Last updated: July 21, 2026
knoyu is operated by Flowstead LLC. This policy explains what data we collect, how we use it, and your rights regarding that data. By using knoyu you agree to the practices described below.
When you sign up we collect your email address (or phone number) and, if you use social login (Google or Apple), a unique identifier from the provider. When you use Sign in with Apple, you may choose to hide your email, in which case Apple provides a private relay address. We do not store your social-login password.
knoyu stores the messages you send and receives during conversations. Key facts, feelings, decisions, and preferences are extracted as structured “memory” notes with timestamps, categories, importance scores, and emotional context. These memories are used to personalize future responses.
We build and maintain a profile summary about you based on your conversations — traits, goals, and important people you mention. You can view and delete this at any time.
If you enable push notifications on mobile, we store an Expo push token associated with your account so we can deliver check-in reminders.
Subscription billing is handled entirely by Stripe. We do not store credit card numbers or bank details. We store only your Stripe customer ID and subscription status.
We track token usage per account for rate-limiting and billing purposes. We also record anonymous, first-party visit metrics — which pages are viewed and roughly how many visitors — using a random first-party identifier. No name, email, IP address, or cross-site tracking is stored, and we honor Do-Not-Track and Global Privacy Control signals. We do not use third-party analytics or advertising/tracking pixels.
Your data is used to:
We do not sell, share, or license your data to third parties for advertising or marketing. We do not train AI models on your conversations.
knoyu uses the following third-party services to operate:
Your data is stored in AWS DynamoDB and Elastic Cloud, both encrypted at rest and in transit. Authentication is handled by AWS Cognito with secure token-based sessions. We do not store passwords directly — authentication is managed through Cognito or social login providers.
knoyu offers privacy controls within the app:
One narrow exception overrides all privacy modes: if a message seeks sexual content involving a minor, a safety record of that message is kept even in secret or forget mode (see Safety review below).
An automated safety system reviews conversations as they happen to detect a small set of prohibited categories: sexual content involving minors, and requests for instructions to commit serious crimes or violence. This system decides how knoyu responds; it does not read your conversations for any other purpose.
When one of those categories is detected, a safety record is created — the category, a timestamp, and a limited excerpt of the triggering message — and may be reviewed by a human. These records are retained separately from your conversation data for abuse prevention, appeals, and legal compliance, and they survive account deletion. Where the law requires it — such as suspected child sexual exploitation — we report to the appropriate authorities (in the US, the NCMEC CyberTipline). We may also disclose information to law enforcement when we believe in good faith there is imminent danger of death or serious injury to a real person.
What is never recorded by this system: expressions of sadness, anger, dark humor, or thoughts of self-harm. Telling knoyu you're struggling is what it exists for — that is met with support, not surveillance, and is never reported or held against your account.
We retain your data for as long as your account is active. You can delete individual memories, entire conversations, or all of your data at any time from within the app. When you delete data it is removed from our live systems immediately. For disaster recovery we keep encrypted point-in-time backups of our database for up to 35 days, after which deleted data ages out of those backups as well. Two exceptions are retained longer: safety and enforcement records (described above) are kept for abuse prevention and legal compliance even after account deletion.
If you wish to delete your entire account and all associated data, you can do so from the Settings page or by contacting us at the email below.
knoyu is an adult service intended only for users 18 years of age and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, please contact us and we will delete it.
knoyu uses authentication cookies and tokens issued by AWS Cognito to maintain your session, plus one anonymous first-party cookie that counts unique visitors for our own traffic metrics (it holds only a random id and honors Do-Not-Track / Global Privacy Control). We do not use third-party analytics, cross-site tracking cookies, or advertising pixels.
You have the right to:
If you are a California resident (CCPA) or in the EU/EEA (GDPR), you may have additional rights. Contact us to exercise them.
We may update this policy from time to time. If we make significant changes, we will notify you through the app or by email. The “last updated” date at the top reflects the most recent revision.
Questions about your privacy? Reach out at privacy@knoyu.ai
Flowstead LLC