Privacy Policy

Overview

• Ordinary typing, candidate ranking and learning run on your device. Optional iCloud sync, submitted AI requests and background JEV diagnostics for eligible test accounts involve the transfers described below.
• AI use requires explicit agreement to “AI 資料分享” (AI data sharing). You can withdraw consent in the KOI app's “AI 與 Credits” page to stop new AI sharing.
• KOI uses account, installation and purchase identifiers for sign-in, Credits, access, purchase recovery and security. Hashed identifiers can still be associated with an account or installation.
• Bundled SDKs process performance, diagnostic and usage data to operate and improve their services.
• KOI does not sell your data or use your input content for advertising.

Advertising and device permissions

KOI has no advertising or cross-app advertising tracking feature and does not use IDFA. Installation identifiers and SDK data needed for the service are handled separately from advertising tracking.

KOI does not browse your contacts, location, calendars or existing photo library. Only when you press “儲存到相片” (Save to Photos) does it use add-only permission to add that generated image.

The keyboard reads the clipboard when you press Paste to put text into the AI input field. Content subsequently submitted is handled under the AI sharing rules.

Local input and learning

The input engine decomposes codes, generates and ranks candidates on your device, and stores selected candidates and associations to improve later input.

Learning data and settings are stored in the container shared by the KOI app and keyboard. Ordinary input is not sent keystroke by keystroke to KOI's servers. Optional sync, AI requests and developer diagnostics are described separately below.

Deleting a KOI account removes account access and related synced data. Ordinary local learning, settings and saved images have their own clearing controls and are not all erased by account deletion.

The “Full Access” permission

The keyboard's network features and sharing data with the KOI app require “Allow Full Access”. This includes KOI Agent, JEV requests for eligible test accounts, handwriting model downloads and the shared generated-image library.

Full Access does not replace AI sharing consent. You must explicitly agree before submitting new AI requests. Basic local input remains available without Full Access.

AI sharing consent and withdrawal

The KOI app's “AI 與 Credits” page and the keyboard's first AI action show “AI 資料分享”, describing data, recipients, purposes and retention, with “同意並繼續” (Agree and Continue) and “取消” (Cancel). Displaying the notice does not grant consent.

Consent is recorded by version in KOI's shared settings. Without consent to the current version, updated clients block new AI sharing. Keyboard actions also require Full Access and respect context limits.

In “AI 與 Credits”, press “已同意 AI 資料分享 · 撤回” and confirm “撤回同意” to stop new AI sharing, including JEV. Already transmitted data cannot be recalled. Withdrawal does not automatically delete stored results or existing provider records. Retrieval and delivery acknowledgement of completed results remain available.

Data sent by KOI Agent

When you agree and explicitly execute an Agent action, the following content passes through KOI's Firebase/Google Cloud service and OpenRouter to OpenAI models. Image understanding may also use OpenAI models provided by Microsoft Azure.

• Your submitted prompt or instruction and applicable earlier turns in the same conversation.
• Previewed input context: selected text, text before the cursor or selection, then text after it; the combined limit is 2,000 Unicode scalar values and 4,000 UTF-8 bytes.
• Reference images and applicable image conversation data needed for image features.

This content supports understanding requests, answering questions, rewriting, replies, translation and image generation. Viewing the context preview does not itself submit that text.

KOI services separately receive installation and account-binding identifiers, Firebase App Check verification data, and metadata needed to reconcile operations, delivery and Credits. KOI's account, security and accounting services use these verification data; they are not sent as model prompts or context.

Text questions needing current information may use OpenRouter's web search and fetch services. Image research sends derived search terms to Brave Search and fetches references from source websites; those services and websites receive the corresponding queries or requests.

KOI does not itself train models on Agent content. Text requests ask providers for zero retention and no content collection. This is not a zero-retention guarantee for all images, search, JEV, service logs or provider processing. Provider links and retention differences appear below.

Optional iCloud sync

Cross-device sync is off by default. When you enable it and run a manual sync, KOI writes selected keyboard settings, learned candidates and associations to your private Apple CloudKit database.

The sync payload uses CloudKit encrypted fields. Sync does not upload every keystroke or sync AI sharing consent or the local diagnostics flag.

Account deletion handles synced data bound to that KOI account. If iCloud identity or network availability prevents completion, the app retains the cleanup state and offers a retry. Apple's platform retention and backups are governed by its policies.

Accounts and identifiers

KOI creates an installation UUID and uses Firebase account or guest identifiers for purchases, Credits, binding, recovery and abuse prevention. The server also uses hashes of installation, account or network data for reconciliation and rate limits. Hashes that remain associated with an account or installation are still identifiers.

For Sign in with Apple, KOI requests the name scope and passes the supplied name to Firebase Authentication to create or update the account. This flow does not request the email scope. Apple and Firebase still handle sign-in data under their policies and applicable settings.

KOI services use account, installation-binding and entitlement data to admit requests. Firebase/Google SDKs also process their diagnostics. Google ML Kit's official disclosure lists device/app information, installation identifiers, performance, feature events, errors and configured languages for diagnostics and usage analytics.

Developer diagnostics and JEV testing

Local input diagnostics are enabled automatically only for accounts granted Lifetime Plus with a verified TestFlight/Sandbox or Xcode environment. There is no manual diagnostics enable switch. The App Store production environment is excluded, and ordinary accounts do not acquire local input diagnostics through this gate.

These local records can include input codes, committed characters, deletion and correction-evaluation events for development testing. They are not synced through iCloud, and there is no automatic upload of the entire trail. Eligible accounts have a clear control; local maintenance applies a 30-day retention rule.

Background JEV evaluation additionally requires current AI sharing consent, Full Access and valid Lifetime eligibility. Bounded sentences and replacement candidates pass through KOI's Cloudflare service to TypeSafe JEV. Withdrawing AI consent blocks new requests. JEV evaluates in the background in this version and does not automatically edit text.

Cloudflare's membership authorization cache lasts at most 60 seconds and contains no input text. This does not mean all Cloudflare or TypeSafe records are deleted after 60 seconds. TypeSafe's published policy states it does not train or fine-tune models on Input; its general retention terms give no fixed deletion period.

Purchases and transaction records

Apple processes payments. KOI uses product, transaction, purchase/subscription status and app-user identifiers from Apple and RevenueCat to calculate Credits, provide Plus, restore purchases, handle refunds and prevent duplicate accounting.

KOI retains Credits ledgers and purchase reconciliation data linked to accounts or guest wallets. After account deletion, transaction data needed for Apple refunds and accounting moves into a private audit record using replacement identifiers for the deleted account. This does not restore the original account or forfeited Credits.

Deleting a KOI account does not cancel an Apple subscription. Use “管理 Apple 訂閱” (Manage Apple Subscriptions) on the deletion confirmation screen or Apple's subscription page in iOS Settings to cancel it.

Service records and result reports

KOI processes request identifiers, timing, stages, models, status/error classifications, App Check and rate-limit data to operate and protect the service. These application summaries do not automatically attach raw prompts or generated content. Cloud platforms also process request and network logs under their configuration.

After separate report confirmation, KOI receives the result type, a SHA-256 digest identifying the generated result and an unsafe-content reason. It stores these with an installation HMAC, App Check app identifier and timestamps. This report does not send your account UID, full prompt, generated text/image or conversation history.

Report metadata becomes eligible for asynchronous deletion 30 days after creation. This is not a guarantee of physical deletion immediately on day 30. Account deletion does not extend or reset that date. If you contact support directly, you also provide your correspondence address, message and attachments.

Retention and deletion timing

• AI result recovery: generated text and images may be stored encrypted in Google Cloud Storage, linked to an account and operation, for recovery and delivery reconciliation. Accepted results have an app retrieval deadline of up to 24 hours; undelivered results have a separate recovery deadline. The bucket also has a lifecycle deletion rule one day after object creation, and expired data is cleaned in batches on subsequent account requests. Storage cleanup may precede the app deadline. Lifecycle deletion is asynchronous: neither a full 24 hours of availability nor physical deletion of all AI data within 24 hours is guaranteed.
• Conversations and images: the current conversation is held temporarily in the keyboard session and can be cleared. Saved images remain in the local KOI library until you delete them. Copies saved to Apple Photos must be managed in the Photos app.
• Image-reference cache: the server-memory cache has a 10-minute expiry, capped at 24 entries and 32 MiB. Expired entries are removed during cache access and maintenance.
• Provider processing: text requests ask for zero retention and no content collection. Images, search, JEV, security, accounting and SDK data have separate policies and agreements. Brave's published Search API notice describes query logs retained up to 90 days for billing and troubleshooting, subject to legal obligations.
• Accounts and purchases: account deletion removes account data, active bindings and AI results. Transaction, deletion and security records needed for refunds, financial reconciliation and abuse prevention may remain without a single deletion deadline. Cloud-platform data and backups follow their configured handling. Contact us about retention and deletion of specific records.

Children

KOI is not designed specifically for children under 13 and does not knowingly collect their personal data. Contact us if you believe a child has provided us personal data so we can address it.

Your choices and account deletion

• Withdraw AI sharing: in the KOI app's “AI 與 Credits” page, press “已同意 AI 資料分享 · 撤回” and confirm. New AI sharing stops and ordinary local input remains available.
• Stop sync: sync is off by default; you can stop manual syncing and turn the switch off.
• Delete an account or guest data: in the account section of “AI 與 Credits”, press “刪除帳戶” (Delete Account) or “刪除訪客資料” (Delete Guest Data), read the disclosure and type “刪除” to confirm. Apple accounts require reauthentication; guest deletion does not require Apple sign-in. Incomplete cleanup displays a retry or processing state.
• Deletion effects: associated account/guest Credits and that account's Lifetime Plus are forfeited. Account access, active bindings, AI consent, developer diagnostics and related synced data are cleaned up. Ordinary local learning, settings and the image library use their own clear/delete controls. Transaction audits and the retention exceptions above still apply.
• Local and photo data: use KOI's learning, diagnostics or image-library clearing controls. Delete Photos copies separately. Uninstalling removes the app's current local storage; iCloud, device backups and provider copies follow their own settings and policies.
• Access, correction or deletion enquiries: contact privacy@rainsday.com. We may request appropriate account or transaction evidence to verify ownership. Do not send passwords or full verification tokens.

Policy updates

We update this page and its effective date when data handling changes. Changes to AI recipients, shared data or purposes will update the sharing notice and consent version and require renewed agreement.

Contact

• Privacy enquiries: privacy@rainsday.com
• General support: support@rainsday.com or the support page.