In short

Kiky Notes recognizes text on your device by default. Some optional features, your account, notifications and the ads in the free version send data outside your device, as described below. We do not sell your notes, documents or OCR text.

Who we are

Kiky Notes is published by Kiky Apps (developer: Everton Kozloski). For anything about your privacy or your data, write to [email protected].

What stays on your device

Your notes, the text recognized by OCR, the images you capture and your settings are stored on your phone.
Text recognition (OCR) runs on your device by default, using Google ML Kit models that run locally.
Photos you import are chosen with the Android photo picker: the app only receives the pictures you select, and does not ask for access to your whole photo library.

What we collect, and why

Only what is needed for each feature you use:

Account (if you sign in): your email address and the name or ID of your Kiky or Google sign-in. Used to identify your account, licenses and credits.
Devices and notifications: a device name, platform and app version, and a Firebase Cloud Messaging token, so we can link your devices to your account and send you notifications.
Optional cloud features (only when you allow them): the image, audio or text you choose to send is processed on our servers, for example to recognize or reconstruct a captured document, to translate or summarize text, to chat about a document, or to transcribe a meeting in the cloud (Whisper, with speaker identification). The files you send (images and audio), the request and its result (for example the recognized text, the summary, the AI reply or the transcript) are kept only long enough for the app to receive the result, and are deleted automatically within about two hours after the task finishes (a task that never starts is closed and cleaned after 72 hours). We keep only a technical record linked to your account (type, status, time and credits used), for support and to prevent abuse. You can turn these features off at any time in Settings.
Purchases and credits: payments go through Google Play, and we never see your card. We keep records of licenses, subscriptions and credit usage.
Ads (free version): Google AdMob collects your advertising ID, an approximate location derived from your IP address, how you interact with ads and diagnostic data, to show and measure ads. Where the law requires it (for example in the European Economic Area and the United Kingdom), we ask for your consent first, and you can change it later in Settings > Privacy & ads.
Optional backup: if you turn it on, your notes are saved in a hidden folder of your own Google Drive that only this app can read. They do not go to our servers.
Permissions: camera (to capture), microphone (to record meetings) and notifications. Meeting audio is transcribed on your device, or on our servers only if you choose the cloud option and allow it.

Document signatures (Kiky Sign)

Checking and applying signatures on a PDF happens on your device. The "ask others to sign" feature (Plus plan) works like this:

The PDF you choose is uploaded to our servers and stored in our database (never in a public folder) so the people you invite can read and sign it.
You give us each signer's name and email. We email them a personal link and a 6-digit confirmation code. Only ask for signatures from people you have a legitimate reason to contact.
To prove who signed and when, we record for each step the date and time, the IP address and the browser (user agent), the name typed by the signer, the optional drawn signature, and that they accepted the terms. The final PDF carries a certificate of completion with the signers' names, emails and this trail, and is digitally sealed and time-stamped. The time-stamp request sends only a hash of the PDF to a public time-stamp authority; the document itself is never sent.
Files (the original, the sealed PDF and drawn signatures) are deleted 30 days after the request is completed, canceled or expires. The audit trail (names, emails, dates, event types) is kept as evidence; the IP address and browser are erased one year after the request ends.
Emails (invitations, codes, reminders and completion notices) are sent through our transactional email provider. Signer links are stored only as a one-way hash.
To check whether a certificate was revoked, the app may ask our server to fetch the certificate authority's revocation list or OCSP answer on its behalf, because the app does not use plain HTTP. Our server sees the address of that public service (and, for time-stamps, only a hash), not your document. These requests can appear in standard server logs.
The Kiky seal is a self-issued electronic seal. It is not a qualified certificate (ICP-Brasil / eIDAS); whether a signature is enough for a specific purpose depends on the law that applies to you.

File sharing by link or invitation (CloudShare)

Sharing a file through CloudShare is optional. The file is encrypted on your device before it is uploaded, and we cannot read it:

The key that unlocks a file stays in the link you share (after the # sign, which browsers never send to us) or inside an encrypted envelope made for the device of a person you invite. We never receive the key, the file name or the file type, so we cannot read, scan or recover the content.
We store the encrypted file (in a private folder, not in a public one), its size, the upload, update and expiry dates, and which Kiky accounts opened it. A free account can keep a few small files; each file expires 30 days after upload or after you confirm it in your dashboard, and is then deleted. We email you once, 3 days before that.
Inviting someone to edit: you give us a username or an email address. If the person has an account we send a notification to their devices; if not, we email that address a notice explaining how to install the app and sign in, without any link to the file or key. Each person you invite counts toward your plan's limit. We keep the invitation (who, when, its status), the public encryption key of the invited person's device, and the encrypted envelope until you remove the invitation, the file expires or the account is deleted.
Anyone who has the link and a Kiky account can open the file; opening it is recorded (account and date) to enforce the limit of people per plan. A person you invite who accepts receives a copy of the file on their device, which we cannot take back; removing the invitation stops further downloads.
Because we cannot read shared files, we cannot check their content. You are responsible for what you share. Report abuse through the contact page; we remove a file by its link identifier.

Anonymous usage statistics (optional)

If you choose to share them (it is off by default: an unticked box when you accept the terms, and a switch in Settings you can change any time), the app sends anonymous usage numbers so we can see which features matter and which ones fail:

Only counts: how many times each feature was used and failed, whether it ran on your device or in the cloud, how long it took, how many pages you scanned, and how long the app was open.
A random installation ID that is not linked to your account, your email or your device. We never collect the content of your notes, recognized text, file names, email or location in these statistics.
Turning it off in Settings stops it and deletes the numbers that were not sent yet.

This website (kiky.app)

The website uses essential cookies to work. Optional cookies are only used if you accept them in the cookie banner.

How long we keep it, and how to delete it

Data on your phone stays until you delete it or uninstall the app.
The files you send to cloud features (images and audio), and the requests and results of those tasks (for example recognized text and transcripts), are deleted automatically within about two hours after the task finishes.
Account data on our servers (account, devices, and the technical records of tasks and credits) is kept while your account exists.
To delete your account and the data we hold, follow the steps at the account and data deletion page. Your account is disabled as soon as we confirm the request, kept for 30 days in case you change your mind, and then permanently deleted.
Some billing and credit records may be kept where the law requires it or, once they no longer identify you, for accounting.

Delete your account and data

Your rights and choices

Under Brazil’s LGPD, the European GDPR and similar laws you can ask for access to your data, correction, deletion, a copy (portability), and you can object to or withdraw consent for processing. To do so, write to us:

Email [email protected]. We may ask you to confirm it is really you.
Export your notes from inside the app (TXT, PDF).
Turn cloud AI features off in Settings.
Change your ad choices in Settings > Privacy & ads (shown where required by law), reset your advertising ID in Android Settings > Google > Ads, and manage ad personalization in your Google account.
You can also complain to your data protection authority (in Brazil, the ANPD).

Security

Data travels over encrypted connections (HTTPS) and sign-in tokens are stored in your device’s protected storage. No system is perfectly secure, but we limit access to what each feature needs.

Children

Kiky Notes is not directed to children, and we do not knowingly collect personal data from them. If you believe a child has given us data, write to us and we will delete it.

International processing

Our servers are in Brazil. Google, which provides ads, notifications, purchases and optional backup, may process data in other countries. Where the law requires it, we rely on appropriate safeguards.

Changes to this policy

We may update this policy. Significant changes will be announced in the app, and the date at the top always shows the latest version.

Contact

Questions about this policy or your data:

Email: [email protected]

Developer: Everton Kozloski · kiky.app

Delete your account and data Data safety summary Contact

Privacy Policy