Privacy Policy

Kikko is a family assistant that helps parents keep track of their kids' schedules. To do that job it has to handle information about your family, so we want to be completely clear about what we collect, why, and what happens to it.

Kikko is operated by FopyLabs (Luca Capone) ("we", "us"). We are the data controller for the personal data described in this policy. You can reach us at hello@kikko.ai.

The short version

• Your family's data is stored in the EU (Frankfurt, Germany).
• We use AI (Anthropic's Claude) to read the school emails, photos, and messages you choose to send us and turn them into calendar events. Anthropic does not use this data to train its models.
• We never sell your data. There is no advertising in Kikko.
• You can export everything or delete your account (and all its data) yourself, in the app, at any time.

What we collect

Account data. Your email address and a display name. Passwords are handled by our authentication provider and are never visible to us in plain text.

Family data you add. Your family name, your children's first names, and optionally their dates of birth, school names, and profile photos. You control all of this; none of it is required beyond a name to label events with.

Content you send to Kikko. This is the heart of the product: emails you forward to your family's private Kikko address, photos and PDFs you upload or share, text you paste, and messages you type or dictate in chat. Kikko processes this content to extract events, tasks, and reminders.

Calendar data. The events, tasks, reminders, and notes Kikko extracts or that you create by hand.

Device data. A push notification token for each device where you enable notifications, and basic device type information needed to deliver them.

Subscription status. Whether your family is on a trial, subscribed, or lapsed. Payments are processed by Apple (in the iOS app) or Stripe (on the web) - we never see or store your card number or bank details.

Usage analytics. Product events (e.g. "an event card was created") via PostHog, hosted in the EU. We use this to understand which features work, not to profile you. No advertising identifiers, no cross-site tracking.

What we do NOT collect

• We don't read your mailbox. Kikko only ever sees individual emails you actively forward to your family's Kikko address.
• We don't access your contacts, location, or photo library beyond the specific items you pick.
• We don't collect data from your children. Kikko accounts are for adults (16+); information about children is entered by their parents or guardians.

Children's data

Kikko is a tool for parents, and parents naturally store information about their children in it (names, school events, activities). We treat this data with special care: it is protected by the same encryption and EU hosting as everything else, is visible only to members of your family, and is deleted along with your account. Children cannot create Kikko accounts, and Kikko is not directed at children.

Why we process your data (legal bases under GDPR)

• Providing the service - accounts, families, extraction, calendar, reminders, chat, and the notifications you enable: performance of a contract (Art. 6(1)(b)).
• Payments and subscriptions: performance of a contract, plus legal obligations (Art. 6(1)(c)) for invoicing and tax records.
• Product analytics: legitimate interest (Art. 6(1)(f)) in improving Kikko; you can object at any time via hello@kikko.ai.
• Security, abuse prevention, and rate limiting: legitimate interest in keeping the service safe.

AI processing - how it works

When you forward an email, upload a photo, or chat with Kikko, that content is sent to Anthropic's Claude API to extract structured information (dates, places, what to bring) or to answer your questions. Under Anthropic's commercial terms, API inputs and outputs are not used to train Anthropic's models. Anthropic retains API data only briefly for abuse monitoring, then deletes it.

Two honest caveats:

• AI makes mistakes. Kikko marks uncertain extractions for your review, but always double-check critical details (times, dates, deadlines) against the original message - which Kikko keeps attached to every event for exactly this reason.
• Your forwarding address is a mailbox. Anything sent to your family's private Kikko address will be processed. The address is unguessable, and email from senders we don't recognize is quarantined for your review instead of being trusted automatically - but treat the address like you would any private inbox, and don't forward content you wouldn't want processed.

Who processes your data (subprocessors)

We use a small set of service providers, each bound by a data processing agreement:

* Where a provider processes data outside the EU/EEA, transfers are protected by the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.

We never sell personal data, and no third party receives it for advertising.

How long we keep it

• Your family's data: for as long as your account exists. Delete your account and it's gone - see below.
• Forwarded emails and uploads: kept so you can always check the source behind an event card, until you delete the item or your account.
• Auth and security logs: up to 90 days.
• Payment records: as long as tax law requires (typically 10 years), held by our payment providers.

Deleting and exporting your data

Both live in Settings in the app, no email required:

• Export my data gives you a complete JSON file of your family's data - events, tasks, children, chat history, everything.
• Delete my account permanently removes your account. If you're the last member of your family, the entire family - events, tasks, chat history, uploaded files, forwarded emails, photos - is erased from our database and file storage. This is immediate and irreversible.

Your rights

Under the GDPR you can ask us for access, rectification, erasure, restriction, portability, or object to processing based on legitimate interest. The export and delete tools above cover the most common requests instantly; for anything else, email hello@kikko.ai and we'll respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

Security

All traffic is encrypted in transit (TLS) and all data is encrypted at rest. Access to your family's data is enforced at the database level: every query is checked against your family membership, so one family can never read another's data. Uploaded files live in private storage buckets accessible only to your family. Webhooks and internal jobs are authenticated with signed secrets.

No system is perfectly secure. If we ever discover a breach affecting your personal data, we will notify you and the supervisory authority as the GDPR requires.

Changes to this policy

If we change this policy in a meaningful way, we'll notify you in the app or by email before the change takes effect. The latest version always lives at kikko.ai/privacy.

Contact

FopyLabs (Luca Capone) - hello@kikko.ai