Cookie Policy

At a glance

The 15-second version.

Our marketing website sets no first-party cookies of its own today. No analytics cookies, no advertising cookies, no tracking pixels.
We don't run Facebook Pixel, Google Ads, TikTok Pixel, or any third-party ad-network tag.
We use Google Fonts to render text on the site. Your browser talks to Google's servers to fetch the font files.
The Kilo mobile app doesn't use cookies at all. It uses secure on-device storage for your session — not cookies.
You can block or clear cookies any time in your browser. We honor Global Privacy Control and Do Not Track signals. Zero "legitimate interest" tricks.

This is the reality of Kilo today. If we ever add analytics or non-essential cookies, this page updates first, a consent banner appears for users in consent-required regions, and we tell you in the app.

Section 1

Scope of this policy.

In short: This covers the Kilo website and the Kilo mobile apps — how we use cookies on the web and similar on-device storage on your phone.

This Cookie Policy applies to:

The Kilo marketing website at kilo.app and getkilo.app, and any subdomains (e.g., help.getkilo.app)
The Kilo mobile app for iOS and Android — where "similar technologies" like secure device storage take the place of cookies

It does not cover third-party services we link to (the App Store, Google Play, or the subscription services you're splitting with friends). Those have their own cookie and privacy policies.

For the full picture of how we handle personal data, see our Privacy Policy.

Section 2

What cookies & similar technologies are.

In short: Small bits of data your browser or phone stores, used for everything from keeping you signed in to tracking you across the internet.

Cookies: Tiny text files that a website asks your browser to store. On your next visit, the site can read them back — to remember you're signed in, what you put in a cart, or (less innocently) to track which other sites you've visited.
First-party cookies: Set by the site you're visiting (us). Typically used for essential features like authentication.
Third-party cookies: Set by a different company whose content is embedded on the site (like an ad network or an analytics vendor). These are what privacy rules have focused on, and what modern browsers increasingly block by default.
Local storage & session storage: A newer browser mechanism that stores data on your device, like cookies but without being sent to the server on every request. Used for UI state, drafts, and similar.
Tracking pixels / web beacons: 1×1 transparent images (or code equivalents) that let a server know you opened a page or an email. Often combined with third-party cookies for cross-site tracking.
Device storage (mobile): On your phone, apps don't use cookies. They use secure OS-managed stores (iOS Keychain, Android Keystore) for credentials and sandboxed app storage for everything else. Similar function, different plumbing.
Device identifiers: IDs that identify your phone or browser to a service — like Apple's IDFV, Android's App Set ID, or the APNs / FCM push token. Kilo uses these only for core functions (push notifications, auth), not for advertising.

Section 3

The four categories.

In short: Cookies fall into four buckets. Today, Kilo uses zero of them on our marketing site.

Category	What it's for	Opt-in required?	Does Kilo use it today?
Strictly necessary	Sign-in, CSRF protection, security, preserving session state during a form submission	No — exempt under ePrivacy	No — our marketing site doesn't have a login.
Functional / preferences	Remembering language, region, theme preference, last-visited page	Yes, in EU / UK / EEA	No.
Analytics / performance	Measuring which pages are viewed, how people navigate, where errors occur	Yes, in EU / UK / EEA	No.
Marketing / advertising	Personalized ads, retargeting, cross-site tracking, conversion attribution	Yes — everywhere with consent laws	No. We don't run ad-network pixels or retargeting tags. We don't plan to.

If this table changes — specifically if we ever add analytics or any third-party tag in the last three categories — this page updates and consent is collected from users in consent-required regions before the tag loads.

Section 4

Cookies on our website.

In short: As of the effective date of this page, the Kilo marketing site sets no cookies of its own.

Because our website is currently a public marketing and information experience (not a logged-in product), it does not need session cookies, CSRF tokens, or any other authentication-related storage. We do not set tracking, analytics, or preference cookies.

If you don't believe us (fair), you can verify in your browser:

Chrome / Edge: open DevTools → Application → Cookies → kilo.app
Firefox: DevTools → Storage → Cookies → kilo.app
Safari: Develop → Show Web Inspector → Storage → Cookies

When you sign in to the app via the web (if that launches later) or access a future logged-in dashboard, we will use strictly necessary cookies or equivalent browser storage to keep your session alive. We'll update this page and disclose it there.

Section 5

Third-party services we load.

In short: Just one — Google Fonts, for text rendering. No ad networks, no analytics, no widgets.

Service	What it does on our site	Data processed	Their policy
Google Fonts	Serves our typefaces (Geist Mono) from `fonts.googleapis.com` and `fonts.gstatic.com`.	Your browser's IP address, User-Agent, and the URL of the font file requested. Google states it does not set cookies or use these requests for advertising.	Google Privacy Policy

That's it. No customer support widget, no social-media embeds, no third-party video players, no CAPTCHA services, no payment iframes on this marketing site (payments happen inside the mobile app, via Stripe).

EU / UK note. Some European courts have treated Google Fonts served from Google's servers as a personal-data transfer to Google and expected site operators to self-host fonts instead. We're aware of this and evaluating a self-hosted build. If this matters to you, you can block requests to fonts.googleapis.com and fonts.gstatic.com — the site will fall back to a system font and still work fine.

Section 6

Similar tech in the mobile app.

In short: The app doesn't use cookies. It uses secure on-device storage provided by your operating system.

What it is	What we store there	Lifetime
iOS Keychain / Android Keystore (via `expo-secure-store`)	Encrypted auth tokens (access & refresh), biometric unlock flag	Until you sign out or delete the app
App sandbox storage	Cached UI state, draft splits, recently viewed screens — nothing sensitive	Until you clear the app's storage or uninstall
APNs push token (iOS) / FCM token (Android)	An opaque identifier issued by Apple or Google so Kilo can send you push notifications	Rotated by the OS; revoked when you disable notifications or uninstall
Device-family identifiers	Apple's IDFV and/or Android App Set ID — device-family scoped, used for debugging and fraud prevention. Not IDFA / advertising ID — we don't request that permission.	Reset by the OS on uninstall or when you reset identifiers in device settings

There are no advertising SDKs, attribution SDKs (AppsFlyer, Adjust, Branch), or session-replay SDKs in the Kilo mobile app. We commit to disclosing any addition here before shipping.

Section 7

Your choices.

In short: Browsers and phones both give you full control. Here's how.

On our website

You can block, allow, or delete cookies site-by-site. If we ever add non-essential cookies, we'll also provide an in-page consent control. Direct links to each major browser's cookie settings:

Clearing cookies won't affect anything on the Kilo marketing site today — we don't set any — but if we add login to the web later, it will sign you out.

On your phone

iOS: Settings → Privacy & Security → Tracking to control which apps can request to track. Settings → Privacy & Security → Apple Advertising → Personalized Ads to disable Apple's own ad personalization.
Android: Settings → Privacy → Ads to reset your Advertising ID, or delete it entirely. Settings → Apps → Kilo → Permissions to review what the Kilo app can access.
You can uninstall the Kilo app at any time, which wipes every local token and identifier.

Section 8

Consent (EU / UK / EEA users).

In short: Under ePrivacy and GDPR, non-essential cookies need opt-in consent before they're set. We don't set any, so no banner today.

The ePrivacy Directive (as implemented in each EU member state's cookie law) and the UK's PECR require websites to obtain prior opt-in consent before setting any cookie that isn't strictly necessary for a service the user has requested. Legitimate interest is not a valid legal basis for cookies under ePrivacy — so we don't pretend otherwise.

Because we currently set no cookies and load no consent-requiring third-party tags on our marketing site, we don't show a consent banner. If we add analytics, a customer support widget, or any third-party service that sets non-essential cookies, we will:

Update this Cookie Policy and its Last updated date before launch.
Show a consent banner to users in the EU, UK, EEA, Switzerland, and other regions where opt-in is required — with equal-prominence Accept and Reject buttons on the first layer (no dark-pattern "Accept All" shortcuts).
Not load the non-essential service until consent is granted.
Remember your choice, and let you change it at any time through a Cookie preferences link in our footer.

Section 9

Do Not Track & Global Privacy Control.

In short: We treat Global Privacy Control as a valid opt-out signal. Do Not Track, we support in principle but the standard is effectively dead.

Global Privacy Control (GPC). When your browser or extension sends the Sec-GPC: 1 header, we interpret it as a valid request to opt out of any "sale" or "sharing" of your personal information — as required by the California Attorney General's CCPA guidance. Since we don't sell or share personal information anyway, this simply formalizes your existing protection.
Do Not Track (DNT). We honor DNT signals but, since we don't track users across sites, there is nothing to turn off. DNT never became an enforceable standard, so most companies ignore it; we're mentioning it for completeness.

Section 10

California & other US privacy rights.

In short: We don't sell or share personal information. California residents have the right to say so anyway — here's how.

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have the right to opt out of the "sale" of their personal information and the "sharing" of it for cross-context behavioral advertising. Similar rights exist under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas DPDPA, and other US state privacy laws.

Kilo does not sell personal information and does not share personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months. Because we don't, we are not required to provide a Do Not Sell or Share link — but to be unambiguous:

Do Not Sell or Share My Personal Information. Your request is already in effect by default. If you would like written confirmation for your records, email privacy@getkilo.app.

Full details of your rights — access, deletion, correction, portability, and how to exercise them — are in the Privacy Policy §10.

Section 11

Changes to this policy.

In short: If we add a tracker, this page updates first and we tell you.

We'll update this Cookie Policy whenever our cookie or similar-technology practices change. Specifically:

Material changes (adding analytics, adding advertising cookies, changing how any tag works): we'll update the Last updated date at the top of this page, post a notice in the app and on the site, and — for users in consent-required regions — request fresh consent before the new tag loads.
Non-material changes (typo fixes, clarifications, adding a new browser link): we'll update the Last updated date silently.
Historical versions. Prior versions are available on request from privacy@getkilo.app.

Section 12

Contact.

In short: privacy@getkilo.app — we respond within 30 days.

Privacy & cookies
Email: privacy@getkilo.app · Response within 30 days (GDPR / CCPA)

Security concerns
Email: security@getkilo.app

Postal address (for legal notices)
Kilo, Inc.
[PLACEHOLDER: street address]
[PLACEHOLDER: city, state, postal code, country]

See the Privacy Policy for the full set of your rights, the legal bases we rely on, and how we handle personal data beyond what's described here.