What Koti can see

16 September 2026 · Revised 9 October 2026 (what leaves the server)

This page says, in plain words, what our server can and cannot read. The Privacy Policy is the formal version; this one is meant to be read.

In short

Koti is not end-to-end encrypted. Your messages, files and calls are encrypted, but the Koti server holds the keys, so it is technically able to read them. Most chat apps work this way. We don't read your messages; the only time anyone looks at one is when it has been reported.

Messages and files

Messages and files are encrypted on our server. Each conversation has its own key, and those keys are locked under a master key that is kept outside the database. The server opens a message only to deliver it to the members of that conversation, to build your data export, or when a report puts it in front of us. Deleting a message deletes it at once; deleting your account deletes everything you wrote and uploaded.

Files have their hidden metadata removed on the way in: pictures are re-encoded, so location, device and editing tags are gone; the metadata blocks of GIF, MP4, MOV and WebM files are blanked. PDFs, archives, AVIF pictures and very large videos are stored as received, and the app marks them. Every file is checked against the type it claims to be.

Calls

Voice, screen and camera are encrypted by the sender with a key that exists only for that call and changes whenever someone joins or leaves. The relay only forwards the encrypted packets to the other participants and cannot listen in. Calls are never recorded.

Who learns your address

A call with a friend connects straight to them, which is faster, and each of you then sees the address the other's connection uses. Everyone else goes through our server, which sees the addresses and forwards the packets without being able to open them. You can send one friend through the server anyway from their menu in a call, and everyone through it with "Hide my network address from everyone" (Settings → Security on the desktop, You → Voice on the phone).

What leaves the server

• Notifications to phones through Google's Firebase and, for iPhones, Apple: the sender's name, the beginning of the message text and the channel's name. The phone fetches the sender's picture from our server. An incoming call on an iPhone rings through Apple alone.
• Email through Resend: confirmation links, password resets, a notice when a sign-in looks suspicious, and notices about your data export, your account's deletion, a report and an answer to the contact form.
• Link previews: our server opens the first link in a message once, so the website sees our server, not you.
• Crash reports, only if you said yes, under a random id, with sign-in tokens and log lines from conversations removed and your home folder cut from file paths.

No outside analytics, no advertising identifiers, no data sales.

What we can see

Usernames, email addresses and the bookkeeping needed to run the service: who is in which server and group, who calls whom and when. Messages, files and calls stay encrypted; nobody reads them unless a report is filed. One conversation is different by design: what you write to the Koti account, and what you leave on the contact form, is meant for the operator and is read by them. Passwords are stored in a form that cannot be read back. If you turn on two-step verification, the key your authenticator app shares with us is stored encrypted.

How to leave

Settings on the desktop, "You" on the phone and the settings page in the browser end sessions, export your data and delete the account; the account-deletion page does the same without the app. Leaving a server offers to erase what you wrote there.