Privacy Policy

The one-minute version

• What you type does not leave your device, unless you open KOI Agent yourself and send a request.
• KOI contains no analytics, crash-reporting or advertising tracking tools of any kind.
• KOI does not read your advertising identifier or any device identifier.
• Learning history and settings are stored on the device; if you turn sync on, they are stored in your own private iCloud.
• We do not sell your data and we do not use it for advertising.

Each point is set out in full below.

What we do not collect

This section matters more than “what we collect”, so it comes first. None of the following can be found anywhere in KOI's code:

• Analytics or usage-statistics SDKs (Firebase Analytics, Mixpanel, Amplitude and the like)
• Crash-reporting SDKs (Crashlytics, Sentry and the like)
• Advertising or attribution SDKs (AppsFlyer, Adjust, the Facebook SDK and the like)
• The advertising identifier (IDFA), the vendor identifier (IDFV) or App Tracking Transparency (ATT) prompts
• Keystroke logging — KOI does not record the keys you press
• Browsing or reading contacts, the photo library, location or calendars — KOI cannot browse or read your photo library

What you type

KOI's input engine runs entirely on your device. Decomposition, candidate generation, ranking, learning — all of it is computed locally, and that part of the code has no networking capability whatsoever.

The characters you choose teach KOI your habits, so the same code ranks them higher next time. This learning history is stored in the app's shared container group.com.rainsday.koikeyboard, which only KOI can read.

Deleting KOI removes this local data along with it.

The “Full Access” permission

iOS rules: a keyboard extension without “Allow Full Access” has no networking capability and cannot use KOI's shared container. KOI uses the permission for these explicit features:

• Connecting to KOI Agent (the AI features)
• Pasting text from the clipboard into the AI input field — the clipboard is read only at the moment you press Paste
• Updating the handwriting recognition model (the base model is built in and works without updates)
• Saving generated images into KOI's shared local image library so the host app can show them later

Without the permission, KOI's five input methods, candidates, learning, handwriting, symbols and cursor controls all keep working. The features above are the only things you lose.

Granting the permission does not itself send any data. Data is sent only when you use the relevant feature.

What KOI Agent actually sends

When you open KOI Agent and send a request, the following goes to KOI's servers (Google Cloud Functions, in asia-east1):

• The instruction text you entered
• Context from the active field. KOI allocates the limit in this order: selected text, text before the selection or cursor, then text after it.
• The combined context is limited to 2,000 Unicode scalar values and 4,000 UTF-8 bytes. The preview shown in KOI Agent is exactly the context sent with that action.
• The earlier turns of the same conversation
• An installation identifier (see “Accounts and identifiers” below) and a Firebase App Check attestation token

KOI sends context only after you explicitly press an Agent action — for example Send, a quick action, Retry, Continue, or Freedom Create. Opening Agent or viewing the preview does not send it.

Not sent: screenshots (KOI cannot take them), your clipboard contents (unless you press Paste yourself), your contacts, or content outside the text field currently being edited.

KOI cannot browse or read your photo library. The KOI app can only use add-only permission after you tap Save to Photos; it cannot inspect existing photos.

Server logs keep request-level data only: request id, path, status code, duration, which model handled it, and processing stage. The instruction text and the surrounding text are never written to logs.

iCloud sync

Cross-device sync is off by default. Before it is turned on, KOI asks you to confirm the iCloud account you are currently signed in to.

Synced data is written to your own private iCloud database (container iCloud.com.rainsday.koikeyboard) using CloudKit encrypted fields — the key is tied to your iCloud Keychain, so neither Apple nor the KOI developer can read the contents.

Sync is triggered manually and never runs in the background. Two settings never sync at all: the sync switch itself, and the input diagnostics switch.

Accounts and identifiers

Installation identifier: KOI generates a random UUID to identify an installation. It is not a device identifier, it does not track you across apps, and reinstalling the app replaces it. On arrival the server hashes it with SHA-256 and a secret pepper, and only the hash is used, for rate limiting and for tying purchases to an installation.

Sign in with Apple: optional, and needed only if you want purchase records to carry across devices. The only scope KOI requests from Apple is your name; it does not request an email address. Apple supplies the name only on first authorization; KOI passes it to Firebase Authentication to create or update the sign-in account. KOI's own Firestore account and purchase records store the Firebase UID, scoped hashes, purchase data and timestamps, and do not separately store your name or email.

AI Chinese correction: this experimental feature is currently limited to Life Time Plus. The keyboard sends the current complete sentence and a bounded set of candidates generated locally from the input code through Cloudflare Workers to TypeSafe Jev for semantic selection. Cloudflare's membership cache stores only a hashed membership decision for up to 60 seconds and contains no input text; KOI's Worker does not write sentences to logs or persistent storage. TypeSafe Jev handles data under its own privacy policy and terms.

The backend database (Firestore) rejects all direct client reads and writes; every write goes through server code.

Purchases

All payments are handled by Apple. KOI never sees your card, your payment method or your billing address.

Purchase state is managed through RevenueCat, which sends purchase events to KOI's servers containing: the purchaser identifier, product id, transaction id, original transaction id, purchase time, expiry time, period type, cancellation reason, store, and environment (production or sandbox).

This data is used to determine whether you have Plus and to work out your Credit balance. It is not used for anything else.

Retention

• AI request logs: request-level metadata only, with no content.
• Reference image cache during image generation: held in server memory for 10 minutes, capped at 24 entries.
• Sandbox environment operation records: 24 hours.
• Credit ledger and purchase records: kept until the account is closed, because they are needed for refunds, disputes and entitlement decisions.
• Local learning history and settings: kept on your device, and gone the moment you delete the app.

Children

KOI is not designed for children under 13 and does not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.

Your choices and rights

• Skip the AI: if you never open KOI Agent, no text leaves the device. You can also switch the AI features off entirely in settings.
• Skip Full Access: the core input method works exactly the same without it.
• Skip sync: it is off to begin with, and you can turn it back off at any time.
• Delete local data: deleting the app clears the learning history and settings on your device.
• Delete iCloud data: manage it in iOS Settings → your Apple Account → iCloud.
• Delete server data: email privacy@rainsday.com. Note that completed purchase records may have to be retained to meet tax and accounting requirements.

Changes to this policy

If the way KOI handles data changes, this page is updated and the effective date at the top changes with it. For significant changes we will tell you in the app.

Contact

• Privacy enquiries: privacy@rainsday.com
• General support: support@rainsday.com