Privacy Policy
1. Who is responsible for your data
[to fill: operating entity] (address: [to fill: registered address]) is the controller of personal data in KIVO. Contact: support@kivosocial.ai.
2. What we collect
- Account: user ID, username, profile photo URL, and the wallet addresses you sign in with or choose to link (public blockchain addresses).
- Profile photo and display name (optional): the photo and name you choose to set. Before upload, your device re-encodes the photo as a 512×512 JPEG, which removes location and other EXIF data (see section 10).
- Chat: messages, the photos, videos (including round video messages), voice messages and PDFs you choose to send, reactions and reports.
- Public posts: the posts, comments and images you publish, your likes and follows, in-app notifications, and copies of reported posts and comments (see section 10A).
- Wallet reads: to show balances and transaction history, the app looks up your addresses with blockchain service providers through KIVO's server; transactions you approve are simulated and broadcast the same way.
- Notifications: push tokens, and the addresses registered when you turn on incoming-transfer notifications.
- Region: the SIM country on Android, and the country inferred from your IP address (IP addresses are used only for the lookup and are not written to our database).
- Safety: recipient addresses and the domains of websites you connect your wallet to (risk checks); device integrity signals and the device model (see section 8).
- Diagnostics and usage: crash and error reports; anonymous usage events.
- Support and deletion requests: when you write to support@kivosocial.ai (including a deletion request by email), we receive your email address, your message and any signed statement you attach. We use them only to answer and handle that request and for nothing else, and keep them for up to 12 months after the request is handled.
Apart from that, we do not collect phone numbers, contacts or precise location (we receive your email address only when you write to us), we do not ask for your real name, and we never receive your recovery phrase, private keys, wallet password or wallet backups.
Some settings stay on your device and are not sent to KIVO: display currency, hide balance, auto-lock time, chat background and address book labels. Currency rates are fetched by KIVO's server from CoinGecko, and those requests contain no user data.
3. Chat
Chat is run by KIVO, and messages and attachments are stored with Supabase in Singapore (the ap-southeast-1 region). Chat is not end-to-end encrypted: KIVO's servers hold your messages and attachments. When a message is reported, or matches our scam-phrase filter, our operators can see its content and review it. Chat notifications are delivered by KIVO's server through Apple and Google push services and include the sender's name and a preview of the message.
When you report a message, KIVO's servers save a copy of it and of the other person's most recent messages in the same conversation, up to five including the reported one: the sender, time, text and attachments. A message that was already deleted is recorded only as deleted. A copy is saved only if you are a member of the conversation and can see the message. Only KIVO's servers and operators can read these copies; neither you nor the other person can, and they are not sent to OpenAI. The copies stay even if the other person later deletes the messages (see section 13).
4. AI moderation
With your consent, the text of messages you send in community rooms and links to their images are sent to OpenAI (United States) for automated moderation and are handled under OpenAI's API data usage policies. Text and images in direct messages and regular groups are not sent to OpenAI. This consent cannot be withdrawn on its own; to withdraw it, delete your account.
Public posts use the same consent as community rooms. With it, the text of the posts and comments you publish and links to the images in your posts are sent to OpenAI (United States) for automated moderation after they are published and are handled under OpenAI's API data usage policies. See section 10A.
Profile photos have no automated or AI review and are not sent to OpenAI, so they need no separate consent. See section 10.
5. Safety checks
Before you send assets, KIVO's server sends the recipient address and chain to GoPlus Security for a risk check. When you connect your wallet to a website in the browser or through WalletConnect, the server also sends that website's domain to GoPlus. GoPlus does not receive your account or IP address; results are cached by address or domain for 24 hours and are not linked to your account. The phishing-site list is downloaded by the app from KIVO's server and checked on your device; your browsing history is not uploaded.
6. Region
KIVO offers features by region. Your region is determined from the SIM country on Android and from the country that KIVO's server infers from your IP address using the MaxMind GeoLite2 database. IP addresses are used only for the lookup and are not written to our database; they may briefly appear in our infrastructure providers' request logs (up to 7 days). Denied requests are recorded with the country code and the account and kept for 24 months; when you delete your account, the link to the account is removed.
7. Diagnostics and usage analytics
Crash and error reports are handled by Sentry, which does not store IP addresses; recovery phrases, passwords, keys and similar content are removed from them. From the app's first launch, PostHog records anonymous usage events (such as opening the app, moving it to the background, and safety-related counters) under a random install ID that is not linked to your account, and discards IP addresses.
8. Device security
The app uses Talsec's freeRASP to detect rooted, jailbroken, tampered or hooked devices. Talsec receives the detection results and other device and app integrity signals, the device model, and anonymous app-instance and device identifiers; Talsec's server also derives an approximate location (country, region and city) and the network operator from the IP address the reports are sent from. None of this is linked to your KIVO account. Under Talsec's policy these records are kept for 12 months. Besides producing security reports for us, Talsec also uses them for its own purposes, such as improving its products and preparing security reports and articles, so unless a written agreement with Talsec says otherwise, we treat this data as shared with Talsec. When a risk is detected, the app restricts sensitive actions rather than refusing to run.
9. Push notifications
Incoming-transfer notifications for your wallet are passed by Expo's push service to Apple and Google. Their text is fixed ("You have a new incoming transfer") and contains no amount, address or transaction hash.
10. Profile photo and display name
Both are optional. Once published, your profile photo is visible to all KIVO users. Your display name is visible too.
Each photo you upload goes to a private upload area. KIVO's server checks only that it is in your own upload path, is a JPEG and is within the size limit, then publishes it right away. Profile photos have no automated or AI review, nobody checks their content before they are published, and they are not sent to OpenAI, so they need no separate consent.
The upload copy is deleted right after publishing; anything left behind, such as an abandoned upload, is purged by a nightly job, so at most about 48 hours; it is also deleted when you delete your account (see section 13).
Published photos are stored with Supabase in Singapore, in a publicly readable storage area: anyone who has a photo's link can open it.
When you replace or remove a photo, the old one is normally deleted. All your photos and your display name are deleted when you delete your account.
The community guidelines in section 8 of the Terms also cover profile photos and display names. You can report another user, and our operators can remove a reported photo.
10A. Public posts
KIVO has a public feed. After you set a username, accept the terms, agree to AI moderation and confirm you are 18 or older, you can publish posts with text and up to 4 images, like posts, comment, and follow other users.
Who can see them
Posts and comments are public inside KIVO: every KIVO user who has passed the app's checks (username, terms, AI moderation consent, age and region) can see them, not only your followers. Like and comment counts, your post count and your follower and following counts are visible too, and other users can open your follower and following lists. Friends follow each other automatically and every account automatically follows KIVO's official accounts, so your friends can appear in those lists. Other users can save or screenshot what you publish, and we cannot recall what they have saved.
If you block someone, or they block you, neither of you can see the other's posts, comments or notifications, and any follow between you ends. Posts and comments from a disabled account are no longer shown to others. A post or comment hidden by moderation stays visible only to its author. Our operators can see all posts and comments, including hidden ones.
The timeline shows posts from people you follow and your own. The Discover page shows posts we feature first, then other recent posts ranked by likes, comments and age. Neither is personalized.
Images and links
Before upload, your device re-encodes images as JPEG, which removes location and other EXIF data. Images are stored with Supabase in Singapore in a private storage area, and the app loads them through signed links valid for up to 24 hours: anyone who has such a link can open the image until the link expires, even if the post has since been hidden. Links in posts open in the built-in browser after a check against the phishing list (see section 5). Posts have no link preview cards.
Review
Posts and comments are published first and reviewed afterwards. Before publishing, text goes through our word filter: abuse and threats are blocked, and so are invite codes and rebate or referral promotions; scam phrases stay visible but are left out of the Discover page and go to human review. After publishing, the text of posts and comments and links to the images in posts are sent to OpenAI (United States) for automated moderation (see section 4). Content it rates as high risk is hidden automatically; other content it flags stays visible. Both go to human review. Image review covers sexual, self-harm and violence content, not everything.
Deleting and retention
You can delete your posts and comments at any time, and the author of a post can delete comments on it. Deleting a post also deletes its comments and likes. Deleted content is removed right away and its images are purged by a nightly job. Images you uploaded but never published are purged by a nightly job once they are a day old, so at most about 48 hours. In-app notifications (likes, comments and follows; a comment notification includes up to the first 80 characters of the comment) are kept for 90 days.
When you delete your account, your posts, comments, likes, follows and notifications are deleted, and your images are purged by a nightly job.
Copies saved with a report
When you report a post or comment, KIVO's servers save a copy of it: the author, the post or comment ID, the time, the text and the paths of its images. A copy is saved only if you can see the content; the report goes through either way. Only KIVO's servers and operators can read these copies; neither you nor the author can, and they are not sent to OpenAI.
A copy stays with its moderation record and is deleted 12 months after the report is handled (see section 13), even if the author has deleted the post or comment. Records that have not been handled are not deleted. The images a copy refers to are kept while it exists, so a reported image can stay in our storage after the post is deleted.
When the reporter deletes their account, the link to the reporter is removed. When the author deletes their account, the content is removed and the copy is de-identified. Exception: if the report is in the illegal-content category, or our operators have placed the copy on hold, it is not removed when the author deletes their account and is kept until 12 months after the report is handled. If our operators lift the hold, for example because the report was not upheld, the content is removed at that point. A report in the illegal-content category also raises an internal alert.
11. Service providers that process data for us
- Supabase (Singapore): account and app database, chat messages and attachments, public posts and their images, file storage, server functions.
- OpenAI (United States): automated moderation of community room and public post text and images (after explicit consent).
- GoPlus Security (provider's global infrastructure): risk checks on recipient addresses and on websites you connect your wallet to.
- Alchemy (United States): EVM balances, history, transaction simulation and broadcast (through KIVO's server).
- Reown (WalletConnect) (provider's global infrastructure): encrypted relay for WalletConnect connections and external-wallet sign-in.
- Expo (United States): delivery of wallet notifications to Apple and Google push services.
- Apple Push Notification service and Firebase Cloud Messaging (provider's global infrastructure): delivery of notifications to your device.
- Sentry (United States): crash and error reports (IP addresses not stored).
- PostHog (United States): anonymous usage analytics from first launch (client IP discarded).
- Talsec (freeRASP) (European Union): detection of rooted, jailbroken, tampered or hooked devices.
- Fly.io (Singapore): hosting of KIVO's background worker (notifications, moderation, list updates).
- Cloudflare (provider's global infrastructure): hosting and DNS of the app.kivosocial.ai website and forwarding of email sent to support@ and security@kivosocial.ai.
- [to fill: provider of the mailbox that receives forwarded email] (provider's global infrastructure): the mailbox that receives email forwarded from support@kivosocial.ai (support requests and deletion requests sent by email).
12. Cross-border processing
Your data is processed in Singapore, the United States, the European Union and other places where the providers above operate. We give providers only the data they need for the purposes above and require them by contract to protect it.
13. Retention
| Data | Kept for |
|---|---|
| Account data, linked addresses, push tokens, consent records | until you delete your account |
| Chat messages and attachments | until you delete the message or your account (direct messages are deleted for both sides); for copies saved with a report, see the next row |
| Copies of reported messages and their attachments | 12 months after the report is handled, even if the sender has deleted the messages. When the sender deletes their account, the content is removed and the records are de-identified; when the reporter deletes theirs, the link to the reporter is removed. Exception: if the report is in the illegal-content category, or we confirm the content is illegal, the copies are not removed when the sender deletes their account, and are kept until 12 months after the report is handled so that we can report to law enforcement as the law requires; if such a report is not upheld, this exception ends when it is closed |
| Profile photo and display name | until you replace or remove them or delete your account (when you replace or remove a photo, the old one is normally deleted) |
| Photos in the private upload area | deleted right after publishing; anything left behind, such as an abandoned upload, is purged by a nightly job, so at most about 48 hours; also deleted when you delete your account |
| Report and moderation records | 12 months after they are handled; when you delete your account, the content is removed and the records are de-identified |
| Region-denial records | 24 months; when you delete your account, the link to the account is removed |
| App review window logs | 180 days |
| Link preview cache | 48 hours |
| Crash reports | up to 90 days |
| Usage analytics | up to 12 months |
| Database backups | up to 7 days |
| Emails about support and deletion requests | up to 12 months after the request is handled |
| app.kivosocial.ai website visitor request data | we do not keep access logs ourselves; Cloudflare (hosting and CDN) processes request data, including IP addresses, as our processor under its own policies, and its dashboard keeps sampled request records for up to 31 days |
14. Your rights
You can ask to access, correct or delete your personal data (for example under Hong Kong's Personal Data (Privacy) Ordinance or Malaysia's Personal Data Protection Act). You can delete your account directly in the app; send any other request to support@kivosocial.ai and we will reply within the time the law requires.
15. Children
KIVO is only for people aged 18 and over. If we learn that an account belongs to someone under 18, we delete it.
16. Security
All data is encrypted in transit; every database table has access controls; KIVO's servers never receive recovery phrases, private keys or wallet backups.
17. Sources and attribution
This product includes GeoLite Data created by MaxMind, available from https://www.maxmind.com. (MaxMind)
18. Changes
We may update this policy and will notify you in the app of material changes.