kiyo

Kiyo Privacy Policy

Effective August 29, 2026

This policy explains what information Kiyo collects, why, how long we keep it, and the choices you have. Kiyo is operated by ν”„λ‘œμ νŠΈμ€„λΌμ΄ ("we", "us").

Privacy at a glance

  • If you use Kiyo without an account, the records you enter stay on your device. The contents of your tasks, events, notes, habits and menstrual cycle records are not sent to us.
  • If you sign in with an account (Google or Apple), we collect only what syncing across your devices requires.
  • We collect usage records β€” which screens you open and which features you use β€” whether or not you have an account. We use them only to improve Kiyo and find errors, and they never include what you typed.
  • Menstrual cycle records are sensitive health information. We process them only if you give separate consent when you turn on Cycle Syncing.
  • We do not sell any of your data, and we never use health information for advertising.

The summary above is part of the full policy below. Where they differ, the full policy governs.

1. Information we collect

If you use Kiyo without an account, what you enter is not sent to us. Tasks, events, notes, habits, menstrual cycle records and everything else you type stay in storage on your own device.

Everything in the table below except "Usage records" is collected only if you sign in with an account (Google or Apple) and use syncing. Usage records are collected whether or not you have an account.

What we collectWhat it includesWhy we collect itHow long we keep it
Account informationEmail address, name (profile name), profile photo URL and account identifier from your Google or Apple account. If you use Apple's Hide My Email, we receive the relay address Apple creates instead.To identify you, keep you signed in, and provide syncingUntil you delete your account
Synced dataThe tasks, events (title, date and time, color and the like), notes, habits and completion records you create in Kiyo, and your app settingsTo sync across your devices and let you use the web versionUntil you delete them, or until you delete your account
Sensitive health data (only with your separate consent)Menstrual cycle records: period start and end dates, whether a period is ongoing and their history, average cycle length, period length, and your Cycle Syncing settings. If you choose to import data, this includes menstrual cycle records imported from Apple Health.To provide Cycle Syncing β€” showing and predicting cycle phases and providing reference information β€” and to sync across your devicesUntil you turn the feature off and delete the records, or until you delete your account
Google connection (optional)Google OAuth tokensTo connect Google Calendar and Google Tasks, so events and tasks can be brought in and reflected backUntil you disconnect, or until you delete your account
Google Tasks data (optional)Task title, due date and completion statusTo show your tasks in Kiyo and sync them both waysUntil you disconnect, until the original is deleted, or until you delete your account
Usage records (with or without an account)App and web usage records (screens viewed, features used), device identifier, platform, app version and the language Kiyo is displayed in β€” plus your account identifier when you are signed inTo improve Kiyo and find errors12 months from the day they are collected

Usage records never contain what you entered β€” not the contents of your events, tasks, habits, notes or cycle records.

We do not store the contents of your Google Calendar events on our servers. Each of your devices fetches the events of a connected calendar directly from Google β€” title, date and time, location, notes, guests and meeting links β€” and keeps them only on that device. They are not sent to us, so they are also not part of the transfers described in "Service providers, and where your information is stored".

We do store the identifier of a Google event and the marks you add to it inside Kiyo (its color, and whether you set it as a D-Day). That is so those marks survive when you change or reinstall your device; it does not include the event's contents. An event you create in Kiyo and send to Google Calendar is "Synced data" above, and it is stored on our servers.

Access logs β€” IP address, times of access and similar β€” may be generated automatically while you use Kiyo. We use them only for security and to respond to failures, and then destroy them.

2. Health information and Cycle Syncing

Menstrual cycle records are sensitive health information, and we handle them under these rules.

  1. Separate consent. We ask for consent to collect and use them when you turn on Cycle Syncing, separately from consent to anything else. You have the right to decline. If you do, every feature of Kiyo other than Cycle Syncing remains available to you.
  2. Never for advertising, never sold. We do not use menstrual cycle records for advertising or marketing, and we do not sell or otherwise provide them to third parties.
  3. Not in usage records. The usage records described above contain none of the contents of your cycle records. When we count which screens were opened, the cycle screen is counted the same way as every other screen.
  4. Apple Health (optional). Only if you start an import yourself and allow it in iOS do we read the menstrual records in the Apple Health app on your device and add them to your cycle records. After that we bring in new records when you open the app, and you can turn that off in settings. Imported records are handled exactly like your other cycle records and are not used for advertising. Kiyo never changes or deletes what is stored in Apple Health.
  5. Withdrawing consent. You can withdraw your consent at any time in settings. When you do, those records are destroyed without delay.
  6. Deletion. Cycle records stored on our servers are destroyed when you delete your account.

If you are a Washington State resident, our Consumer Health Data Privacy Policy describes how we handle menstrual cycle records under the My Health My Data Act.

3. How we share information

We do not provide your personal information to third parties, except:

  1. when you have agreed in advance; or
  2. when required by law, or when an investigative authority makes a lawful request following the procedures the law sets out.

We do not sell your personal information.

4. Service providers, and where your information is stored

We do not run our own servers. We use two service providers to operate Kiyo, and they only do the work we engage them for:

Using Kiyo therefore involves transferring, storing and processing your information outside your country of residence β€” in Singapore, Japan and the United States. Both providers keep it only until our agreement with them ends or you delete your account.

What is transferred is everything in the table above: your account information, synced data, Google connection information and Google Tasks data, and β€” if you have given separate consent β€” your menstrual cycle records, including any you imported from Apple Health. For the web version it also includes the website visit statistics described under "Cookies, local storage and analytics". It is sent over the internet as you use Kiyo: when you sign in, when data syncs and when usage records are sent. Usage records are transferred whether or not you have an account. The contents of your Google Calendar events are never sent to us, so they are never transferred.

You can avoid all of this except usage records. If you use Kiyo without signing in, your account information, synced data, sensitive health data and Google connection information stay on your device and are never transferred. Syncing across devices and the web version are then unavailable to you.

5. Information we receive from Google APIs

Kiyo uses Google APIs for Google sign-in and for the Google Calendar and Google Tasks integration. We handle what we receive from those APIs under these rules.

  1. We use it only to provide the features you can see β€” showing and syncing your events and tasks.
  2. No person reads that data, apart from limited exceptions such as security review and complying with the law.
  3. We do not use it for advertising, and we do not sell it.
  4. We do not transfer it to others beyond what providing the feature requires, such as storing it on our cloud infrastructure.
  5. The contents of your Google Calendar events stay on your device and are not stored on our servers. Our servers hold only the identifier of an event and the marks you added in Kiyo β€” its color and D-Day setting.
Kiyo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your Google account at any time in Kiyo's settings or in your Google account permissions.

6. How we delete information

  1. When personal information is no longer needed β€” because its retention period has passed or its purpose has been met β€” we destroy it without delay.
  2. Information held as electronic files is permanently deleted in a way that cannot be recovered.
  3. You can delete the data stored on your own device yourself, by deleting the app or by using the data reset function in Kiyo's settings.

7. Your choices and rights

  1. You can ask us at any time to let you access your personal information, correct it, delete it, or stop processing it.
  2. Some of these you can do yourself in Kiyo: edit or delete a record on the screen it appears on, reset your data in settings, turn off Cycle Syncing in settings, and sign out or delete your account in settings or by contacting us.
  3. For anything else, write to team@kiyoplanner.com and we will act without delay.
  4. You can also exercise these rights through a legal representative or someone you authorize. In that case we may ask for documents showing that authority.
  5. Kiyo is for people aged 14 and over. We do not collect personal information from children under 14, and if we find that we have, we delete it without delay.

8. How we protect information

  1. Encryption in transit. All communication between Kiyo and our servers is encrypted with TLS.
  2. Access control. Access to our servers and database is limited to the minimum needed to operate the service.
  3. Physical security. Data is held on infrastructure run by cloud providers with international security certifications.

9. Cookies, local storage and analytics

  1. The app uses no cookies and no tracking SDKs for advertising or behavioral analysis, and sends nothing about you to third-party analytics services. It does run the usage-record collection we built ourselves, to improve Kiyo and find errors; what that collects and how long we keep it are in the table above.
  2. The web version uses browser storage (localStorage) only for what running the service requires, such as holding your records and keeping you signed in. You can clear that storage in your browser settings, but doing so also deletes the records held on your device and may leave parts of Kiyo unusable.
  3. The web version uses the website visit statistics feature provided by our web host, Vercel, Inc., to see which pages are opened and how often.
    • What it collects: the address of the page visited, how you arrived (the previous page, a search engine and so on), country, and device and browser type.
    • It uses no cookies and no browser storage. To tell visitors apart it converts connection information into a non-identifying value that changes every day, so after a day a visit cannot be linked to an earlier one.
    • It is not used for advertising or behavioral analysis, it does not follow you across other sites, and it is never combined with what you entered in Kiyo β€” your events, tasks, habits or menstrual cycle records.
    • How to refuse: your browser's tracking protection or a content blocker will stop the collection. Refusing does not limit your use of Kiyo in any way.
    • This applies to the web version only, not to the iOS or Android app. Usage records in the app are covered by point 1 above and by the table.

10. Changes to this policy

  1. This policy takes effect on August 29, 2026 (posted August 22, 2026; effective August 29, 2026). In this revision we updated how we describe accounts to include Sign in with Apple, and brought the list of sensitive health data we collect in line with what we actually process.
  2. The previous version is available here:
  3. When this policy changes, we post the changes on our website (kiyoplanner.com) at least 7 days before they take effect β€” at least 30 days before, if the change materially affects your rights.

11. Contact us

If you need to report a privacy matter or seek advice, you can also contact the following Korean authorities: