Privacy Policy

Effective 9 September 2026 · Last updated 9 September 2026

1. Who we are

Kairon is operated by HotPatch Studio Inc. ("HotPatch Studio", "we", "us"), a company incorporated in Canada, with its registered address at 1804-2A Church St Toronto ON M5E 0E1 Canada. This policy covers the Kairon mobile app only — our website and any other apps we publish are not covered by it.

We are the data controller for the personal information described in this policy. If you have any question about it, or want to exercise any right described in section 10, contact us at support@kairontheapp.com.

2. Information we collect

2.1 Account information

When you create an account, we collect and store:

Your email address, first name and last name.
Your sign-in method — email and password, Google, or Apple — and the account identifier that Google or Apple gives us when you use one of those. We never receive your Google or Apple password.
If you sign up with email and password, a cryptographic hash of your password. We never store the password itself and cannot read it.
Short-lived verification codes used to confirm your email address or reset your password. These expire within minutes and are then unusable.

2.2 Content you create

Kairon is a planning app, so most of what we store is what you choose to put in it. This includes your goals, milestones, sprints, tasks, habits and habit check-ins — along with the names, descriptions, dates, priorities and sizes you give them.

It also includes your sprint reflections: the free-text notes on what went well, what held you back and what you will try next, and the 1-to-5 mood rating you record alongside them. We treat reflection text and mood ratings as the most sensitive content in the app. They are never included in analytics, never used for advertising, and never used to train machine-learning models.

2.3 Preferences

Your settings — reminder schedules, theme and colour choices, sprint naming and duration preferences, and your analytics opt-in choice — are stored with your account so they follow you across devices.

2.4 Purchase information

If you buy the Supporter unlock or leave a tip, the payment itself is handled entirely by Apple or Google. We never see or store your card number, billing address, or any payment credential.

What we receive and store is a confirmation record: which product was bought, which store it came from, the amount and currency, the time of purchase, and a transaction identifier used to make sure the same purchase is not processed twice. We use this to unlock your Supporter status and to keep accurate business records.

2.5 Diagnostic information

When the app or our servers hit an error, we receive a crash or error report so we can fix it. These reports are deliberately stripped before they are sent:

They identify you only by your random account identifier — never your email or name.
The contents of requests are never attached, so the text of your tasks, goals and reflections cannot appear in them.
Web addresses are recorded without their query strings, and console logs are discarded.
No screenshots and no capture of the on-screen layout are collected.

Diagnostic reporting is not product analytics and is not covered by the opt-in toggle described below. It is what allows us to find out that the app is broken.

2.6 Usage analytics — off unless you turn them on

Kairon can collect anonymous-by-design product analytics to help us understand which features get used. This is disabled by default. Nothing is collected or transmitted unless you switch on Share usage data in Settings, and switching it back off stops collection immediately.

If you enable it, we record events such as:

Which screens you visit.
That a task, goal, habit or sprint was created or completed — with attributes such as whether a due date was set, or whether it was part of a sprint.
That a reflection was submitted. Neither the text nor the mood rating is ever sent.
Steps in the tipping flow, including which tip size was chosen.

These events carry only numbers, yes/no flags and fixed categories — never the words you type, and never your email or name. They are linked to your random account identifier so we can tell repeat use from first use. We have also disabled location lookup from your IP address, session recording, and automatic error capture in our analytics tool.

2.7 Information kept only on your device

Some data never leaves your phone: your sign-in tokens (held in the operating system's secure storage), the schedule for reminder notifications, and the small summary the home-screen widget reads. Reminders are generated locally by your device — Kairon does not operate a push-notification server.

3. What we do not collect

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.
We do not show advertising and we do not embed advertising trackers.
We do not collect your precise location, contacts, photos, calendar, microphone or camera.
We do not record your screen or your sessions.
We do not use your content to train machine-learning or AI models.

4. Why we use your information

Purpose	Information used	Legal basis (UK/EU)
Providing the app — storing your plans and syncing them across devices	Account information, content, preferences	Performance of a contract
Signing you in and keeping your account secure	Account information, sign-in identifiers	Performance of a contract
Sending account emails — verification, password reset, account deletion	Email address	Performance of a contract
Unlocking Supporter features and keeping accurate financial records	Purchase information	Performance of a contract; legal obligation for tax records
Diagnosing crashes and fixing faults	Diagnostic information	Legitimate interests — keeping the app working
Understanding which features are used	Usage analytics	Consent — and only if you opt in
Measuring overall activity levels, using existing account timestamps in aggregate	Dates on records you already created; never their contents	Legitimate interests — understanding whether the app is useful

5. Who we share information with

We do not sell your information. We share it only with the service providers below, each of which processes it on our instructions and only for the purpose shown.

Provider	What it handles	Where it processes data
Cloud hosting provider	Runs our servers and database — your account and all content live here	United States
Backup storage provider	Stores encrypted database backups, which it cannot read — the decryption key is held only by us	United States or Canada
Functional Software, Inc. (Sentry)	Crash and error reports, stripped as described in section 2.5	United States
PostHog, Inc.	Product analytics — only if you opt in	United States
RevenueCat, Inc.	Validating purchases and tracking Supporter status	United States
Sendinblue SAS (Brevo)	Delivering account emails	European Union
Apple Inc. / Google LLC	Sign-in, and processing payments for the Supporter unlock and tips	United States and elsewhere

Apple and Google act as independent controllers of the payment data they collect from you; their own privacy policies apply to it.

We may also disclose information if we are legally required to, or where necessary to investigate fraud or protect the rights and safety of our users. If Kairon is ever involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction; we will give notice before it becomes subject to a different privacy policy.

6. International transfers

We are based in Canada, and the providers above process data in Canada, the United States and the European Union. If you use Kairon from the United Kingdom or the European Economic Area, your information will be transferred outside that area.

Where that happens, transfers are protected by an appropriate safeguard — the European Commission's adequacy decision covering Canada for commercial organisations, or Standard Contractual Clauses agreed with the provider concerned.

7. How long we keep information

Your account and content — kept for as long as your account exists.
If you delete your account — your account, content, preferences and settings are deleted from our live systems immediately. Encrypted backups are overwritten on a rolling cycle and purged within 30 days.
Purchase records — retained for 7 years after the transaction, because tax and accounting law requires us to keep them. These records are kept separately from your account content and are not used to profile you.
Verification codes — expire within minutes of being issued.
Diagnostic reports — retained for up to 90 days, then deleted automatically.
Analytics events — retained while your opt-in remains active, and deleted on request.

8. Security

All traffic between the app and our servers is encrypted in transit using TLS. Passwords are stored only as salted cryptographic hashes. Sign-in tokens are held in your device's dedicated secure storage — the iOS Keychain or the Android Keystore — rather than in ordinary app storage. Access to production systems is restricted to those who need it.

No service can promise perfect security, but we design to limit what an incident could expose: our diagnostic tooling is configured never to receive the contents of your requests, and our analytics never receive the text you write.

9. Children

Kairon is not intended for children. You must be at least 13 years old to use it, and at least 16 if you are in the European Economic Area or the United Kingdom.

We do not knowingly collect personal information from anyone below these ages. If you believe a child has given us personal information, contact us at support@kairontheapp.com and we will delete the account.

10. Your rights

You can exercise the following at any time, free of charge:

Access — ask for a copy of the personal information we hold about you.
Portability — ask for your content in a structured, machine-readable format. Email us and we will send it to you.
Correction — change your name and email in the app, or ask us to correct anything else.
Deletion — delete your account and everything in it from Settings → Delete Account. This is immediate and cannot be undone. You can also ask us to do it for you.
Withdraw consent — turn off Share usage data in Settings at any time. Analytics collection stops right away.
Object or restrict — ask us to stop or limit processing that relies on our legitimate interests.

Write to support@kairontheapp.com to make any of these requests. We will respond within 30 days. We may need to confirm your identity first, to be sure we are not disclosing your information to someone else.

If you are in Canada and are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada. In the United Kingdom or the European Economic Area, you may complain to your local supervisory authority. If you are a California resident, you have the rights to know, delete, correct and opt out of sale or sharing — we do not sell or share personal information as those terms are defined by California law — and we will not discriminate against you for exercising them.

11. Changes to this policy

We may update this policy as the app changes. If a change materially affects how we handle your information, we will notify you in the app or by email before it takes effect. The date at the top of this page always shows the current version.

12. Contact

HotPatch Studio Inc.
1804-2A Church St Toronto ON M5E 0E1 Canada
support@kairontheapp.com