Privacy Policy

Information Collection and Use

By default, the Service does not collect personal data beyond what is needed to keep it running securely and to enforce fair-use limits. Depending on how you use the Service, the following information may be collected:

• The pages and features of the Application you visit, and the time and date of your visit
• The operating system you use on your mobile device

The Application does not gather precise information about the location of your mobile device.

Account Information

If you choose to create an account, the Application collects:

• Email address and username (when registering with email and password)
• Profile information provided by Google or Apple when you sign in using those authentication services
• Profile avatar images you upload or generate within the Application

Account data is stored securely in the Service Provider's database, managed by Supabase (supabase.com). You may use the Application without creating an account; anonymous usage is tracked by a one-way hashed (HMAC-SHA256) representation of your IP address solely for the purpose of enforcing daily usage limits. Your raw IP address is never stored.

This same anonymous-tracking approach applies to the Chat page on this website: if you use it without signing in, your messages are processed by the same third-party AI infrastructure to generate a reply, and a one-way hashed representation of your IP address plus token usage counts are logged for analytics and to enforce a daily usage limit, exactly as described above.

Chat Messages and AI Processing

The Application is an AI assistant. Messages you send are processed by third-party large language model (LLM) infrastructure providers in order to generate responses. Specifically:

• Your chat messages may be transmitted to OpenRouter (openrouter.ai) and/or Hugging Face (huggingface.co), which route them to the appropriate AI model for a response. Please refer to those providers' privacy policies for details on how they handle data passing through their infrastructure.
• Chat history is stored locally on your device in encrypted form (AES-256-CTR) and is not uploaded to the Service Provider's servers.

Image Generation

If you use image or avatar generation features, the text prompts you provide are transmitted to Replicate (replicate.com) to generate images. Please refer to Replicate's privacy policy for details on how they handle prompt data.

Memories

If you use the Memories feature, the memory entries you create are stored in the Service Provider's database (Supabase) and associated with your account. You may view, edit, or delete your memories at any time within the Application.

Optional Training Analytics

The Application may offer an optional, opt-in "Training Analytics" feature. If you choose to enable it, data you contribute through this feature is used to help improve KiwiMate's AI models. Because this data becomes part of an aggregate training/analytics dataset, once contributed it is not deleted — including if you later delete your account or turn the feature off. Opting out only stops future contributions; it does not retroactively remove data already contributed. This feature is off unless you actively opt in.

Usage Data and the Developer API Platform

The Application tracks the number of tokens (a measure of AI usage) consumed per request, per day. This data is stored in the Service Provider's database and is used to enforce daily usage limits (Kiwi Credits) and, for the website's Chat page, to understand overall usage as described above. It is not used for advertising or sold to third parties.

If you create a developer API key at kiwimate's Developers page, we also store the key (hashed, never in plain text after creation), the NZD credit balance associated with your account, and a record of API requests (timestamps, token counts, and rate-limit windows) needed to bill usage, enforce the 60 requests/minute rate limit, and detect abuse. We do not store the content of your API requests any longer than needed to generate and return a response.

Website Feedback and Issue Reports

If you submit feedback through this website, we collect the message, star rating, and an optional name you provide. If you report a bug through the "Report an Issue" page, we collect the title, description, an optional name and email address you provide, and your browser's user-agent string (to help diagnose the issue). This information is stored in the Service Provider's database/storage and used only to review feedback and fix reported problems.

Public Roadmap (Kanban Board)

The Application's public roadmap board is visible to anyone, including visitors who are not signed in. If you are signed in and submit a feature suggestion, your suggestion is displayed publicly on the board, and the email address associated with your account may be recorded alongside it for our internal reference. Do not submit suggestions containing information you don't want displayed publicly.

Third Party Access

The Application uses the following third-party services, each of which may have access to certain data as described:

• Supabase — database, authentication, and file storage provider. Stores account details, memories, usage data, feedback, issue reports, and avatar images.
• OpenRouter and Hugging Face — AI inference providers. Receive your chat messages to generate AI responses.
• Replicate — image generation provider. Receives text prompts when you use image or avatar generation features.
• Google / Apple — optional sign-in providers. Used only if you choose to sign in with Google or Apple.
• Vercel — hosts this website and provides cookieless, aggregate page-view analytics (Vercel Analytics) so we can see which pages are used. It does not set advertising or tracking cookies.
• Apple App Store / Google Play — if you make an in-app purchase, that purchase is processed entirely by Apple or Google. We never receive or store your payment card details; see "Purchases" in our Terms & Conditions.

The Service Provider may also disclose information:

• As required by law, such as to comply with a subpoena or similar legal process
• When necessary in good faith to protect the rights, safety, or security of the Service Provider, users, or the public, or to investigate fraud
• With trusted service providers who work on the Service Provider's behalf, have no independent use of the disclosed information, and have agreed to adhere to this privacy policy

Cookies & Tracking Technologies

This website sets one cookie: geo-currency, a functional cookie that remembers the currency your prices should be shown in (detected from your country), so the Store page doesn't need to re-detect it on every visit. It expires after 30 days and is not used for tracking or advertising.

We do not run advertising or cross-site conversion tracking on this website, and we do not sell or share your data with advertisers.

Opt-Out Rights

You can stop all collection of information by the Application by uninstalling it. You may use the standard uninstall processes available as part of your mobile device or via the mobile application marketplace. If you have an account, you may also delete it at any time from within the Application, or contact the Service Provider to request deletion. You can also decline, or later turn off, the optional Training Analytics feature described above at any time (see that section for what happens to data you already contributed).

Data Retention Policy

We keep things simple: by default we don't collect data beyond what's needed to run your account, so for most users there is little or nothing to retain. When you delete your account, your associated personal data (profile, memories, feedback tied to your account, and API/credit records) is deleted immediately, not just "in a reasonable time." Chat history is stored only on your device and is cleared when you uninstall the Application or clear app data.

The one exception is data you've contributed through the optional Training Analytics feature (see above): because that data is used in aggregate model training, it is retained even after account deletion. If you'd like your account or server-side data deleted, please contact the Service Provider at hello@kiwimate.net and they will respond in a reasonable time.

Children

The Application is not directed at, and is not knowingly used by, children under the age of 13. The Service Provider does not use the Application to knowingly solicit data from or market to children under 13, and does not knowingly collect personally identifiable information from them.

If you have reason to believe that a child under 13 has provided personally identifiable information to the Service Provider, please contact us at hello@kiwimate.net so we can delete it.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. Measures in place include: AES-256-CTR encryption for local chat history, HMAC-SHA256 hashing of IP addresses (so the raw IP is never persisted), hashed storage of developer API keys (shown to you only once, at creation), HTTPS for all network communication, row-level security policies in the database ensuring users can only access their own data, and platform-native secure storage (iOS Keychain / Android EncryptedSharedPreferences) for encryption keys.

Changes

This Privacy Policy may be updated from time to time. The Service Provider will notify you of any changes by updating this page. You are advised to review this Privacy Policy regularly, as continued use of the Application constitutes acceptance of any changes.

Your Consent

By using the Application, you consent to the processing of your information as set forth in this Privacy Policy, now and as amended by the Service Provider. This Privacy Policy is governed by, and should be read in accordance with, the laws of New Zealand, including the Privacy Act 2020.