com. The download sees only which file you asked for.
- An OCR language other than English — SnapText has English built in and needs no download. If you set any other language, that language's data file is fetched once from our own cdn.kimtos.com and then cached. Your image is never sent anywhere — only the name of the language pack.
- The weather and trending-article cards — if you have them enabled on your home screen, they fetch from Open-Meteo and from public developer feeds (DEV, Hacker News, Lobsters).
- The search bar — typing a search on the new-tab page sends that query to whichever search engine you have chosen, exactly as a normal search box would.
- Importing a PDF by URL — fetches the file from the address you gave it.
- If you uninstall KimtOS — your browser opens our own exit-survey page, once. The address it opens carries only the extension's version number — no account, install or device identifier. Answering is entirely optional; if you do answer, we store the reason you picked and anything you typed, linked to your account only if you happened to be signed in on kimtos.com.
Cookies and local storage
Our websites set no analytics, advertising or tracking cookies — not from us, and not from anyone else. Everything below exists only to make something work that you asked for, and none of it follows you across other sites. The cookie dialog you see on your first visit exists for the future, not the present: it lets you decide about optional categories (analytics, marketing) before anything in them could ever run — and today those categories are empty, so nothing non-essential is stored no matter what you choose. Your choice itself is remembered (the consent record in the table below) and can be changed any time via Cookie settings in the footer.
This is the complete list of what kimtos.com, docs.kimtos.com and our API may place on your device, under the exact names your browser's storage inspector will show:
| Name | What it is | Why | How long |
|---|---|---|---|
kimtos_rt | Cookie, set by our API server when you sign in | Keeps you signed in between visits. It is httpOnly (no script can read it) and is only ever sent back to our own API. | 30 days |
kimtos_support_guest | Cookie on .kimtos.com, set only if you start a support chat while signed out | Lets you reopen that one guest support conversation, on the marketing site and the docs site alike. It identifies the conversation, not you. | 30 days |
kimtos.support.guest | Browser storage (localStorage), written alongside the cookie above | A fallback copy of the same guest-conversation token, for browsers that block cookies. | Until the conversation ends or you clear your browser data |
kimtos_consent | Cookie on .kimtos.com, set when you answer the cookie dialog | Remembers your cookie choices (and when and under which version of the categories you made them), so the dialog does not re-ask on every visit. Strictly necessary: it stores your consent decision itself. | 365 days, then you are simply asked again |
kimtos.consent | Browser storage (localStorage), written alongside the cookie above | A fallback copy of the same consent record, for browsers that block cookies. | Until you clear your browser data |
kimtos-theme | Browser storage (localStorage) on kimtos.com | Remembers your light/dark theme choice. | Until you clear your browser data |
kimtos-welcome-dismissed | Browser storage (localStorage) on kimtos.com | Remembers that you dismissed the one-time welcome message, so it never comes back. | Until you clear your browser data |
kimtos-announcement-dismissed | Browser storage (localStorage) on kimtos.com and docs.kimtos.com | Remembers which announcement bar you closed, so the same one does not come back. It stores the announcement’s id, nothing about you. | Until we publish a new announcement, or you clear your browser data |
vitepress-theme-appearance | Browser storage (localStorage) on docs.kimtos.com | Remembers your light/dark theme choice on the docs site. | Until you clear your browser data |
If we ever added anything that did not fit this description — an analytics service, an advertising pixel, anything that stores or reads data on your device beyond what a feature you use strictly needs — we would ask for your consent first, before it set anything. Today there is nothing to ask about.
Who else sees anything
We use as few third parties as we can. These are all of them:
| Who | What for | What they see |
|---|---|---|
| Dodo Payments | Payments and subscriptions (our Merchant of Record) | Your email and billing details. As merchant of record, Dodo takes the payment; we never see or store your card number. |
| Resend | Transactional email | Your email address, to send you verification and password-reset messages. |
| ipapi.co | Approximate sign-in location for new-device security alerts and the country on your account | Your IP address at the moment you sign in, to estimate the city and country we show if we email you about a sign-in from a new device or location. We keep that coarse location and store the country on your account — never your IP. |
Our own database runs on servers we control. We do not sell your data, and we do not share it with advertisers or data brokers — there is no version of KimtOS where that makes sense, because we do not have your data in the first place.
Your rights over your data
Your app content is already yours — it is on your machine, and you can export or erase it yourself without involving us. For the account data we hold, you can ask us to show it to you, correct it, or delete it entirely. Deleting your account removes your record from our database; your app content is untouched, because we never had it.
Email support@kimtos.com and we will action it. If you are in the EU or UK, these are your rights under the GDPR, and you may also complain to your national data-protection authority.
How long we keep things
Account records are kept while your account exists, and removed when you delete it. Sign-in tokens expire on their own. Payment records are retained by Dodo Payments for as long as tax and accounting law requires, which is out of our hands.
One thing outlives your account, on purpose. The Pro free trial is once per email address, for good. So when a trial starts we store a one-way fingerprint of the address — not the address itself — and that single record stays after the account is deleted. It is the only way the rule can survive deletion, and it is deliberately the least we can keep: a fingerprint can be matched against an address someone types in later, but it cannot be turned back into one, mailed, or used for anything else. Deleting your account still frees your address to sign up again; what does not come back is a second free trial.
Support conversations. If you have an account, your conversation is kept with it, so we can pick up where we left off — and it goes when your account goes. If you wrote to us without an account, the link that lets you reopen that conversation expires after 30 days. We delete the conversation, and the email address you gave us with it, on the same 30-day clock: once you can no longer read it, we have no business keeping it.
Children
KimtOS is not directed at children under 13, and we do not knowingly create accounts for them.
Changes
If we change this policy we will update the date at the top of this page. If a change ever meant your content started leaving your device, we would tell you plainly and ask first — that promise is the product.