Privacy Policy

Effective November 12, 2026

This policy explains how Okairo LLC (“Kirinoto”, “we”, “us”), a Texas company, handles personal information in the Kirinoto browser extension, mobile apps and kirinoto.com (the “Service”). Questions: privacy@kirinoto.com.

1. What we collect

When you make a card

• The piece you clip: the text you select, or an image of the element or area you mark. To create that image, the extension takes a picture of the visible part of the tab at the moment you clip and immediately crops it to what you marked, on your device. The rest of the picture is thrown away and never sent to us.
• Your comment, the card's source (the page address, site and page title, which you can edit) and the date.
• On sites likely to be private, such as email, documents and banking, the page title is left out by default.

When you sign in

• From Google (or another sign-in provider): your name, email address and profile photo. We don't get your password or access to your Google data.
• What you add to your profile: username, display name, photo, bio, links, and Pro card style.
• Your settings, such as whether new cards are public and how sensitive content is shown, and the confirmation that you're 13+ (or 18+ to see sensitive content).

When you use the social features

• Who you follow, cards you like, hide or report, and accounts you block.

When you pay for Pro

• Your plan, billing dates and payment status. Card numbers are handled by our payment partner; we never see or store them.

Automatically

• Basic technical data our servers need to deliver pages and stop abuse: IP address, browser or device type and the time of a request. These logs are kept for a short time.
• A sign-in cookie or token that keeps you logged in. We don't use advertising or cross-site tracking cookies.

What the extension does not do

The extension needs permission to run on all websites so its button can appear wherever you are. It does not read, collect or send your browsing history, the contents of the pages you visit, what you type, or anything else, unless you actively make a card. Before you sign in, your cards are saved only in your browser on your device.

2. How we use it

• To create, store and show your cards, and to make share links and card pages work.
• To run your account, profile, follows and feed.
• To provide Pro, process payments and send receipts.
• To keep Kirinoto safe: handling reports, removing content that breaks our Terms, and preventing spam and abuse.
• To send messages about your account, such as security notices or changes to these policies. Optional notifications, like new followers, can be turned off in settings.
• To fix bugs and improve the Service, using information about how features are used, not the content of your private cards.

We don't sell your personal information, don't share it for targeted advertising, and don't use your private cards to train AI models.

3. Who can see your cards

• Private cards are visible only to you.
• Shared cards can be opened by anyone who has the link, along with your display name, username and photo.
• Public cards appear on your profile and in the Kirinoto feed.
• If you opt in to being featured, we may repost your cards on Kirinoto's social media with credit to you.

4. Companies that help us run Kirinoto

We share information only with service providers that process it on our behalf, under contracts that limit how they can use it:

• Cloudflare: website hosting, card image storage, security, and automatic scanning of uploaded images for known child sexual abuse material.
• Supabase: our database and sign-in system.
• Google: “Sign in with Google” and our email (Google Workspace).
• Our payment partner, for Pro subscriptions, which may process your payment as the seller of record.
• Apple and Google, if you subscribe through the App Store or Google Play.

We may also disclose information when the law requires it, to protect people from harm, including reporting child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), or as part of a merger or sale of the business, in which case this policy continues to apply.

5. How long we keep it

• Cards: until you delete them. On Free, your oldest card is removed when you create an 11th, and share links stop working after 30 days.
• Your account: until you delete it. We then erase your profile and cards within 30 days, and from backups within 90 days.
• Server logs: up to 30 days, unless needed to investigate abuse.
• Payment records: as long as tax and accounting laws require.
• Content removed for breaking the rules may be kept longer when the law requires it or to handle disputes.

6. Your choices and rights

• Access and export your cards and account information.
• Correct your profile at any time.
• Delete any card, or your whole account, in settings.
• Control visibility: keep cards private, unshare them or make them public.
• Turn off optional notifications and Instagram featuring.

Depending on where you live (for example the EU, UK, California and other US states), you may also have the right to object to or restrict certain processing, to data portability, and to complain to your local data protection authority. Email privacy@kirinoto.com and we'll respond within 30 days. We won't treat you differently for using these rights.

For people in the EU and UK: we process your information to provide the Service you asked for (contract), to keep it safe and improve it (legitimate interests), to meet legal duties, and, where we ask, with your consent, which you can withdraw anytime.

7. Children

Kirinoto is not for children under 13, and we don't knowingly collect their information. If you believe a child under 13 has an account, email privacy@kirinoto.com and we'll delete it.

8. Security and where data is stored

We use encrypted connections (HTTPS), access controls and reputable providers to protect your information. No system is perfectly secure, and we'll notify you and the authorities as the law requires if a breach affects you. Kirinoto is run from the United States, and your information may be stored and processed in the US and other countries where our providers operate, with appropriate safeguards for international transfers.

9. Google and Chrome Web Store data

Kirinoto's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. The Kirinoto extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements: we use data only to provide Kirinoto's features, never sell it, never use it for advertising, and don't let humans read it except with your permission, for security or legal reasons, or when it's part of content you shared publicly.

10. Changes

If we change this policy, we'll update the date above, and for significant changes we'll tell you in the app or by email before they take effect.

11. Contact

privacy@kirinoto.com
Okairo LLC, Texas, USA.