Privacy Policy
Effective October 29, 2026
We collect your email address, the media you upload, the prompts you write and the outputs you generate, plus billing and technical records. We use them to run the service. We do not sell them and we do not train models on your content. Everything we store about you is held in the United States. You can download a copy of your data or delete your account at any time.
1. Who we are
Qualia LP operates meetkuro.com and share.meetkuro.com and is the controller of the personal data described here. You can reach us at privacy@meetkuro.com or by post at 2967 Dundas Street West, Suite 207d, Toronto, Ontario M6P1Z2, Canada.
This policy covers the meetkuro.com website and the app at app.meetkuro.com, the share.meetkuro.com permalink pages, and our API. They are one account and one set of records, and everything described below is true of all of them.
2. What we collect
- Account data. Your email address, and, if you set them, a display name, a public @handle and an avatar URL. If you sign in with Google, we receive your email address and basic profile from Google; we never receive your Google password.
- Content you provide. Images, video and audio you upload, and the prompts, scene text, notes and titles you write. Uploaded photographs may contain personal data about you and about other people; you are responsible for having the right to upload them.
- Content you generate. The images, clips, audio and videos the models return, together with the settings used to produce them (model, dimensions, duration, credit cost).
- Billing data. Your plan, subscription state, order history and credit ledger. Payment card details go directly to Stripe, our payment processor, and are never received or stored by us.
- Technical records. Request logs containing a request ID, your account ID, the route, method, status, latency and timestamp; product events recording which features an account used; and, when you authenticate, accept policies or begin checkout, the IP address and forwarding chain our server observes, your browser user-agent and a stable device digest made in your browser from browser, language, screen, time-zone and canvas signals. The digest is forgeable corroboration, not proof of identity and not an authentication factor. When you use the web, desktop or iOS app, we also record an account-scoped digest of a random browser/app installation identifier, estimated device category (computer, phone, tablet or unknown), operating system, browser, app surface and sampled activity timestamps to understand device usage. API and MCP activity is counted separately.
- Dispute evidence. If a payment is disputed, we mirror the dispute state from Stripe and may copy bounded, redacted account, transaction and service-activity records into a manual-review packet. Those copies exclude raw prompts and chat text and are never submitted automatically.
- Connected applications. If you connect ChatGPT, Claude, Codex or another MCP client, we store the application's name, the permissions you approved, token digests and connection timestamps. We receive the prompts and media references that client sends to our tools and return the requested status and generated media to it.
- Support correspondence. Whatever you send us and our replies.
We do not use advertising cookies, third-party analytics or tracking pixels. Our marketing site at meetkuro.com stores nothing about where you came from: its only cookie, kuro_locale, is set when you press its language switcher, to remember the language you chose. When you open a page there from another website or directly, the links on that page that lead into our app carry, for that page view only, the page's address without its query, the domain of the website that sent you (if any) and the campaign tags of the link you followed (its utm_ parameters), and nothing that identifies you. If you follow one, the app reads them from its own address, as it reads the campaign tags of any link into it, and keeps them, together with the app page you opened and the page that sent you to it, in the app's own storage in your browser for up to 90 days; if you sign up in that time, they are saved with your account's sign-up record, so we can tell which pages and which sources bring people who sign up (legitimate interests). The app stores your sign-in session in your browser because it cannot keep you signed in otherwise.
3. Why we use it, and on what basis
| What | Why | Basis (GDPR Art. 6) |
|---|---|---|
| Account data, content, generation settings | To give you the service you asked for | Performance of a contract |
| Billing data | To take payment, apply credits and keep accounts | Performance of a contract; legal obligation for the accounting records |
| Request logs, product events | To keep the service up, find bugs, and stop abuse and fraud | Legitimate interests |
| Connection, checkout and dispute-evidence records | To prevent fraud and establish or defend payment claims | Legitimate interests; establishment or defence of legal claims |
| Transactional email (sign-in links, low-credit notices, payment and renewal notices) | To operate your account | Performance of a contract |
| Marketing email, which may include a note when each free try of your first week opens | To tell you about the product | Consent, which you can withdraw at any time. In the United States, where the law does not ask for it in advance, we email you unless you turn the switch off when you sign up or later; we record the country you signed up from and which of the two rules applied |
4. Where it is processed
Everything we store about you is in the United States. Our database runs in Supabase's us-east-1 region, our API and rendering worker run on Fly.io in Virginia, and media is stored in Cloudflare R2. We are established in Canada, so if you are in the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred outside your country to the United States to be processed.
One thing sits outside that, and it does not hold your account or your media. Our mail provider is a Swiss company, so email between you and us, including the sign-in links you ask for, passes through it. It is named in the table below.
We rely on our providers' own transfer safeguards, including the Standard Contractual Clauses they incorporate into their data-processing terms. We are reviewing our transfer documentation, and our position on whether an EU representative under Art. 27 is required, with legal counsel; if that review changes anything material we will update this section and tell affected users.
5. Who else processes it
We use the providers below. They act on our instructions and may only use your data to provide their service to us. We do not sell personal data and we do not share it with advertisers.
| Provider | What it does | Where |
|---|---|---|
| Supabase, Inc. | Managed Postgres database, authentication, and realtime updates. Holds accounts, prompts, generation metadata and the credit ledger. | United States (us-east-1) |
| Cloudflare, Inc. | Object storage (R2) for uploaded and generated media, static site and app hosting (Pages), DNS and CDN, and privacy-preserving traffic analytics (Web Analytics) on our marketing sites. The analytics beacon runs in your browser and reports page performance; it sets no cookie and does not track you across sites. | United States, with a global edge network |
| Fly.io, Inc. | Compute for the API and the rendering worker. | United States (iad) |
| Replicate, Inc. | Runs the image, clip and audio generation models. Receives your prompt and any reference media you attach to a generation. | United States |
| Features & Labels Inc. (fal) | Runs some of the same image and clip models as Replicate, and takes over when Replicate cannot. Receives your prompt and any reference media you attach to a generation. | United States and other countries its notice permits |
| Higgsfield Inc. | Runs its own image and video models, and is the first choice for some clip models. Receives your prompt and any reference media you attach to a generation, including a source video. | United States and other countries its notice permits |
| ElevenLabs, Inc. | Generates speech with an account voice selected by its ElevenLabs ID. Receives the spoken text, voice settings and selected voice ID. | United States |
| OpenRouter, Inc. | Routes our requests to the language model behind storyboard drafting and the studio assistant, and passes them to the model's own provider. Receives the text you write in those surfaces, and any picture you attach to them. If the Organizer is on, it also receives each finished file, each file you upload and each storyboard's first picture, so a naming model can write a title, a description and keywords for it. For an uploaded photo it also receives the first photo of up to six of your Subjects, to suggest which of them the photo shows; nothing about a face is stored. | United States |
| Post for Me (Day Moon Development LLC) | Connects social accounts and publishes media and captions to TikTok, Instagram, YouTube and X when you ask Kuro to post. Holds the platform authorization tokens; Kuro does not store them. | As described in Post for Me’s privacy notice |
| Stripe, Inc. | Processes payments for paid plans and credit top-ups, and sends your payment receipts. Receives your email address and billing details; we never receive or store card numbers. | United States, and other countries its notice permits |
| Migadu-Mail GmbH | Mail to our published addresses. Carries anything you send to hello@, privacy@ or abuse@, and our replies. Receives your email address and the contents of those messages. It does not carry the mail we send you. | Switzerland; it does not publish the locations of its mail servers |
| Loops | All email we send you. Sign-in links, password resets and email-change confirmations, plus product mail about your account: the welcome message, low-credit notices, payment-failure notices and credit-renewal notices. Receives your email address. Payment receipts do not go through Loops. Those come from Stripe. | United States |
| Functional Software, Inc. (Sentry) | Crash reporting for the app at app.meetkuro.com. When it fails, your browser sends it the error message, the stack trace and the path of the page you were on. It also sees your IP address and user-agent, because the report goes straight from your browser rather than through us. It receives no prompts, no media, no email address and no account data. | United States (ingest.us.sentry.io) |
| Notion Labs, Inc. | Our internal workspace, where we triage support and errors. Messages you send to hello@, privacy@ or abuse@ are copied there with every email address removed, and crash reports and the reports your AI agent sends us are filed there with your account ID. Receives the contents of those messages and reports, and none of the media you make. | United States |
| Anthropic, PBC | Claude, the AI assistant we use for our daily support, bug and growth reviews. It reads what we file in Notion (support messages with email addresses removed, crash reports and agent reports) and account-level usage figures, and receives none of the media you make. | United States |
Claude, Codex and other MCP clients you choose to connect are not our subprocessors. They act at your direction as the client through which you use the service. Conversation content they hold before a tool call, and the tool results they receive from us, are handled under that client's own terms and privacy policy. Disconnecting a client stops future access but does not delete copies already held by that client.
If we add a synthetic-voice provider, or any other processor, we will list it here before the feature that uses it ships.
We may also disclose data where the law requires it, or to establish or defend legal claims. If we are ever acquired, your data would move with the service and we would tell you first.
6. Training
We do not train any model on your prompts, your uploads or your outputs, and we do not license them to anyone for training. Our model providers receive your prompt and any reference media in order to return your result; what they retain and for how long is governed by their own terms, which are linked in the table above.
7. How long we keep it
| Category | Retention |
|---|---|
| Account record | For as long as your account exists. Erased or pseudonymised when you delete it (see section 9). |
| Uploads, generated media and rendered videos | Until you delete them or delete your account. Deleting an item removes the stored file as part of that request; anything left over is swept hourly. On a free account there is one further limit: after twelve months without signing in, the media stored in the account is removed — see the row below. |
| Free accounts that have gone quiet | If you have no paid plan and do not sign in for twelve months, we remove the uploads, generated media, rendered videos and the storyboards and prompts that belong to them. We email you twice first, thirty days and seven days before, and signing in at any point cancels it. Your account, your credits and your purchase history are not affected and the account keeps working. Accounts on a paid plan are never subject to this. |
| Prompts, scene text and generation settings | Same as the media they belong to. |
| Videos you have moved to the bin | Marked deleted immediately and hidden from you. Their stored files are not yet purged automatically; they are removed when you delete your account, and you can ask us to remove them sooner. |
| Credit ledger | For as long as your account exists. |
| Orders, refunds and completed checkouts | Kept after account deletion, detached from your identity, for as long as tax and accounting law requires, which in Canada is generally six years from the end of the tax year they relate to. |
| Dispute-evidence packets | Held while a legal hold is active. When an authorised admin releases the hold, the packet and its copied sources are deleted after 90 days. Raw connection and policy-acceptance ledgers are removed when the account is erased; a packet copy already under hold is preserved in pseudonymised form. |
| Browser/app installations | While your account exists; removed when you delete your account, including when billing records are retained. |
| Device and API/MCP activity observations | 400 days, or until you delete your account, whichever comes first. |
| Request logs with an account ID | 30 days, then deleted. |
| Aggregate traffic counts with no account ID | 13 months. |
| Share links you created | Until you revoke them or delete your account. |
| OAuth connections and personal access tokens | Until they expire, you revoke or disconnect them, or you delete your account. We store only token digests, not reusable token plaintext. |
| Free allowance claims | A one-way digest of your email address, never the address itself, kept for up to two months after the month it was used in, including after you delete your account, only so the same inbox cannot claim the free monthly allowance twice. Then deleted. |
| First-week free tries | The same one-way digest of your email address, never the address itself, kept for as long as we offer the first-week tries, including after you delete your account, only so the same inbox cannot receive them twice. |
8. How your media is protected
Uploaded and generated files are stored in a private bucket. They are not reachable by a public URL. Every view or download is served through a link we sign for you that expires within minutes. Making something public is an explicit action: a share link you create yourself, which you can revoke.
9. Your rights
Depending on where you live, you may have the right to get a copy of your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable format, and withdraw consent you have given. Exercising any of them costs nothing and we will not treat you differently for it.
- Delete your account. In the app, go to Settings → Profile → Delete account. This signs you out, removes your content and starts erasing your stored files immediately. It cannot be undone.
- Correct your details. Name, handle and avatar are editable in Settings → Profile.
- Everything else (a copy of your data, a portable export, restriction, objection): email privacy@meetkuro.com from the address on your account. We answer within one month and will tell you if we need longer.
We keep some records even after erasure where the law requires it: the order, refund and held dispute-evidence records described in section 7, held without the account's name or email attached. If you are in the EEA or the UK you can complain to your local supervisory authority; in Canada, to the Office of the Privacy Commissioner.
10. Age
The service is not for children. You must be at least 18 to create an account. We do not knowingly collect data from anyone younger; if you believe we have, email privacy@meetkuro.com and we will delete it.
11. Automated decisions
We do not make decisions about you by automated means that produce legal or similarly significant effects. Automatic rate limits and abuse controls may temporarily block a request; email us and a person will look at it.
12. Security
Data is encrypted in transit and at rest by our providers. Access to production systems is limited to the people who need it. No system is perfectly secure; if a breach affects your personal data we will notify you and the relevant authority where the law requires it.
13. Changes
If we change this policy we will update the effective date at the top, and for material changes we will tell you by email or in the app before they take effect.
On 19 October 2026 we described how a link from our marketing site into the app carries where you came from, and how the app keeps that with your sign-up record (section 2); the marketing site sets no cookie for it. Our marketing site also began serving its own copies of the typefaces instead of loading them from Fontshare (section 5).
On 28 October 2026 we corrected the payment provider: payments are processed by Stripe, not Polar (sections 2 and 5). The app and share.meetkuro.com now serve their own copies of the typefaces too, so Fontshare is no longer one of our providers (sections 4 and 5). Creating an account now asks you to confirm you are 18 or older (section 10).
On 29 October 2026 we added fal and Higgsfield, which run some of our generation models, and Notion and Anthropic to our subprocessors (section 5). For Notion and Anthropic: messages you send to our published addresses, with email addresses removed, are now filed in our Notion workspace and read by Claude to help us triage support and bugs. Our support address is hello@meetkuro.com.
14. Contact
Qualia LP, 2967 Dundas Street West, Suite 207d, Toronto, Ontario M6P1Z2, Canada. privacy@meetkuro.com.