Privacy Policy

Kikan turns the messages you paste into follow-ups. To do that it stores your account, the text you paste and the follow-ups made from it, and sends the text of each capture to a language model. We do not sell your data, show ads or use analytics trackers, and your text never reaches our logs or error reports.

Kikan, available at kikan.app, is the controller of your personal data under the EU General Data Protection Regulation (GDPR). Write to privacy@kikan.app with any question or request about your data.

• Account: your email address, the name and email address Google or Microsoft share if you sign in with them, the names and addresses you add as your identities, and your settings such as timezone and digest hour.
• Content: the text you paste, the follow-ups, people, notes, folders and reminders made from it, and the history of changes to each follow-up. Pasted text is encrypted in the database with a key specific to your workspace.
• Other people’s data: pasted messages usually contain names and email addresses of the people you correspond with. You decide what you paste; Kikan uses it only to build your follow-ups.
• Usage and billing: how many captures you made and what they cost in model use, to apply your plan’s weekly allowance; your Stripe customer and subscription status. Card details go to Stripe and never reach us.
• Google Calendar: if you connect it, the email address of the Google account and an access token from Google, encrypted with your workspace key.
• Technical: session and security cookies, and your IP address, which is kept briefly in rate-limit counters to stop abuse.

Google and Microsoft sign-in share only your name and email address. Kikan never reads your mailbox.

• To provide Kikan: extract follow-ups, show your queues, send sign-in links, reminders and digests, and run your plan. The legal basis is our contract with you (GDPR Art. 6(1)(b)).
• To keep Kikan secure and working: rate limits, error reports and abuse prevention. The legal basis is our legitimate interest in a safe, reliable service (Art. 6(1)(f)).
• To keep records required by law, such as for payments. The legal basis is a legal obligation (Art. 6(1)(c)).

We do not use your content to train models, and we do not make decisions about you by automated means alone.

When you capture a message, its text, the date and your identities are sent through ProxyAPI to OpenAI, which returns the follow-ups it finds. Requests are made with storage turned off. Under OpenAI’s API terms, API data is not used to train its models and may be kept for up to 30 days to detect abuse. You always review the result before it is saved.

Only if you create a calendar subscription link in Settings, any calendar app that has the link can fetch the title and due date of each open follow-up that has a due date, with a link back to Kikan. Notes, summaries, pasted text and the names of people are never included. The link is a secret: Kikan stores only a hash of it, and anyone you share it with can read these titles. Regenerating the link or turning the subscription off stops the old link at once; calendar apps that already copied events keep them until their next refresh, under their own terms.

Only if you connect Google Calendar in Settings, Kikan creates a separate calendar in your Google account and sends it the title and due date of each open follow-up that has a due date, with a link back to Kikan. Notes, summaries, pasted text and the names of people are never sent, and Kikan never reads your other calendars or events. Google then holds these events under its own terms. Disconnecting stops the sync and removes Kikan’s access; you can choose to delete the calendar at the same time.

We share personal data only with the service providers below, each limited to what its task needs. Stripe, as merchant of record, also acts as an independent controller of the payment data it collects. If you connect an AI assistant to Kikan, that assistant can read and change your follow-ups on your behalf under its own provider’s terms; you can disconnect it at any time in Settings → Connected apps. The same applies to Google Calendar if you connect it (see above).

Your data is stored in Germany. Captures pass through ProxyAPI in Russia and are processed by OpenAI in the United States; email, error reports and payments involve providers in the United States. Where a country has no EU adequacy decision, the transfer relies on the European Commission’s standard contractual clauses or, for providers certified under it, the EU–US Data Privacy Framework. Ask us for a copy of the relevant safeguards.

• Your account and content are kept while your account exists.
• Pasted text is kept unless you set a source retention period in Settings (30, 90 or 365 days); it is then deleted that long after the source is finished with.
• Deleted follow-ups can be restored for 30 days and are then erased.
• Data exports can be downloaded for 24 hours and are then deleted.
• When you delete your account, its encryption key is destroyed and every row is deleted at once, your Stripe customer is deleted, which cancels any subscription, and a connected Google calendar created by Kikan is deleted with its events.
• Payment records that Stripe must keep by law are kept by Stripe.

You can access, correct, export and delete your data. Export and account deletion are in Settings → Data and work without contacting us. You can also object to processing based on legitimate interest, ask us to restrict processing, or withdraw from Kikan at any time. For any other request, write to privacy@kikan.app; we answer within one month.

You have the right to lodge a complaint with a supervisory authority, in France the CNIL (cnil.fr), or the authority where you live.

Kikan uses only cookies it needs to work: a session cookie that keeps you signed in for up to 30 days, a security cookie that protects forms against cross-site requests, and a cookie that remembers your theme. There are no advertising or analytics cookies, so no consent banner is needed.

Connections use TLS. Pasted text and exports are encrypted with per-workspace keys, sessions are stored hashed, every request is checked against your workspace, and sign-in links expire after 15 minutes and work once.

Kikan is not meant for anyone under 16, and we do not knowingly collect their data.

If we change this policy, we update the date above. For changes that affect how your data is used, we tell you by email before they apply.