Privacy Policy

Last Updated: October 7, 2026

Khio AI ("Khio", "we", "us", or "our") builds an AI assistant you can use on the web, in our mobile apps, and by text. This policy explains what we collect, how we use it, who we share it with, and your choices. It covers all of Khio:

• Khio AI: chat, co-written documents, notebooks, and voice mode at khio.ai.
• Keeps: AI study tools (flashcards, quizzes, notes, AI tutor).
• Khio Text: our iMessage/SMS assistant for tracking your day by text.
• Khio Life: the dashboard, add-ons, and account connections.
• KhioAI Chrome extension: answers what is on screen, records lectures, and does browser tasks you ask for.

By using the Service you agree to this policy. Please also read our Terms of Service.

1. Information We Collect

Account information

• Sign-in identifiers. When you sign in with Apple, Google, or a phone number, we receive a stable identifier (Apple user ID, Google user ID, or phone number) plus, if you share them, your name and email.
• Profile basics. A profile picture from Google Sign-In (if you connect Google), and your timezone (detected on first use so reminders fire at the right local time).

Content you create or send

• Messages & conversations. Your chats with Khio AI, your iMessage/SMS messages with Khio Text, and AI tutor conversations. These may include personal, health, wellbeing, financial, or emotional information you choose to share.
• Uploads & sources. Text you paste, files you upload (PDF/DOCX/PPTX/TXT), images and photos, audio recordings, and URLs (including YouTube/TikTok links).
• Things you log. Gym workouts, meals and calories, habits, sleep, cycle, budget, todos, and calendar entries you record by text or in the app.
• Generated content. Flashcards, notes, quizzes, mind maps, podcasts, documents, and other output Khio produces from your inputs.
• Memory. To feel personal, Khio remembers context about you (your goals, preferences, and past conversations). You can view and clear this in your settings.

Data from accounts you connect

• Google sign-in. We use your Google account identifier, name, profile image and email address to sign you in. Signing in does not by itself connect your Gmail, Calendar or Drive.
• Gmail and Calendar. Connecting a personal or school Google account lets Khio read email content, senders, recipients, subjects and message identifiers, and calendar event details such as titles, dates, locations and attendees. Khio uses these for inbox questions, summaries, schedule answers and background email alerts. Important-email monitoring starts when you connect Gmail; you can pause it and manage sender-specific rules in Settings → Automations.
• Optional actions. Read-only access is the default. If you choose read-and-act access, Khio can send or reply to email, archive messages, mark them read, move them to Trash, and create, change or remove calendar events. Outgoing emails require your review and confirmation. Khio does not request permission to permanently delete Gmail messages.
• Optional Google Drive. If you enable Drive, Khio can search file names and metadata, download or export matching files, and read their contents to answer your requests. This access is read-only: Khio cannot create, edit, move, share or delete Drive files.
• Connection credentials. We store OAuth access and refresh tokens on our server so connected features can work while you are away. We do not receive your Google password through Google OAuth.
• Your controls. Disconnect an account in Settings → Connections to remove its stored tokens, request revocation at Google, clear connection caches and stop associated monitoring. If Google cannot confirm revocation, the disconnect result says so; you can also remove access in your Google Account. Previously saved chats and generated content are separate from the connection and remain until you delete them or your account.

Apple Health (Khio AI iPhone app)

Apple Health is off until you connect it in the Khio AI iPhone app, first on Khio's own screen and then on Apple's permission screen. Khio only reads the types you allow there.

• What we read. Daily steps, walking and running distance, active energy, heart rate (daily average, low and high), resting heart rate, time asleep, body weight, and your workouts (type, start and end time, duration, distance, energy and average heart rate). Khio never writes to Apple Health.
• Why. Only to coach you: to answer questions about your activity, sleep and training, and to shape your check-ins and suggestions. A daily summary and your workout list are stored on our servers so Khio can use them when the app is closed. Nothing is stored in iCloud.
• Never sold, never for ads. We do not sell Apple Health data, share it with data brokers, or use it for advertising or marketing, and we do not use it to train AI models.
• AI processing. To write your replies, relevant Apple Health data is sent to our AI providers, OpenAI and, as a backup when OpenAI is unavailable, Google (Gemini), which process it on our behalf.
• Disconnecting deletes it. Disconnect Apple Health in Connections and Khio deletes every Apple Health record it synced and stops reading. Deleting your account deletes it too. You can also withdraw Khio's access at any time in the Health app's sharing settings.

KhioAI Chrome extension

The KhioAI extension for Chrome is for Khio Premium subscribers. It only does something when you ask it to.

• Answering what is on screen. When you press one of its keys (G, H or J by default), it takes a screenshot of the tab you are looking at and sends it to Khio so we can read the questions on it and answer or explain them. Nothing is captured while you just browse.
• Recording a lecture. Between pressing Record and Stop, it records the audio you chose (the tab, your microphone, or both) and sends it to Khio in short pieces to turn into a transcript. The audio is not kept. If you save the lecture, its transcript becomes a Keep in your own Khio library.
• Browser tasks in your own Chrome. Only if you switch on "Let Khio use this browser", Khio can do a task you asked for in tabs it opens in a "Khio" tab group. It reads and clicks those pages, and the page contents and screenshots of them are sent to Khio to do the task. It never touches your other tabs and never sees your passwords. It never enters your card, and it only presses a button that spends money when you asked it to buy something and approved the exact total. You can watch it work, stop it at any time, or switch it off in the extension.
• Stored on your computer. Your Khio sign-in token (read from khio.ai so you don't sign in twice), your chosen keys and settings, and your most recent answers.
• AI processing, never sold. Screenshots, page contents and audio are processed by our AI providers as described below, only to do what you asked. We do not sell this data or use it for advertising.

Usage & technical data

• Live ETA location. If you deliberately start Live ETA sharing, Khio processes your current coordinates, destination, distance, and estimated arrival time so the people you share the session with can see its Live Activity. Location sharing stops when you arrive, end the session, or its timer expires.
• Token usage counts for AI generations (to enforce trial and premium quotas) and aggregate feature usage.
• Subscription and billing status (we do not store your full card number — payments are handled by Stripe and Apple).
• Device and log data such as browser/device type, app version, and the route that errored, collected in crash reports and error logs. These do not include the contents of your study material or private messages.

2. How We Use Your Data

• Provide the Service — generate responses, flashcards, plans, summaries, and other output from what you submit.
• Remember and personalize — keep context so Khio feels continuous and tailored to you.
• Sync your work across the web, mobile apps, and your text thread.
• Reminders & check-ins — send the messages and nudges you've enabled.
• Process payments for subscriptions and trials.
• Support, safety & reliability — respond to issues, investigate and prevent abuse or harm, enforce our Terms, and keep the Service running and secure.
• Comply with law — meet our legal, tax, and regulatory obligations and respond to lawful requests.

3. AI Processing of Your Content

What is sent, and to whom. Khio sends relevant information through our backend to OpenAI and Google (Gemini) to generate replies, understand submitted content and provide voice conversations. Depending on the feature, this includes messages, relevant conversation history and saved memories, submitted photos and files, voice recordings and live-call audio, and relevant profile details such as your name and goals. If you separately authorize a connection, relevant Apple Health activity, sleep and workout summaries, Apple Reminders, email, calendar events or file content can also be included. We collect this information from what you submit or log, your sign-in profile, and only the permissions you grant to connected services.

Routing and speech. TypeSafe AI receives the current message and bounded recent conversation excerpts to select the instructions relevant to your request. For automated browsing, it may receive the task goal, notes, recent steps and page details to choose the next action. Its privacy policy prohibits training or fine-tuning on submitted inputs, and its Data Processing Agreement governs processing on our instructions. When you request a podcast or spoken reading, Microsoft (Edge text-to-speech) receives the text to synthesize audio, under the Microsoft Privacy Statement. Web lookups use our self-hosted SearXNG service, which forwards the relevant search query to search engines; page reading sends the requested URL to the website. TinyFish is not the active search or page-reading provider.

Your choice in the iPhone app. Before sign-in or opening an existing session, the app presents a separate AI processing screen that names these providers and explains the data above. Choosing Allow AI processing records your permission on that installation. Choosing Don't allow keeps the app's AI features, Siri questions, calls and connected-data sync off. A saved login, a link to this policy, and Apple or Google sign-in are not treated as permission. You can revisit the disclosure in the app menu under AI privacy; choosing Don't allow there stops a native call, stops this device's Health sync and signs you out. Signing out clears this installation's permission; using the app again requires a new choice. This device choice does not revoke connections or permissions you separately granted on other devices or through Khio Text. Disconnect those connections or delete your account to remove their stored data as described below.

Provider protection. We use paid OpenAI and Gemini API services with model training on private user content disabled. We require third-party providers that process personal data on our behalf to provide the same or equal protection as this policy, including purpose-limited processing, confidentiality, appropriate security, and applicable deletion and data-protection obligations. OpenAI's processing is governed by its Data Processing Addendum. Google's paid Gemini API processing is governed by the Gemini API terms and their applicable data-processing terms. We do not use the unpaid Gemini service to process private user content. Provider retention and safety-monitoring periods depend on the service and applicable controls; disabling model training does not mean data stays on your device or is never retained.

Khio is an AI product, so the content you submit is processed by AI systems to produce a response. When you use Khio, the relevant prompt and content are sent to our AI provider(s) to process the request and return a response. Provider retention depends on the service and applicable data controls. We do not use your private content to train third-party foundation models. A limited number of authorized people may review content where necessary to provide support, investigate a safety or abuse concern, debug a problem, or comply with law — under confidentiality and on a need-to-know basis. Because AI output can be inaccurate, you should not rely on it for important decisions; see our Terms of Service.

4. Who We Share Data With

To run Khio we share the minimum data necessary with the infrastructure providers below. Each is bound by its own terms and may not use your data for unrelated purposes.

We may also disclose information: (a) at your direction, such as to a service you connect; (b) for legal and safety reasons — to comply with law or a lawful request, to enforce our Terms, or to protect the rights, safety, or property of you, us, or others (for example, in an emergency involving a risk of harm); and (c) in a business transfer, such as a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honor this policy. We do not sell or rent your personal information.

5. Google User Data (Limited Use)

Khio's use of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API User Data and Developer Policy.

We use Gmail, Calendar and Drive data only for the connected, user-facing features described above. Relevant content may be sent to our AI providers to answer your questions, summarize information or carry out a request. Results may appear in your saved conversations and notifications. Email or file content is sent to another recipient only as part of an action you request and approve. We do not sell Google data, use it for advertising, or use it to develop or train generalized AI models.

Google data may be transferred only as permitted by Limited Use: with your consent to provide the connected features, for security, to comply with law, or in a business transfer after your explicit prior consent. Human access to Google data is limited to your documented consent to view specific data, necessary security investigations, legal requirements, or aggregated and anonymized internal operations. These restrictions also apply to information derived from Google data and take precedence over broader provisions elsewhere in this policy.

Tokens remain until you disconnect or delete your account. Temporary connection caches are cleared on disconnect; saved conversations, generated documents and automation records follow the retention and deletion controls below. To request deletion of Google-derived content you cannot remove in the app, email [email protected].

6. Messaging & SMS

If you use Khio Text, your phone number and the messages you exchange with Khio are processed to deliver the service. Message and data rates may apply. Reply STOP to opt out of messages or HELP for help at any time. We do not share your mobile number with third parties for their own marketing. See our Terms for full messaging terms.

7. Cookies & Similar Technologies

We use cookies and local storage for essential purposes — keeping you signed in, remembering your preferences and theme, and operating the Service. We do not use third-party advertising cookies. You can control cookies through your browser settings, though some features may not work without them.

8. Data Retention

We keep your data while your account is active so the Service works and Khio can remember you. When you delete your account, we delete your personal content (including the files and pages you created) and associated data, except where we must retain limited records to meet legal, tax, security, or fraud-prevention obligations. Backups are purged on a rolling schedule.

Pages you delete in Space go to Trash, where you can restore them for 30 days. After 30 days they are permanently deleted, and you can delete them sooner from Trash.

Live ETA coordinates are temporary: they are cleared when the session ends, arrives, or expires. The inactive session record is deleted after 24 hours. Khio does not turn Live ETA location into a location history or AI memory.

9. Security

We use industry-standard measures to protect your data, including encryption in transit and access controls. Google connection tokens are stored in our server-side database and are used by the service to access the permissions you granted. No system is perfectly secure, but we work to keep your data safe and will notify you of a breach where required by law.

10. Children's & Teens' Privacy

11. Your Rights & Choices

• Access & export — you can view your data in the app; email us for a copy.
• Correct or delete — edit your profile, clear Khio's memory, or delete your account from settings.
• Disconnect accounts — revoke any third-party connection from settings at any time.
• Opt out of messages — reply STOP, or turn off notifications in settings.

Depending on where you live, you may have additional rights:

• EU/UK (GDPR). Rights to access, correct, delete, restrict, object to, and port your data, and to withdraw consent. Our legal bases are performance of our contract with you, your consent (for example, connected accounts and messaging), our legitimate interests (operating, securing, and improving the Service), and legal obligations. You may also lodge a complaint with your local data-protection authority.
• California (CCPA/CPRA). See Section 12 below.

To exercise any right, email [email protected]. We will not discriminate against you for exercising your rights, and we will verify your identity before acting on a request.

12. California Privacy Notice

If you are a California resident, you have the right to know what personal information we collect and why, to request access to and deletion of it, to correct it, and to opt out of "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under California law, and we do not knowingly sell or share the personal information of anyone under 16. The categories of personal information we collect (identifiers, account and profile data, the content you submit, commercial/subscription data, internet and device activity, and inferences), the purposes for collecting them, and the providers we disclose them to are described throughout this policy. To exercise your rights, email [email protected]; you may use an authorized agent, and we will not discriminate against you for exercising your rights.

13. International Users & Data Transfers

Khio is operated from North America, and your data may be processed there and in other regions where our providers operate. These regions may have different data-protection laws than your own. Where required, we rely on appropriate safeguards for international transfers. By using the Service you consent to this transfer and processing.

14. Changes to This Policy

We may update this policy as Khio evolves. We'll change the "Last Updated" date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect means you accept the updated policy.

15. Contact

Questions or requests about your privacy? Email [email protected].