Privacy Policy
Version 1.1 · Effective 18 October 2026
Kairo OS stores the plans, habits and goals you write, plus the account details Google gives us when you sign in. Our public pages use Google Analytics, only if you allow it; nothing inside the app is ever sent to it. There is no advertising, and we do not sell your data. You can delete everything yourself from Settings, at any time.
1. Who we are
VEKHAT Ltd. (Sofia, Triaditsa District, No. 255, 1404, Bulgaria) is the data controller for the personal data described here — meaning we decide why and how it is processed. Kairo OS is the planning application at https://kairo-hq.com.
For anything in this policy, including requests about your data, contact us by email at tanchev@mywebcore.com or by telephone on +359 888 868 617.
2. What we collect
Account and identity
Signing in uses Google only — Kairo OS never sees or stores a password. From your Google account we receive your email address, name, profile picture and a Google account identifier.
Your profile
A display name, an optional profile picture, your timezone, the hours your day starts and ends, and your default task length. The profile picture you upload is stored inside our database as part of your profile record.
What you create — the main content
- Tasks: title, notes, checklist items, tags, priority, status, estimated duration, planned date, scheduled start and end, and any recurrence.
- Habits: title, icon, colour, grouping, schedule, daily target and unit.
- Habit logs: the dates you completed a habit and how many times.
- Goals: title, description, target, unit, progress and due date.
- Lists: name, colour and ordering.
Please note what this means. These are free-text fields, so they contain whatever you type. People routinely track things here that reveal health, beliefs or other sensitive matters — a medication reminder, a therapy appointment, a recovery streak. Under GDPR that is special category data (Art. 9). We do not ask for it, do not analyse it, and cannot tell it apart from any other task. If you would rather it did not exist in our database, please do not record it here.
Google Calendar (only if you connect it)
Connecting Google Calendar is optional and off by default. If you connect it, we request access to your calendar, your email address and your basic profile so we can show your existing events alongside your plan and write your scheduled tasks into Google Calendar. We store the identifier of any event we create, so we can keep it in sync. You can disconnect at any time in Settings, and you can additionally revoke access from your Google account security settings.
AI assistants (only if you connect one)
Kairo OS can expose your tasks, habits, goals and lists to an external AI assistant through an authorised connection. This is off by default and requires you to explicitly authorise it. While connected, that assistant can read and modify this content on your behalf, and the provider you chose processes it under their privacy policy, not ours. Disconnecting it from the assistant's side ends that access.
Waitlist
If you submit your email on our home page to hear about pricing, we store that email address and the fact it came from the landing page. This is separate from any account.
What we do not do
The app you sign in to contains no analytics, advertising, profiling or third-party tracking software. Your plans, habits, goals and calendar are never sent to an analytics provider. We do not sell or share your personal data for marketing, and we do not use your content to train AI models. Our hosting providers keep standard technical logs (such as IP addresses) as a normal part of serving and securing the site.
3. Why we process it, and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running your account and showing you your own plans, habits and goals | Performance of a contract — Art. 6(1)(b) |
| Connecting Google Calendar | Consent — Art. 6(1)(a), given when you connect it |
| Connecting an external AI assistant | Consent — Art. 6(1)(a), given when you authorise it |
| Emailing you about pricing if you joined the waitlist while it was open | Consent — Art. 6(1)(a), withdrawable at any time |
| Counting visits to the public pages with Google Analytics | Consent — Art. 6(1)(a), given in the banner and withdrawable at any time |
| Keeping the service secure and preventing abuse | Legitimate interests — Art. 6(1)(f) |
Where we rely on consent, you can withdraw it at any time; that does not affect processing already carried out.
4. Who else processes your data
We do not sell your data. We do rely on service providers who process it on our instructions to make the product work:
| Provider | What they do for us |
|---|---|
| Lovable (Lovable Cloud) | Application hosting and backend platform. |
| Supabase | Database, authentication and session handling. |
| Cloudflare | Edge hosting and delivery of the application. |
| Sign-in (Google OAuth). If you connect Google Calendar, also reading your events and writing scheduled tasks. | |
| Lovable Connector Gateway | Brokers and stores the Google Calendar authorisation on your behalf, so the app never holds your Google tokens directly. |
| Google Analytics | Counting visits to the public pages, only for visitors who allow it. Never used inside the app. |
Some of these providers operate outside the European Economic Area. Where data is transferred outside the EEA, it is protected by an approved transfer mechanism such as the European Commission's Standard Contractual Clauses. We may also disclose data if legally required to do so.
5. Cookies and local storage
The app itself uses no cookies and no advertising or analytics trackers. We store a small amount of information in your browser's local storage, all of it strictly functional:
- Your session — so you stay signed in. Removing it signs you out.
- Your preferences — such as your chosen plan view and whether quick capture is on.
- A dismissal flag — so the Google Calendar prompt stays hidden once you close it.
Because this storage is strictly necessary to provide a service you actively asked for, and none of it tracks you across sites, we do not show a consent banner. Clearing your browser storage removes all of it and signs you out.
Google Analytics on the public pages
The pages anyone can open without an account — the home page, the blog, this policy, the terms and the sign-in page — can use Google Analytics to count visits and see how people find Kairo OS. It runs only if you press Allow in the banner those pages show. Until then, and after No thanks, nothing is loaded from Google and no cookie is set.
If you allow it, Google sets the cookies _ga and _ga_<id> (kept for up to two years) and receives the address of the public page, the referring site, your browser and device type, and an approximate location derived from your IP address, which Google does not store. Google signals and ad personalisation are switched off. Pages behind sign-in never send anything to Google Analytics, whatever you chose.
You can change your mind at any time: . Saying no removes the Google Analytics cookies.
6. How long we keep it
Your account content is kept until you delete it. Delete an individual task, habit, goal or list and it is removed. Delete your account and all of it is erased immediately — profile, tasks, habits, habit logs, goals, lists and any stored calendar connection are removed together, by design, in one operation.
One exception, stated plainly: a waitlist email, if you submitted one while that form was open, is stored separately from accounts and is not removed by deleting your account. Email us and we will delete it.
7. Deleting your data
To delete everything: open Settings, scroll to Delete account, and confirm. This is immediate and cannot be undone.
To disconnect Google Calendar without deleting your account: open Settings and choose Disconnect. Events already written to your Google Calendar stay there and are yours to remove in Google.
If you cannot sign in, or want a waitlist email you submitted removed, contact tanchev@mywebcore.com from the address in question and we will handle it.
8. Your rights
If the GDPR applies to you, you have the right to access your data, correct it, erase it, restrict or object to how we use it, receive it in a portable format, and withdraw any consent. You also have the right not to be subject to decisions based solely on automated processing — we do not carry out any such decision-making.
Write to tanchev@mywebcore.com and we will respond within one month, as GDPR requires. Most of these you can exercise yourself: your data is visible in the app, editable in the app, and deletable from Settings.
If you think we have handled your data improperly, you may complain to your local data protection authority. In Bulgaria this is the Commission for Personal Data Protection (Комисия за защита на личните данни), Sofia — cpdp.bg. You may also complain to the authority where you live or work.
9. Security
Access is protected by Google sign-in, traffic is encrypted in transit, and the database enforces per-user access rules so one account cannot read another's rows. Your Google Calendar authorisation is held by a dedicated connector service rather than in our own database. No system is perfectly secure, and we cannot guarantee absolute security.
10. Children
Kairo OS is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We will update this page when our practices change, and revise the version and effective date at the top. If a change materially affects your rights, we will tell existing users before it takes effect rather than changing it quietly.
See also our Terms of Service.