Privacy Policy
Version 2026-08-11. This is the version recorded against your account when you signed up.
This policy explains what Koti collects, why, and what you can do about it. It is written to meet Brazil's Lei Geral de Proteção de Dados (Lei nº 13.709/2018, "LGPD") and the EU/UK General Data Protection Regulation.
1. Who is responsible
The controller (controlador) of your personal data is [LEGAL ENTITY NAME], [CNPJ], of [REGISTERED ADDRESS], which operates Koti.
Our data protection officer (encarregado, Art. 41 LGPD / Art. 37 GDPR) can be reached at privacy@koti.so. That address reaches a person, and it is the right one for any question or request in this document.
2. What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Email address, display name, profile photo, which sign-in provider you used | The identity provider you chose when signing in | To create and identify your account |
| A one-way hash of a hardware identifier for your Mac | Your device, at first sign-in | To allow one free trial per machine |
| Your name for the account, marketing preference, referral code, and how you heard about Koti | You, at sign-up | To address you correctly, to honour referrals, and — only with your consent — to email you |
| Subscription status and billing history | Our payment provider | To know whether your subscription is active |
What we do not collect
Koti is a terminal. We do not collect the contents of your terminals, your files, your source code, your command history, or anything your agents produce. That material stays on your Mac. Koti's own scrollback is written to a directory on your computer and is never transmitted to us.
We never see your payment card. Card details are handled entirely by our payment provider, described in section 5.
3. Our legal basis for using it
Under Art. 7 LGPD and Art. 6 GDPR, we rely on:
- Performance of a contract (Art. 7, V LGPD; Art. 6(1)(b) GDPR) — for your account, your subscription, and providing the software you are paying for.
- Legitimate interests (Art. 7, IX LGPD; Art. 6(1)(f) GDPR) — for the hashed machine identifier, which exists to stop one person taking unlimited free trials. We considered whether this is proportionate and concluded that a one-way hash, which cannot be reversed into a device identifier and is never used for advertising or tracking, is the least intrusive way to make a free trial possible at all.
- Consent (Art. 7, I LGPD; Art. 6(1)(a) GDPR) — for marketing email, and only that. The box is unticked by default and you can withdraw at any time without affecting your account. Messages about your trial, your subscription and your billing are not marketing and are sent regardless, because they are part of the service.
- Compliance with a legal obligation (Art. 7, II LGPD; Art. 6(1)(c) GDPR) — for tax and accounting records.
4. Your rights
Art. 18 LGPD and Arts. 15–22 GDPR give you the right to confirm we are processing your data, to access it, to correct it, to anonymise, block or delete unnecessary or excessive data, to port it to another provider, to know who we have shared it with, to withdraw consent, and to object to processing based on legitimate interests.
To exercise any of these, email privacy@koti.so. We will respond within 30 days. There is no charge.
Deletion, specifically. Ask and we will delete your account and the personal data tied to it. One thing survives, and we would rather say so than let you discover it: the hashed machine identifier is kept as an anti-fraud record under the legitimate-interest basis above. It is not linked to your identity after deletion, and its only effect is that the same Mac cannot start a second free trial.
You may also complain to Brazil's ANPD (Autoridade Nacional de Proteção de Dados) or, in the EU/UK, to your local supervisory authority.
5. Who else touches your data
- Google (Firebase) — authentication, database and hosting. Acts as our processor (operador).
- Paddle — our merchant of record. Paddle is the seller of record for Koti subscriptions and an independent controller of the payment data you give it, under its own privacy policy. This is why your card details never reach us.
- Your identity provider — Google, when you sign in with it. It tells us your email, name and photo, and nothing else.
We do not sell personal data, and we do not share it for advertising.
6. International transfers
Our infrastructure runs in the United States. If you are in Brazil, this is an international transfer under Art. 33 LGPD; if you are in the EU or UK, under Chapter V GDPR. We rely on the providers above offering contractual guarantees compatible with these laws — in particular the European Commission's Standard Contractual Clauses, which Google's data processing terms incorporate.
7. How long we keep it
- Account data — while your account exists, and then deleted on request.
- Billing records — as long as tax law requires us to keep them.
- Hashed machine identifiers — indefinitely, for the reason given in section 4.
8. Children
Koti is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, write to us and we will remove it.
9. Changes
If we change this policy materially we will tell you by email and ask you to accept the new version. The version you accepted is recorded against your account, so it is always possible to tell which text you actually agreed to.
← Back