Version 2026-10
Privacy & data
How Komorebi handles what you write. In plain language.
This document describes how the app works technically. It is not a legal assessment of GDPR compliance and must be reviewed by a qualified professional before public launch.
What we store
- Account: email and password (managed by Supabase Auth; the password is never stored in plain text).
- Profile and preferences: name, communication style, language and country (to show suitable helplines).
- Conversations with the AI and compact summaries of them.
- Memories you approve or create in “My memory”.
- Kaizen goals and actions, reflections and mood journal entries.
- Consent records and AI usage records (token counts and estimated cost, no content).
What is sent to the AI provider
To generate a reply, the server sends the AI model provider (configurable by the operator):
- The companion's instructions and your communication preferences.
- Recent messages of the current conversation and, if it exists, a summary of its earlier part.
- If memory is on: only memories and summaries relevant to the conversation (not all), your active Kaizen goals and — only if you allow it — journal entries marked as shareable and your latest reflection summary.
- In the tools (Kaizen, Ikigai, Wabi-sabi, Shikata ga nai, journal), the content you submit when you press “ask the AI”.
Your email and account ID are not sent. Provider API keys live only on the server. The provider's data retention terms apply to the requests sent.
Memory: how it works and how you control it
- It is off until you turn it on. You can turn it off at any time.
- The AI proposes memories from what you write. Inferences and sensitive topics (health, relationships, finances…) stay pending until you approve them.
- You can view, edit, pin and delete each memory, or delete them all at once.
- The full conversation history is stored separately from summarised memories.
Security
- Encrypted transport (HTTPS) and storage in a managed database, encrypted at rest by the infrastructure provider.
- Per-user isolation enforced in the database with Row Level Security: nobody can read another account's data.
- Server logs do not include message content.
What we don't do
- We don't use what you share for advertising or behavioural profiling.
- We don't sell or share your data with third parties for commercial purposes.
- We don't make diagnoses based on your conversations or entries.
Your rights and controls
- Export all your data as JSON (Settings → Your data).
- Delete conversations, memories, or your whole account with all linked data.
- Set automatic retention for conversations.
- Withdraw consent at any time in Settings.
When you delete your account, usage records are anonymised (no link to you) and kept only for aggregate cost control.