Koti

Privacy Policy

Version 1.4 · In effect since 2 November 2026 (section 6: names you give other people) · Version 1.3 in effect since 2 November 2026 (sections 5, 7, 9, 14, 15 and 16: signing in with Google or Apple, deleting for yourself, forwarding, read ticks, and what a report keeps) · Version 1.2 in effect since 23 October 2026 (sections 5, 6, 8 and 15: everyday usage bookkeeping, a server's activity for its owner, and what a call leaves in your chat), revised 24 October 2026 (sections 5 and 18: the minimum age is 16) · Version 1.1 in effect since 10 October 2026 (sections 5 and 6: open servers and Discover) · Version 1.0 in effect since 8 September 2026, revised 20 September 2026 (writing to the operator, and what a closed report is answered with) and 9 October 2026 (sections 3, 4, 7 and 11 to 15: what a notification carries and which services deliver it, link previews, update checks, what a crash report carries, and the full list of recipients)

Protecting your personal data matters to us. Koti is built so that as little as possible about you exists, and so that what exists stays on our own server in the European Union. Apart from our hosting provider, outside companies receive data from us for three jobs only: Resend sends our emails, Google and Apple deliver notifications to phones, and Google and Apple confirm who you are if you choose to sign in with them. Section 14 lists every recipient. Crash reports, which are sent only if you agree, go to our own server. We set no tracking cookies, we use no outside analytics or advertising services, and we do not sell data. This page says what is stored, who can see it, how long it stays and how you get rid of it. The page "What Koti can see" explains the encryption in plain words.

1. Controller

The person responsible for data processing on Koti:

Maksim Nikolaev
Am Frauenberg 20
99734 Nordhausen, Germany
Email: support@koti.one

2. Principles and legal bases

We process personal data only as far as necessary to provide a working service. The main legal bases are Art. 6(1)(b) GDPR (performance of the user agreement), Art. 6(1)(f) GDPR (our legitimate interest, for example in the security and stability of the service) and Art. 6(1)(a) GDPR (your consent, for example for crash reports).

3. Hosting and connection data

When the app or the browser talks to our server, technically necessary connection data – your IP address, the time of access, the requested resource, the status code and the user agent – is processed to deliver the service and keep it stable and secure (Art. 6(1)(f) GDPR). This data appears in the logs of the server's edge proxy for a short time. The desktop app regularly asks our server whether a newer version exists and downloads updates from it; these requests carry no account information.

Hosting, the database and the file storage run on servers of netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany, exclusively within the European Union. A data processing agreement under Art. 28 GDPR is in place.

4. Cookies and local storage

The browser app sets exactly one cookie: a sign-in cookie that keeps you signed in between visits. It is required for the service to work (§ 25(2) TDDDG) and needs no consent. It also keeps a small random identifier on your device so that the sessions of two browsers can be told apart in your sessions list, and a few choices that matter only on that device: your accent colour, the emoji you used recently, the link previews you hid and the notices you dismissed. The desktop and phone apps keep your sign-in on the device in the same way. We set no third-party tracking, advertising or analytics cookies.

5. Your account

Using Koti requires an account. For it we process your username, a password that we store only in a form we cannot read back, and, if you add one, your email address, which we use to confirm the address, to reset your password and to warn you about a suspicious sign-in. Creating an account records that you accepted the Terms and confirmed being at least 16, together with the time. You may add a display name, a short description and a picture; these are voluntary and shown to the people you share a server, a group or a friendship with – in an open server, that is anyone who joins it. The legal basis is Art. 6(1)(b) GDPR.

You can sign in with Google or Apple instead of a password. That company then confirms to us who you are and sends us an identifier for your account with it, your email address (with Apple, possibly a relay address it made for you), whether it verified that address and, if you share it, your name. We keep the identifier and the address to recognise you and, with Apple, an encrypted token that lets us end Koti's access when you delete your account. The address can become your Koti email address and the name a suggested display name, which you can change. These companies learn that you signed in to Koti, and nothing of what you do here. Their own privacy policies apply to the sign-in itself. You can remove a sign-in method in Settings as long as another way in remains. The legal basis is Art. 6(1)(b) GDPR.

Using Koti leaves a little bookkeeping behind, as with any app: on the days you use it, the server notes that you were there, whether you were active, which apps you used and in which of your servers, and which app version each of your sessions runs. It holds nothing of what you read or wrote, and not whom you talked to. Our dashboards show it as totals across everyone; you can see your own under Your activity. The legal basis is our legitimate interest in keeping Koti running well (Art. 6(1)(f) GDPR).

6. Servers, groups and friends

To provide the service we process the relationships you create: which servers and groups you belong to, who your friends are, and the requests between you. The members of a server see each other's names, pictures, roles and whether they are online; the members of a group see each other; your friends see whether you are online and the status you chose. Nothing about you is public, and there is no directory of users.

You can give another person a name of your own. Only you see it, and they are not told. We keep it with your account so it shows on all your devices, include it in your data export, and delete it when you remove it or delete your account.

If you own a server, you can see how it is doing: how many members joined, left and were around each day, how many messages each channel got, and how much time was spent in its voice channels and screen shares.

A server's owner may open it, so that anyone with its lasting link can join, and may have it listed in Discover, the directory of open servers in the apps. A listing shows the server's name, picture, description, topics and number of members – never who the members are. Joining an open server makes you a member like any other: its members see your name, picture and roles and whether you are online, and may write to you. A call between two people still needs them to be friends, and whom you are in a call with is never shown to anyone outside that call.

7. Messages and files

Messages and files are stored on our server in the EU for delivery. Transmission is encrypted, and messages and files are additionally encrypted on the server. This is server-side encryption, not end-to-end encryption: the server holds the keys, so it can process the content where necessary for delivery, for search, for your data export, and for moderation when something is reported. Pictures you upload have their hidden metadata – location, device, editing history – removed on the way in; the app marks the few file types where that is not possible.

When a message contains a link, our server opens the first link once to show a preview of the page, and keeps the preview and a copy of the page's picture with the message, encrypted like the message itself. The website sees a request from our server, not from you or the people you write to, and the person who sent the message can remove the preview.

A message disappears when you or a moderator delete it, or when a disappearing-messages timer set for that conversation runs out. You can also delete a message or a whole chat for yourself alone: it leaves your view and stays for the others. Deleting a chat for both people removes its messages for both.

If someone forwards your message, a copy appears in the chat they chose, with your name on it. Deleting your original does not delete that copy; the person who forwarded it can. Deleting your account removes your name from it and the files you uploaded.

In direct messages and groups, the people you write with can see how far you have read, as two ticks on their messages. You can turn this off in your privacy settings; you then no longer see theirs either. The legal basis is Art. 6(1)(b) GDPR.

8. Calls

Voice, screen sharing and the camera are encrypted by the sender with a key that exists only for that call and changes whenever someone joins or leaves. They travel either directly between the participants or through our relay server. The relay only forwards what it receives and cannot listen in. What you say and show in a call – voice, screen sharing and camera alike – is encrypted and never recorded or stored. A call with a friend or in a group leaves a record in your chat – who called, and how long you talked – just as you see it in the app, stored encrypted like every other message.

Whether the other participants learn your IP address depends on the route. A call with a friend is connected directly, so the two of you see each other's public addresses; a friendship is made and withdrawn by both people, which is why it is what we treat as permission for this. Everyone who is not a friend goes through the relay, and sees the relay's address rather than yours. You can send a single friend through the relay anyway, or hide your address from everyone, from the app's settings. The relay sees the addresses of everyone it forwards for.

9. Reporting, moderation and blocking

To keep Koti safe, a reporting function exists. If you report a message or a person, the reported content is made available to us for review, together with your reason. The basis is our legitimate interest in a safe service free of abuse (Art. 6(1)(f) GDPR). Violations may lead to the removal of content and the suspension of the account responsible. You can block anyone at any time; a blocked person can no longer reach you, and we keep the list of people you blocked for as long as you keep it.

When a message is reported, we keep a copy of it and of its files for the review, even if it is deleted afterwards by its sender or anyone else, or its sender deletes their account. The copy is deleted 90 days after the report is closed. A report that is still open has no fixed end, because we need the copy until it is decided.

When a report is closed, we tell the person who filed it what came of it, and, where content was removed or an account suspended, we tell the person concerned the reason. Those messages arrive in the conversation with the Koti account, or by email where the account can no longer be used.

10. Writing to the operator

Two ways to reach us exist, and both are read by the operator personally. "Message Koti" in the app opens an ordinary conversation with the service account; it is stored like any other conversation, and the operator reads and answers it. The contact form on the support page needs no account: it stores the email address you give, the topic you pick and your message, encrypted, so that an answer can be sent to that address. The basis is Art. 6(1)(b) GDPR where it concerns your use of Koti, and Art. 6(1)(f) GDPR otherwise. Nothing you write there is used for anything else, and nothing is passed on.

11. Push notifications (Google and Apple)

To notify your phone about a message, a mention, a friend request, a call or a screen share while the app is not open, our server sends a notification through Google Firebase Cloud Messaging. On an iPhone, Firebase passes the notification on to the Apple Push Notification service, and an incoming call rings through Apple's service directly, without Google.

A notification carries the name of the sender or caller (their display name, or else their username), for a message the beginning of its text (up to 240 characters; for a message without text, whether it is a photo, a video, an audio file or another file), the name of the channel where there is one, and the internal identifiers the app needs to open the right conversation and to show the number of unread messages. The sender's picture is not part of the notification; the phone downloads it from our server. Google, and for iPhones also Apple, therefore process this content and the phone's notification token while they deliver the notification.

To receive notifications, the app registers the phone with Google's Firebase service (an iPhone also with Apple) and sends us the token it receives, together with the platform, the app version and the language of the phone. We use these only to address notifications. In the app's notification settings you choose which events notify you, and you can mute a conversation or a server. Nothing is sent for what you switched off or muted, for a conversation you have open, or, except for friend requests, while your status is "Do not disturb". Silent notifications that only update the unread count or stop a ring carry no names and no text. If you do not allow notifications on the phone, no token is registered. The legal basis is Art. 6(1)(b) GDPR. Safeguards for the transfer are described in section 14.

12. Transactional email (Resend)

To send emails we use Resend (Resend, Inc., USA): address confirmation, password reset and security notices, the notice that your data export is ready, the confirmation that your account was deleted, our answer to a message you left on the contact form, and the outcome of a report where your account can no longer be used. We transmit the recipient email address and the content of the message. The notices that tell the operator about a new report (with the username of the person who filed it and the reason) or about a new message on the contact form (with the email address given and the topic) are sent through Resend as well. The legal basis is Art. 6(1)(b) or (f) GDPR. Safeguards for the US transfer are described in section 14.

13. Error diagnostics

For stability and debugging we run a self-hosted error tracker (GlitchTip) on our own server in the EU. Crash reports are sent only if you agree when the app asks, and you can change that answer at any time in the app's settings (Art. 6(1)(a) GDPR). A report carries the error, where in the app it happened and the steps just before it, the app version, the operating system and the type of device, and on the desktop the graphics card and its driver. Before a report leaves your device, your account is replaced by a random identifier for the installation, the device's name, request details and sign-in tokens are removed, log lines from conversations are left out, and on the desktop your home folder is cut from file paths. No data is passed to third parties.

14. Recipients, processors and transfers to third countries

Beyond this we disclose personal data only where you have consented, where it is needed to perform the agreement, or where the law requires it. Where data is transferred to providers based or processing in the USA, we rely on appropriate safeguards under Art. 46 GDPR, in particular the EU Commission's standard contractual clauses and, where the provider is certified, the EU-US Data Privacy Framework.

If you install Koti from Apple's App Store or Google Play, Apple or Google process the download and your store account under their own terms and privacy policies.

15. Retention

We keep personal data only as long as needed for the stated purposes or while your account exists.

After account deletion the associated data is deleted at once, unless statutory retention obligations apply. Data in backups is overwritten in the course of the regular backup cycle.

16. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You may withdraw any consent at any time with effect for the future.

Access, portability and erasure you can exercise yourself. Settings → Your data on the desktop, You → Your data on the phone, or the settings page in the browser build a copy of everything your account holds (one export a day, kept for 7 days) and delete the account, and the account-deletion page does the same without the app. Deletion is immediate and removes your messages, files, sessions and devices. A copy kept for a report stays until that report's 90 days are over (section 9). When you leave a server, you can also erase everything you wrote there. For anything else, contact support@koti.one.

17. Right to complain

You have the right to lodge a complaint with a data protection authority. The authority responsible for us is the Thüringer Landesbeauftragte für den Datenschutz und die Informationsfreiheit (TLfDI), Häßlerstraße 8, 99096 Erfurt, Germany.

18. Minors

Koti is not for children. Use requires that you are at least 16 years old, which you confirm at registration; we do not ask for identification. An account reported as belonging to someone under 16 is reviewed and closed where the report holds.

19. Data security

Transmission is encrypted throughout. Passwords are stored only in a form that cannot be read back. Messages and files are encrypted on the server, and calls are encrypted by the participants with a key the relay does not have. You can see and end every session of your account from the app.

20. Changes to this privacy policy

We update this privacy policy when changes to the service or the law require it. The version published here at the relevant time applies (see the version and dates above).