KolPrivacy Policy
- No phone number, email or password. Kol gives you a random six-character ID.
- Calls between people go straight from phone to phone, encrypted. We never record or store them.
- Your name, contacts, call history and groups stay on your phone.
- When you talk to an AI, the AI provider (OpenAI) processes that audio to answer. We don't store it.
- We don't sell data, show ads, or track you across apps.
- Settings → Delete my data erases your ID and everything tied to it.
- Who we are
- What we process
- Calls
- AI
- On your device
- Service providers
- How long
- Your choices and rights
- Children
- Contact
1. Who we are
Kol (the app, its web version at kol-ai.app, and related services) is made by Holy Apps ("we", "us"). Holy Apps is the controller of the personal data described here. Questions: [email protected].
2. What we process, and why
Kol is built to need as little as possible. This is everything that leaves your device:
| Data | Why | Where it's kept |
|---|---|---|
| Your Kol ID and an anonymous sign-in ID | So people can reach you, and so only your install can use your ID. | Google Firebase (EU) |
| Push token, app language, app build and platform | To notify you when someone calls while Kol is closed. | Google Firebase (EU) |
| Online status: last seen time, Do not disturb, whether the app is open | To show your contacts whether you're available. | Google Firebase (EU) |
| IDs you blocked | So blocked IDs can't wake your phone. | Google Firebase (EU) |
| A recovery fingerprint: a one-way hash of a random key | To give you back your ID when you reinstall. The key itself stays on your phone; we only keep its hash. | Google Firebase (EU) |
| Computer link codes | To link Kol on a computer to your phone. A code works once and expires after 5 minutes. | Google Firebase (EU) |
| Usage events (for example "call connected") and crash reports | To find bugs and improve reliability. They never include audio, names, contacts or the IDs you talk to. You can turn this off. | Google Analytics and Crashlytics |
| What you send us with "Report a problem" | To help you. The email includes your ID, app version, device model, notification settings and the app's recent log lines. You see it before sending. | Our email |
We use this data to provide Kol (the service you asked for), to keep it secure and working, and, for usage events and crash reports, because of our legitimate interest in making Kol better. You can opt out of the last at any time.
What we don't collect
- The audio of calls between people.
- Your contacts, call history or groups.
- Your phone number, email address or address book.
- Your location, advertising ID or data for tracking across apps and websites.
3. Calls
Voice goes directly between the devices in a call over WebRTC, encrypted end to end with DTLS-SRTP. When a direct connection isn't possible (some mobile and office networks block it), the encrypted audio passes through a relay run by Cloudflare. The relay only forwards encrypted packets: it can't listen, and nothing is stored.
To set up a call, devices exchange connection details through a signaling server (PeerJS). It sees your Kol ID, the ID you're calling and your IP address, but never the audio.
The name you choose is sent to the people you call so they see who's calling. If their app is closed, your name is included in the notification, which is delivered by Google (Firebase Cloud Messaging) or Apple (Apple Push Notification service).
4. AI in calls
An AI is only in a call when someone adds it, and everyone in the call sees it, with a label that shows when it's listening. Anyone in the call can mute or remove it.
While an AI is in a call and not muted, what's said in the call is streamed to our AI server and to OpenAI, which turns it into the AI's answer. Kol does not record or store this audio. OpenAI processes it under its API terms, which do not allow it to use the audio to train its models and may include limited retention to prevent abuse. We keep a record of AI usage (which ID used which AI, when, and for how long) to apply usage limits.
AI answers are generated automatically and can be wrong. See the Terms.
5. On your device
Your name, contacts, call history, groups, favourites and settings are stored on your phone (or, on the web, in your browser). To give them back after you reinstall, Kol keeps a small backup in your phone's secure storage: the Keychain on iPhone and Block Store on Android. Apple and Google may include it in your device's own encrypted backup. We can't read it.
6. Service providers
We use these companies to run Kol. They process data only to provide their service to us.
| Provider | What for |
|---|---|
| Google (Firebase) | Sign-in, the ID registry and online status (stored in the EU, region europe-west1), server functions, notifications, Analytics and Crashlytics |
| Apple | Notifications on iPhone |
| Cloudflare | Encrypted call relay, and hosting this website |
| PeerJS | Call signaling (connection setup only) |
| OpenAI | AI participants in calls |
Some providers may process data outside your country, including in the United States. Where the law requires it, these transfers rely on safeguards such as the European Commission's standard contractual clauses or an adequacy decision.
We don't sell or rent personal data, and we don't share it for advertising. We disclose data to authorities only when the law requires it.
7. How long we keep it
- ID, push token, online status and blocked IDs: until you use Delete my data.
- Recovery fingerprint: until you use Delete my data. It only links to the anonymous sign-in ID, never to your name or phone.
- Computer link codes: 5 minutes.
- Usage events and crash reports: for a limited period set in Google's tools, then deleted.
- AI usage records: as long as needed for usage limits.
- Support emails: as long as needed to handle your request.
8. Your choices and rights
- Turn off usage and crash reports: Settings → Share usage and crash reports.
- Delete everything: Settings → Delete my data. This gives your ID back, deletes your push token, online status and blocked list from our servers, and removes the recovery key and backup from your phone. It can't be undone.
- Notifications and microphone: you can turn these off in your phone's settings at any time.
Depending on where you live (for example under the GDPR in Europe or the Privacy Protection Law in Israel), you may have the right to access, correct, delete or export your data, to object to or restrict its processing, and to complain to your data protection authority. Because Kol doesn't know who you are, we'll need your Kol ID to find your data. Write to [email protected].
9. Security
Calls are encrypted end to end. Server data is protected by access rules: no one can read another person's push token, blocked IDs or recovery data. Connections to our services use HTTPS. No system is perfectly secure, and we'll tell you and the authorities about a breach where the law requires it.
10. Children
Kol isn't meant for children under 13, and we don't knowingly process their data. In some countries a parent's permission is needed up to an older age. If you believe a child is using Kol without permission, contact us and we'll help delete the data.
11. Changes
If we change this policy, we'll update the date above. For important changes we may also tell you in the app.
12. Contact
Holy Apps · [email protected]