Privacy Policy

Last updated: 29 September 2026

Koishii is a small app for two people who care for each other's bear. This policy explains what we collect, why, and what you can do about it.

Who we are

Koishii is published by Milan Romanczyk, an individual based in France, who is the data controller for the information described here. Contact: hello@koishii.app.

What we collect

• Your account. Koishii doesn't ask for a phone number or password. When you open the app we create an anonymous account identified by a random ID, plus the session tokens that keep you signed in. If you choose to save your account, we also keep your email address, used only to send you sign-in codes.
• Your contact email (optional). If you give it when your trial starts or in My bear, we use it only for important messages about your account: your trial ending, and a warning before photos are removed. No newsletters. Only you can see it, and you can change or remove it at any time.
• What you type. The display name you choose, your bear's name and look, notes you add to photos, and your answers to the daily question.
• Photos you send. Photos you choose or take for your partner. We re-encode every photo before upload, which removes its metadata, including location.
• Your activity in the app. Care actions, levels, experience points and reveal progress, with their timestamps.
• Your approximate location (optional). Only if you turn on distance: your phone's position is rounded to about 10 km before it's stored, nobody (not even you) can read it back, and your partner only ever sees a rounded distance between you. Turning it off deletes it.
• Notifications. If you allow notifications, we keep your device's push token to send you reminders and your partner's news. It's deleted when you turn them off, sign out or delete your account.
• Partner codes. If you enter a creator's partner code, we record that your couple used it and whether you went on to subscribe, so the creator can be credited. Creators only ever see totals, never who you are.
• Reports. If you report a photo, we keep the reason you chose, any details you add, and which photo and people it concerns.
• Technical data. Crash reports (through Sentry) and a small set of product events such as "care action completed" (through PostHog), linked only to your random account ID. We don't record your screen or your sessions, and we don't use advertising identifiers.

We don't collect your contacts, your precise location, or anything from other apps.

Why we use it

• To run Koishii (performing our contract with you): pairing you with your partner, storing and progressively revealing what you send each other, and showing your bears and widget.
• To keep it working and improve it (our legitimate interest): fixing crashes and understanding, in aggregate, which parts of the app are used.
• To keep people safe (our legitimate interest and legal obligations): handling reports and removing content that breaks our Terms.

We never sell your data and we don't show ads.

Who can see it

• Your partner sees what you send them, progressively as they care for your bear, and sees your display name, your bear and your daily answers once they've answered too.
• Our service providers, only to run Koishii for us, under data processing agreements:
  • Supabase (database, storage and sign-in), hosted in the United States (Virginia);
  • Sentry (crash reports), hosted in the EU;
  • PostHog (product analytics), hosted in the EU;
  • Resend (email delivery, only if you gave a contact email), hosted in the United States;
  • Apple (app distribution, in-app purchases, push notifications, and the home-screen widget on your device). Apple processes your payment; we only receive whether your couple has an active subscription or shields, never your payment details.
• Authorities, only if the law requires it.

If you're in the European Union, some of your data is processed outside it, notably by Supabase and Resend in the United States. Those transfers are covered by the European Commission's Standard Contractual Clauses included in our providers' data processing agreements.

How long we keep it

• Your account and everything in it are kept while you use Koishii.
• Deleting your account (My bear → Delete account) permanently deletes your account, your pairing, both bears, every photo and note you exchanged, and your daily answers, straight away.
• Ending a pairing (My bear → End pairing) pauses it: neither of you can see the other's bear or photos any more, but nothing is deleted, and pairing again with the same person brings everything back. Delete your account if you want it gone.
• Photos after Koishii Plus ends. When a free trial or a subscription ends without being renewed, the photos you exchanged are kept for 30 days, with a countdown in the app and reminders, then deleted. Everything else (bears, levels, notes) stays.
• Photos you delete ("Delete for both of us") are deleted straight away.
• Reports are kept as long as needed to handle them, and no longer than 12 months.
• Crash reports and analytics events are kept according to our providers' retention settings, and no longer than 24 months.

Your rights

Under the GDPR you can ask to access, correct, delete or export your data, and object to or restrict how we use it. You can delete everything yourself from the app at any time; for anything else, write to hello@koishii.app. If you think we've mishandled your data, you can complain to the CNIL (cnil.fr) or your local data protection authority.

Security

Data travels encrypted (HTTPS). Every table is protected so that only the two people in a pairing can read what's theirs, photos are only served through short-lived links, and repeated wrong invite or partner codes are blocked. No system is perfectly secure, but we work to keep yours safe.

Children

Koishii is not intended for anyone under 16, and we don't knowingly collect data from them.

Changes

If we change this policy, we'll update the date above and, for significant changes, let you know in the app.