Kotolog
中文日本語English
Join the beta

Privacy Policy

What Kotolog stores about you, what it is used for, who else handles it, and what you can do about it.

Updated November 13, 2026

What this policy covers

This policy covers Kotolog's iPhone app, web app, desktop app, command line tool and MCP adapter, and this website. Kotolog is operated by Zhou Lei (周磊), an individual operating in Japan under the Minerei brand ("we").

The operator’s actual contact address is available by a valid request to the email below and will be provided promptly as required by law; a private home address is not published here. The operator receives and handles contact email using Gmail (Google). The web app and TestFlight share the existing beta accounts and data.

Kotolog is in public beta. Features change, and this policy will change with them. When it changes in a way that matters, we will tell you beforehand in the app or by email.

We show no ads, use no analytics tools, and do not sell your data.

What we store

  • Account: your email address, the name you chose, your time zone and avatar. Passwords are kept only as a hash that cannot be reversed. If you sign in with Apple or Google, we keep the account identifier, email address and name they give us.
  • What you write: tasks, events, logs, Spaces, whiteboards and routines, the photos and files you upload, and your conversations with Koto-chan, including what she read or looked up in order to answer and the proposals she made.
  • Sign-ins and devices: a record of each sign-in (which client, the browser or app identifier, the IP address) and the device credential that saves you from signing in again and again.
  • Push: once you turn reminders on, the device's push token, its model, language, time zone and app version.
  • Accounts you connect: see "Connected accounts" below.
  • Shared Spaces: members, roles and invitations.
  • Who wrote it: every task and log records whether you, Koto-chan or an outside AI tool wrote it, and from which client.
  • Operational records: server logs hold the request path and IP address, to find faults and stop abuse. They do not hold sign-in credentials or request bodies.

What it is used for

  • To sign you in and sync your content between your devices.
  • To show pages such as Now and the calendar, and to send reminders when they are due.
  • To generate an answer when you ask Koto-chan something.
  • To prevent abuse and find faults.

Koto-chan and AI models

  • Opening a conversation sends nothing anywhere. A run starts only when you send a message, or when a routine you set up comes due.
  • A run sends these to the model provider: your message and the conversation, her character settings and your name, and what she read in order to answer. She reads the relevant Spaces, tasks, events and logs; the calendars you let her read (titles, times, places); and the whiteboard you are looking at. She reads only your personal content, not what is in shared Spaces.
  • A picture you upload is passed to a model to read the text in it.
  • The part of a routine that she does runs daily on schedule and looks up public information only.
  • Conversations are kept in your account so you can come back to them. Archived conversations are removed by cleanup jobs on a 30-day retention schedule.
  • The model provider in use is DeepSeek, reached through Cloudflare AI Gateway. The model provider may retain and process requests under its own policy; we have no specific third-party zero-retention or no-training guarantee. How a provider retains and uses what it receives is governed by its own terms. We ourselves do not use your content to train models. Application requests instruct Cloudflare AI Gateway not to log request/response bodies and to skip caching. The gateway can still keep metadata such as model, status and usage, currently in a rolling maximum of 100,000 log entries with no fixed time-based expiry. This is not a promise of zero retention by the model provider.
  • Web search: enabled, using Tavily. When it is on, what goes to the search provider is a query she writes, not your own words, though it may contain words from your question.

Connected accounts

  • Google account: read-only. We read the calendars you pick and their events (from 30 days back to 180 days ahead) and store each event's title, description, place, times and number of attendees, not the attendees' addresses. When you let Koto-chan read a calendar, event titles, times and places go to the model provider along with your question. When you disconnect, we ask Google to revoke the authorization and delete the calendars and events we stored; events and logs you already made your own stay. Our use of information received from Google APIs, and its transfer to any other app, adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use that data for advertising or general-purpose model training; processing and transfers are limited to the features you authorize.
  • GitHub: read-only. We read things such as issues and file paths in the repositories you pick. Credentials are cleared when you disconnect.
  • Calendars by address: our server fetches the calendar from the address you give.

Authorization credentials and subscription addresses are stored encrypted.

What others see in a shared Space

  • Members can see everything in the Space.
  • Members see each other's name (the part of the email address before the @ if no name was chosen), role and join date, who created, edited or completed each item, and which day each of them planned a task for.
  • Someone who holds an invitation link and is signed in sees the Space's name, who invited them, and the members' names and roles before joining.
  • For now a member cannot be removed, change role or leave a shared Space. Think before you put something in.
  • Materials, calendars, outside sources, routines and Koto-chan stay each person's own and are not shared with the Space.

Push notifications

A reminder shows the task's title, the day it is planned for and the day it is due, and the name of its Space. Notifications reach your device through Apple's push service.

Services we use

These services handle part of the data, only to do their part of the work:

  • Hosting and database: Railway (the API, background jobs and the database) and Vercel (the web app, on servers in Singapore).
  • File storage: Cloudflare R2 (avatars, the originals of attachments, and encrypted backups).
  • Email: Resend. It sends only verification and password-reset mail, and receives your email address.
  • Push: Apple.
  • App distribution and over-the-air updates: Apple TestFlight and Expo.
  • Error reporting: Sentry, in the iPhone app only. It receives crash and error information without account details, on servers in the United States.
  • AI models and web search: see "Koto-chan and AI models" above.
  • Sign-in: Apple and Google, when you choose to sign in with them.
  • Voice input: dictation on the iPhone uses the system's own speech recognition.

Where this data is stored and processed: Accounts and primary content are stored in Railway’s Singapore database; the API and background jobs also run in Singapore. The web app uses Vercel’s Singapore functions and global delivery network. Files and encrypted backups use Cloudflare R2’s distributed infrastructure; we do not promise storage in a single country. Cloudflare, DeepSeek, Tavily, Resend, Apple, Expo, Sentry and Google may process relevant data in other countries, including the United States and, under DeepSeek’s policy, China. Cross-border processing serves the features described above and is subject to provider policies and applicable law. Contact the operator for details of recipients and safeguards

The web app and this website

  • The web app uses a few cookies to keep you signed in: the session (up to 90 days), the device credential and last sign-in email that save you from signing in again, and short-lived markers used while a sign-in redirects. We set all of them ourselves, page scripts cannot read them, and they are not used for tracking.
  • The browser's local storage holds your appearance and layout choices and unfinished drafts.
  • The product introduction pages set no additional cookies. They share a domain with the web app; when you are signed in, the homepage reads the sign-in session and opens Now. There are no analytics scripts. Its fonts are loaded from Google Fonts, so your browser makes a request to Google.

How long it is kept and how it is deleted

  • For now tasks, events and logs can be archived but not deleted one by one. A Space can be archived and then deleted for good: its tasks and events are deleted with it, and its logs move to your default Space. When a shared Space is deleted for good, everything in it is deleted.
  • Notification records are kept for 30 days.
  • A session ends after 7 days unused and lasts at most 90 days. A device credential lasts at most 180 days.
  • Backups: one encrypted backup every night. Daily copies are kept for 35 days and one monthly copy for 400 days. Content deleted from the live service stays in backups until they expire.
  • During the beta we keep your data. We do not clear it to ship a new version.
  • The product has no "delete account" or "export data" screen yet. To delete your account or get your data, write to parz1zhou@gmail.com and we aim to reply within 7 days and normally act within 30 days after verifying your identity and the scope of the request. After an account is deleted, we normally remove associated personal data from the live service within that handling period. If legal obligations, security or disputes require limited retention, we explain the reason and duration. Backups are not edited item by item: residual copies expire on the 35-day daily and up-to-400-day monthly schedule. If a backup is restored, we reapply confirmed deletion requests.

Security

  • Data travels over HTTPS throughout.
  • Passwords are hashed with Argon2. Sessions and invitation links are also stored only as hashes.
  • Credentials for connected accounts and subscription addresses are encrypted with AES-256-GCM.
  • The API limits how often it can be called.
  • No system can promise complete security. If you find a problem, please write to us.

What you can do

  • See and change your content in the product.
  • Disconnect an outside account, or turn reminders off.
  • Write to us to see, correct, export or delete your data.
  • Subject to applicable law, you may request disclosure, correction, restriction or deletion, or withdraw consent where processing relies on it. We explain any limits required to protect others’ rights or meet legal obligations. Contact the operator first, or complain to Japan’s Personal Information Protection Commission (PPC) or a competent data protection authority where you live

Children

The public beta is for people aged 18 or older. We do not target anyone under 18. If you believe we have collected their personal data, contact the operator so we can verify and arrange deletion, except where retention is legally required.

Contact

parz1zhou@gmail.com