Your data.

What lives on your device#

Your logs, your chats, Kata's memory of you, the Kata log, your concerns, trackers, letters and seasons, your photos and your connection tokens: all of it is stored on your device, per account. Settings and structured logs live in local storage; larger content such as photos lives in IndexedDB. Kata's servers never store any of it in readable form.

What we hold#

• Your account basics: email, sign-in method and timestamps, and which platform and app version you use, once a day at most, with the country derived from the connection.
• App-open counts and when you were last active.
• Aggregate AI usage numbers for fair use: how many messages and voice interactions, never what was said.
• An abstract persona sketch computed on your device: an archetype word plus coarse traits. It helps us make Kata better and cannot be traced back to your content.
• Your invite state, your plan and its status, and your consent records.
• If notifications are on: your push token and the schedule they follow (categories, quiet hours, time zone, language), and for 21 days a record of which notification went out when, so nothing arrives twice.
• In the web app and the Android app: one sealed restore snapshot of your account, encrypted on your device under a key we never receive. We hold ciphertext we cannot open, and your photos are never in it. See Backup and restore and Backups on Android.
• Only if you switch them on: one yes-or-no value a day for Duo and Groups, deleted after 21 days, and for an active secure share, its sealed copy we cannot read, the recipient's email address as a salted hash, and its expiry.
• Only if you make one: the public card of a Sensei letter, which holds your archetype mark, a few counts and one line, never your name, the letter text or a health value, until you remove it.
• If you give or receive a gift: its code, length and card, the names and note written on it, how it arrives (the recipient's email or a postal address), and who claimed it and when. The names, the note and the addresses go 90 days after the gift is claimed.

Never readable on our servers: your chats, your logs, your photos, Kata's memory, your decisions. And there is no analytics profile, no ad pixel, no selling, ever.

Paying for a plan#

When you take a paid plan we keep only what running a subscription needs: your plan and its status, the billing period, the currency and country used for tax, a customer and subscription identifier, and a record of payments and refunds. We never receive or store your full card number. The payment itself is handled by the provider where you bought: Stripe on the web, Apple for App Store purchases, Google for Google Play. See What the servers do.

When you talk to Kata#

Your message, plus the minimum context needed to answer it, travels encrypted to our AI provider to generate the reply, and the Privacy Policy names who that is. Kata's servers keep no copy of it; the provider processes it to answer, does not train on it and deletes it within 30 days. Speech becomes text before it is sent, by Apple's speech recognition on iPhone, your phone's on Android or your browser's on the web, and photos are analyzed only when you send them. See How it reads your data.

What Kata knows about me#

Settings, Data opens the viewer of everything Kata knows: profile facts, tone, this week's intention, memory, concerns, the newest locked-in entries, medications, cycle and lab values, each readable and deletable by you, followed by Shared in the moment, the exact list of what rides along with a message.

Export, wipe and delete#

Settings, Data, Export my data gives you one file with everything: treat it as your backup, or use the built-in Backup and restore. Clear my data on this device, under Settings, General, Account, wipes this device and signs you out, leaving backups and other devices alone. Delete account, at the bottom of your Profile, removes your account and its operational rows from our systems, the sealed snapshot included, and wipes the device. Three things remain, each for a set time: billing records for the statutory period; the record of what you agreed to, for ten years, linked only to a one-way fingerprint of your email address and your former account ID; and, for 24 months, one-way fingerprints of your email address and your Apple or Google sign-in, used only so that the free month of Kata Plus and invite rewards go to each person once. A fingerprint cannot be turned back into your address. See yourkata.com/delete-account.