Privacy Policy - Kibo

Last updated: August 23, 2026

Kibo ("the app", "we") is an AI-powered emotional wellbeing companion. Privacy is not a legal section for us - it is the very condition under which this product can exist. What you write in Kibo is among the most personal data there is, and we treat it that way.

1. Who is the data controller

The controller of your data is E-SPOT DIVERT S.R.L., a Romanian company with its registered office at Str. Popa Șapcă nr. 24, Voluntari, Ilfov County, Romania, registered with the Trade Registry under no. J2022001375231, VAT no. RO45723091 (the operator of the Kibo app). You can reach us at privacy@meetkibo.com for anything related to your data.

2. What data we collect

Account data: email address, password (hashed; we never see it) or Sign in with Apple.

Profile data: first name (what to call you), age, gender (optional), language, communication preferences.

Personal content (sensitive data): evening reflections, conversations with Kibo, mood check-ins, questionnaire answers, relationships you choose to describe, and the psychological profile the app builds. This is health-related data under GDPR and we process it only with your explicit consent, given when you create your account. You can withdraw consent at any time by deleting your account.

Usage data: anonymized product events (e.g. "completed onboarding", "wrote a reflection") - never their content; technical crash reports; your device's push notification token.

Payment data: subscription status (active/trial/expired). Payments are handled exclusively by Apple; we never see or store your card details.

3. How we use your data

• To provide the service: your profile, daily actions, reflections and conversations are processed so Kibo can know you and help you in a personalized way. That is the essence of the product.
• To generate AI responses: relevant content is sent to our AI provider (Anthropic) under a zero-retention policy - Anthropic does not store your data and does not use it to train models.
• To transcribe voice dictation: if you choose to dictate instead of typing, the audio recording is sent to Groq (Whisper model) solely for transcription. Audio is never stored - not by us and not by Groq; we keep only the resulting text, like any other message.
• To improve the product: aggregated events only, never personal content.
• To send you notifications (you can turn them off anytime in Settings or your phone settings).

We do not sell your data. We do not use it for advertising. We never share it for marketing purposes.

4. How we protect your data

• Intimate content (reflections, conversations, your psychological profile) is column-level encrypted (AES-GCM) in the database and decrypted only at processing time, server-side.
• All transfers are encrypted (TLS).
• The app can be locked with Face ID / biometrics on your device.
• The database is hosted in the European Union (Frankfurt, Germany).

5. Our processors

Meta Pixel and Conversions API (only on meetkibo.com/portret pages). On the web quiz pages we measure the effectiveness of our ads: page views, email submissions, checkout starts, and completed purchases (with amount and currency). Measurement happens on two paths: from your browser (Meta Pixel, which sets cookies such as `_fbp`) and from our server to Meta (Conversions API). Both send the same events with a shared identifier, so they are not counted twice.

Through the Conversions API we send Meta: your email address as an irreversible SHA-256 hash (Meta receives a string of characters, not the address itself, and uses it only to match the event to an existing account), an internal identifier of your session, also hashed, your IP address, browser information, and the Meta cookies mentioned above. We never send Meta your quiz answers or the content of your portrait.

You can block the pixel in your browser with a content blocker, and Meta's ad settings let you limit how Meta uses this data. The quiz works exactly the same without measurement. If you want us to stop sending your data to Meta entirely, write to contact@meetkibo.com and we will delete the events associated with you.

Our own cookies (no tracking). On meetkibo.com we use two first-party cookies that contain nothing about you as a person and are never shared: `KIBO_CC` stores the detected country so we can show you the right currency and the right local support lines, and `KIBO_AB` stores a random number between 0 and 9999, which we use to test page variants and to make sure you see the same variant if you reload. Both expire after 30 days and you can delete them from your browser at any time; the quiz works exactly the same without them.

6. Retention

For as long as your account is active. Conversations older than 30 days are consolidated into summaries (originals are deleted). When you delete your account, all your data is permanently removed from our systems within 30 days (including backups).

7. Your rights (GDPR)

• Access and portability: export all your data directly in the app (Settings - Export data).
• Deletion: delete your account and all data directly in the app (Settings - Delete account). No emails, no waiting.
• Rectification: edit your profile anytime.
• Withdrawal of consent: anytime, by deleting your account.
• Complaint: you have the right to lodge a complaint with your local supervisory authority (in Romania: ANSPDCP, www.dataprotection.ro).

For anything else: privacy@meetkibo.com.

8. Minimum age

Kibo is intended for people aged 16 and over. Between 13 and 16, use is permitted only with parental/guardian consent where applicable law allows it. We do not knowingly collect data from children under 13; if you learn that a child has created an account, contact us and we will delete it immediately.

9. Kibo is not a medical service

Kibo is a personal growth and emotional support tool. It is not psychotherapy, not a medical service, and does not replace a professional. If you are in crisis, the app will surface real help resources (crisis lines), and we encourage you to use them.

10. Changes

If we materially change this policy, we will notify you in the app before the change takes effect. Continued use after notice means acceptance of the new version.