Privacy Policy

Who we are

Kilo is developed and published by Martin Mirchevski, an independent developer based in Bulgaria (“we”, “us”). This policy covers the Kilo app for iPhone, its widgets and Live Activities, and this website. Where we decide why and how personal data is processed, we are the controller under the EU General Data Protection Regulation (GDPR).

You can reach us at [email protected].

What stays on your iPhone

Kilo is designed to work entirely on your device. It stores the following on your iPhone, and only there:

• Credentials for the tools you connect. Sign-in tokens, access tokens, session cookies or API keys, depending on how you connect. These are kept in the iOS Keychain with device-only protection, so they aren’t synced to iCloud Keychain or moved to another device.
• Account details a tool reports. For example the email address or username and plan name of a connected account, plus any name you give it in Kilo.
• Usage readings. Limit percentages, reset times, credit or balance figures, and up to 90 days of history used for trends and forecasts.
• Your settings. Capacity thresholds, alert preferences, refresh interval, appearance, sounds and haptics.

Kilo’s widgets and Live Activities read this data from a container shared between the app and its extensions on the same device. We have no access to any of it.

Apart from Keychain items, this data is part of your app data, so it may be included in device backups you make with iCloud Backup or a computer. Those backups are handled by Apple under its terms and your settings.

What the app sends, and where

When you connect a tool, Kilo sends requests from your iPhone straight to that tool’s service to sign in and read your usage. Depending on the tools you connect, this means:

• Anthropic (Claude, Claude Code): claude.com, claude.ai, platform.claude.com and api.anthropic.com
• OpenAI (Codex): auth.openai.com and chatgpt.com
• GitHub (Copilot): github.com and api.github.com
• Cursor: cursor.com
• Z.ai: api.z.ai
• OpenRouter: openrouter.ai

These requests carry the credential needed to authenticate, along with the technical information any internet connection reveals, such as your IP address. Each provider handles that data under its own privacy policy, which we encourage you to read. Kilo only asks for account and usage information. It doesn’t read, send or store your prompts, conversations or code.

When you sign in with a provider inside Kilo, the provider’s own login page opens in a secure Safari sheet provided by iOS. It can use a login you already have in Safari. Kilo never sees your password. It receives only the tokens the provider issues after you sign in.

What we collect

We don’t run a server for Kilo, and we don’t receive your credentials, account details, usage readings or history. The app contains no analytics, advertising or tracking code, and it doesn’t track you across other companies’ apps or websites.

We only receive personal data in these cases:

• When you contact us. If you email us, for example through Contact support in the app, we receive your email address and whatever you include in your message. We use it only to reply and help you. The legal basis is our legitimate interest in providing support and, where you ask us to do something, taking steps at your request. We keep this correspondence for as long as needed to resolve your request, and usually no longer than two years afterwards.
• When you buy Kilo Pro. Purchases are processed by Apple. Apple handles your payment and Apple Account details under its own privacy policy. We don’t receive your name, email or payment details. Apple gives us sales reports that don’t identify you. The app checks your purchases on your device using Apple’s StoreKit.
• If you share analytics with developers. If you’ve turned on sharing with app developers in your iPhone’s Analytics & Improvements settings, Apple may give us crash reports and aggregated usage statistics. Apple provides these in a form that doesn’t identify you, and you can turn this off at any time in Settings.

Alerts and Live Activities

Usage alerts and reset reminders are worked out on your iPhone after each refresh and delivered as local notifications. Live Activities are updated by the app on your device. Kilo doesn’t use a push notification server, so no notification content passes through us.

This website

kilo.studiomillimeter.com is a static website. It sets no cookies of its own and loads no analytics, advertising, third-party scripts or web fonts.

The site is hosted on Cloudflare Pages. To deliver and protect the site, Cloudflare processes technical data about each visit, such as your IP address, browser details and the pages requested. Cloudflare acts as our processor for this, and its privacy policy describes how it handles that data. The legal basis is our legitimate interest in running a secure, working website.

International transfers

Cloudflare may process website request data outside the European Economic Area. Where it does, it relies on safeguards recognised under the GDPR, such as the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses.

The providers you connect in the app may be located outside the EEA. Those connections are made directly by your device at your request, and the provider is responsible for how it handles your data.

Deleting your data

Because your data lives on your iPhone, you stay in control of it:

• Remove a tool in Settings to delete its credential, readings and history.
• Erase all data in Settings removes every connected tool, credential and all history from your iPhone.
• Deleting the app removes its stored data. iOS can keep Keychain items after an app is deleted, so use Erase all data first if you want your credentials removed straight away.
• History older than 90 days is deleted automatically.

Removing a tool from Kilo doesn’t sign you out of that provider. To revoke access completely, end the session or revoke the token in your account settings with that provider.

Your rights

Under the GDPR and similar laws, you can ask us for access to the personal data we hold about you, or ask us to correct it, delete it, restrict or object to its processing, or provide it in a portable format. In practice, the only personal data we may hold is correspondence you’ve sent us. Everything else stays on your device, where you can view and delete it yourself.

To exercise your rights, email [email protected]. You also have the right to lodge a complaint with a data protection authority. In Bulgaria this is the Commission for Personal Data Protection. You can also contact the authority where you live or work.

Children

Kilo is a tool for software developers and isn’t directed at children. We don’t knowingly collect personal data from children.

Security

Credentials are stored in the iOS Keychain and are never written to logs or shared files. All connections to providers use HTTPS. No system is completely secure, so we recommend protecting your iPhone with a passcode and keeping iOS up to date.

Changes to this policy

We’ll update this page when Kilo’s data handling changes and revise the date at the top. If a change is significant, we’ll also point it out on this website or in the app.

Contact

Questions about privacy or this policy? Email [email protected].

See also our Terms and Conditions.