Privacy Policy

1. Who We Are

KOKORO is responsible for the personal information described in this Policy.

For users in the European Economic Area, United Kingdom, or Switzerland, KOKORO acts as the data controller unless otherwise stated.

2. Information We Collect

Account information

We may collect:

• Email address;
• Internal user identifier;
• Authentication provider;
• Authentication and refresh tokens;
• Name, if you or an authentication provider supplies it;
• Account creation and sign-in information; and
• Information needed to secure or recover your account.

We do not receive your Apple Account password, Google password, or payment-card number.

Audio and voice data

When you intentionally start a recording, Tapestry:

• Captures audio through your device’s microphone;
• Stores audio locally for session playback and history;
• Sends short audio chunks securely to our backend and transcription provider;
• Uses the audio to create a transcript; and
• May store session audio in private cloud storage when required by the active recording workflow.

Tapestry does not access the microphone before you start a recording.

We do not use audio to identify you biometrically, create a voiceprint, or perform advertising-related profiling.

Transcripts and session content

We may collect and store:

• Transcribed speech;
• Transcript timestamps and confidence information;
• Session titles and notes;
• Sparks, Threads, reports, and other generated content;
• Evidence excerpts connecting suggestions to your transcript;
• Favorites and saved selections; and
• Feedback or corrections you submit.

Audio and transcripts may contain information about other people. You are responsible for obtaining any consent required before recording them.

Creative-profile information

Information you choose to provide may include:

• Creative interests or disciplines;
• Project objective, format, and subject;
• Skill level;
• Preferred outputs;
• Available tools and materials;
• Budget and time constraints;
• Style preferences;
• Hard limits;
• Topics you want the Service to avoid;
• Creative-process notes; and
• Other project context.

We use this information to personalize results and respect the creative constraints you provide.

AI-generated and inferred information

The Service may generate or infer:

• Creative themes and recommended actions;
• Project-relevance signals;
• Creative preferences;
• Contextual or tone-related signals;
• Similarity representations or embeddings;
• Quality, grounding, and relevance scores; and
• Suggested connections between current and previous sessions.

These inferences support creative functionality. They are not medical, psychological, employment, credit, insurance, or eligibility assessments.

Device and usage information

We may collect:

• Identifier for Vendor (“IDFV”) or a randomly generated installation identifier;
• Device type;
• Operating-system and App version;
• Recording minutes used;
• Subscription entitlement and plan;
• Session timestamps;
• Feature interactions;
• Request timing, status, and error information;
• IP address and standard server-request metadata; and
• Security, fraud-prevention, and diagnostic logs.

The device identifier is used for App functionality and usage-limit enforcement. It is not used for advertising or tracking across unrelated companies’ services.

Purchase and subscription information

When you make an App Store purchase, Apple processes the payment. We may receive:

• Product identifier;
• Subscription plan;
• Transaction and original-transaction identifiers;
• Purchase, renewal, expiration, revocation, and entitlement status;
• Storefront and transaction environment; and
• Signed transaction information needed to verify access.

We do not receive your complete payment-card information.

Support and website information

If you contact us or use our website, we may collect:

• Contact details;
• Messages and attachments;
• IP address;
• Browser and device information;
• Referring page;
• Page views;
• Cookie or consent preferences;
• Contact-form submissions; and
• Newsletter information, if you subscribe.

Optional analytics or marketing communications are used only where permitted and, where required, with your consent.

3. How We Collect Information

We collect information:

• Directly from you when you create an account, record audio, complete your profile, submit feedback, or contact us;
• Automatically from the App, your device, and our servers during use;
• From Apple when you purchase or restore a subscription;
• From Apple or Google when you use a supported sign-in provider; and
• From contracted providers when they return transcripts, generated results, security signals, or processing information.

4. How We Use Information

We use information to:

• Create, authenticate, secure, and support your account;
• Capture and transcribe recordings you initiate;
• Generate personalized Sparks, Threads, reports, and creative suggestions;
• Maintain session history;
• Apply your stated tools, preferences, and constraints;
• Verify subscriptions and enforce usage allowances;
• Restore purchases and respond to transaction changes;
• Provide customer support;
• Detect and prevent fraud, abuse, unauthorized access, and security incidents;
• Diagnose errors and improve reliability, accessibility, and quality;
• Comply with legal obligations;
• Establish, exercise, or defend legal claims; and
• Send service communications and, where you opt in, marketing communications.

We do not sell personal information. We do not use App data for third-party advertising or cross-context behavioral advertising.

5. Audio, Transcription, and AI Processing

When you tap Record, you request the following processing:

1. Tapestry records audio on your device.
2. Audio chunks are transmitted securely to KOKORO’s backend.
3. Audio is sent to Deepgram for transcription.
4. The resulting transcript is stored with your session.
5. Transcript excerpts, creative-profile information, project constraints, and candidate ideas may be sent to AI providers for creative generation and evaluation.
6. Results are returned to Tapestry and may be saved in your session history.

Depending on the enabled features, AI processing may involve OpenAI, Anthropic, or Google.

Optional search enrichment may send a search query derived from a project idea to Tavily. Raw audio is not sent to generative-text providers during ordinary creative generation.

Tapestry may complete an already-requested transcription or final creative review after you tap Stop. Stopping prevents additional recording but does not necessarily cancel processing already underway.

6. AI Training and Human Access

KOKORO does not sell your recordings or transcripts and does not use them to train a KOKORO general-purpose AI model.

We use enterprise or API-based AI services and instruct providers to process content only to provide contracted services, maintain security, and comply with law. Provider retention may vary according to our configuration and applicable provider terms.

Authorized KOKORO personnel may access limited account or session information when reasonably necessary to:

• Respond to support requests;
• Investigate abuse or security incidents;
• Diagnose technical failures;
• Evaluate service quality;
• Comply with law; or
• Protect users and the Service.

Operational logs may contain request identifiers, generated results, transcript excerpts, or, in limited circumstances, session content necessary to diagnose processing. Access is restricted, and logs are not used for advertising.

We may use aggregated or de-identified metrics that cannot reasonably identify you to evaluate performance and improve the Service.

7. When We Disclose Information

We use the following service providers:

• Supabase — authentication, database hosting, and private storage;
• Vercel — backend hosting, request processing, and operational logs;
• Deepgram — audio transcription;
• OpenAI — creative generation, evaluation, embeddings, and related AI processing;
• Anthropic — optional multi-model creative evaluation;
• Google — supported authentication and optional AI evaluation;
• Tavily — optional web-search enrichment;
• Managed caching infrastructure — temporary recent-session context; and
• Apple — Sign in with Apple, StoreKit purchases, subscriptions, and platform services.

We require providers, through contracts or comparable legally binding commitments, to provide the same or an equivalent level of protection described in this Policy and to process information only for authorized purposes.

We may also disclose information when reasonably necessary to:

• Comply with law, legal process, or a lawful government request;
• Protect the rights, safety, and security of users, KOKORO, or others;
• Investigate fraud, abuse, or security incidents;
• Enforce our agreements; or
• Complete a merger, acquisition, financing, restructuring, or sale of assets.

We may disclose information at your direction, such as when you export or share a transcript or Thread.

8. What We Do Not Do

Tapestry does not:

• Sell or rent personal information;
• Share personal information for cross-context behavioral advertising;
• Use advertising SDKs in the App;
• Request or use Apple’s advertising identifier;
• Track you across unrelated companies’ apps or websites;
• Create biometric voiceprints;
• Access the microphone before you start recording; or
• Make automated decisions producing legal or similarly significant effects concerning employment, housing, credit, insurance, health care, or education.

9. Legal Bases for Processing

Where required, we rely on:

• Contract: To create your account, transcribe requested recordings, generate results, maintain history, verify subscriptions, and provide the Service;
• Consent: For microphone access, optional communications, optional website analytics where required, and other processing for which consent is requested;
• Legitimate interests: To secure, maintain, diagnose, and improve the Service and prevent abuse, provided those interests are not overridden by your rights;
• Legal obligations: To comply with applicable legal, tax, accounting, consumer-protection, and lawful-request requirements; and
• Legal claims: To establish, exercise, or defend legal rights.

You may withdraw consent at any time. Withdrawal does not affect processing completed before withdrawal or processing supported by another lawful basis.

10. Data Retention

Local data

Local recordings, transcripts, Threads, session metadata, and preferences remain on your device until you:

• Delete an individual local recording;
• Use Delete Local Data;
• Delete your account;
• Delete the App; or
• The device or operating system removes the data.

Local App data may be included in an Apple-managed device backup, depending on your device settings.

Audio chunks

Audio chunks sent for real-time transcription are ordinarily processed transiently and are not retained by KOKORO as separate session files after transcription.

If a workflow stores complete session audio in private cloud storage, it is retained with the corresponding session until the session or account is deleted, unless the App presents a shorter retention period.

Transcription providers may temporarily retain request data under their contractual terms, security requirements, and configured controls.

Transcripts, profiles, and generated content

Server-side transcripts, profile information, generated results, reports, embeddings, and related session records are retained while your account remains active and the information is needed to provide session history, unless deleted earlier.

Temporary context

Recent transcript context stored in caching infrastructure ordinarily expires within approximately one hour.

Subscription records

Subscription and entitlement records are retained while necessary to provide access, prevent fraud, resolve billing issues, and satisfy legal or accounting obligations.

Logs and support records

Security, error, and operational logs are retained on a limited rolling basis according to operational, security, and hosting requirements.

Support communications are retained while necessary to resolve the request, maintain an appropriate record, prevent abuse, and comply with law.

Deleted data and backups

When you delete your account, associated information is removed from active KOKORO systems.

Limited residual copies may temporarily remain in encrypted backups, provider logs, fraud-prevention records, or legally required records until overwritten or no longer required.

We may retain a minimal record of a deletion request when necessary to demonstrate compliance.

11. Your Controls

You can:

• Grant or revoke microphone permission in iOS Settings;
• Stop a recording at any time;
• Edit your creative profile;
• Delete local recordings;
• Use Delete Local Data to clear device-stored Tapestry content;
• Delete your account inside the App;
• Request access, correction, export, restriction, or deletion;
• Unsubscribe from marketing communications; and
• Manage your subscription through your App Store account.

Deleting local data does not delete your account or server-side information.

Deleting the App does not delete your account.

Deleting your Tapestry account does not automatically cancel an Apple subscription.

See Data Controls for detailed instructions.

12. Account Deletion

You may permanently delete your account through:

Tapestry → Settings → Account → Delete Account

Account deletion removes your account and associated information from active KOKORO systems.

If you registered through Sign in with Apple, we may require reauthentication and revoke the related Apple authorization during deletion.

You may also request deletion by emailing hello@kokoro.cool. We may verify your identity before completing a request.

13. Your Privacy Rights

Depending on where you live, you may have the right to:

• Know whether we process your information;
• Access the information we hold;
• Correct inaccurate or incomplete information;
• Receive a portable copy of information you provided;
• Request deletion;
• Restrict or object to certain processing;
• Withdraw consent;
• Opt out of sale, sharing, or targeted advertising;
• Appeal a privacy-request decision; and
• Complain to a privacy or data-protection authority.

We do not discriminate against users for exercising privacy rights.

To submit a request, email hello@kokoro.cool with the subject Privacy Request. Include the email associated with your account and a description of your request. Do not send passwords or authentication tokens.

We may request information reasonably necessary to verify your identity. We respond within the period required by applicable law, generally within 30 days.

Canada

Canadian residents may request access and correction and may withdraw consent, subject to legal and contractual restrictions. You may contact the Office of the Privacy Commissioner of Canada or the applicable provincial authority.

European Economic Area, United Kingdom, and Switzerland

You may have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with your local supervisory authority.

California and other United States states

We do not sell personal information or share it for cross-context behavioral advertising.

During the preceding twelve months, we may have collected identifiers, contact information, commercial information, internet or electronic activity, audio or sensory information, user content, and inferences. These categories may be disclosed to service providers for the business purposes described in this Policy.

Where applicable, you may use an authorized agent. We may require proof of authorization and identity verification.

14. International Data Transfers

KOKORO is based in Canada. Service providers may process information in Canada, the United States, the European Economic Area, or other jurisdictions.

Where required, we use appropriate safeguards such as contractual data-protection terms, standard contractual clauses, adequacy mechanisms, or another lawful transfer mechanism.

15. Security

We use safeguards designed to protect personal information, including:

• HTTPS/TLS transmission;
• Authentication and authorization controls;
• Device Keychain storage for sensitive credentials;
• Private, access-controlled cloud storage;
• Database row-level access controls;
• Restricted administrative access;
• Provider access controls;
• Account-ownership checks; and
• Security monitoring and incident-response procedures.

No system is completely secure. We cannot guarantee that information will never be lost, accessed without authorization, or disclosed during a security incident.

16. Children’s Privacy

Tapestry is not directed to children under 13 or the higher minimum age applicable in their jurisdiction.

We do not knowingly collect personal information from a child who cannot legally consent without verified authorization from a parent or guardian.

If you believe a child has provided personal information unlawfully, contact hello@kokoro.cool.

17. Automated Processing

Tapestry uses automated systems to transcribe audio, evaluate project context, and generate creative suggestions.

These systems do not make decisions intended to produce legal or similarly significant effects. You may disregard, edit, or delete generated results.

18. Changes to This Policy

We may update this Policy to reflect changes to the Service, providers, law, or privacy practices.

We will revise the “Last updated” date. When changes materially affect your rights or how we use information, we will provide additional notice where required.

19. Contact