Privacy policy
Kailoom ("we", "us") is run by gggravity, a company in Missouri, United States, and provides the service at kailoom.com. This page explains what we collect, why, who handles it, how long we keep it and what you can do about it. We keep it short on purpose.
What we collect
- Account details. Every account has a username, a display name and a profile picture, plus an email address if we have one. If you sign in with Discord we copy your Discord username, display name and picture (and your verified email, if Discord shares it) when you join, and keep them current until you change them in Settings. We do not get your Discord password, messages, servers or friends. You can change your username, display name and picture at any time, whether you joined with Discord or email. Adding a password is optional for Discord accounts: if you do, we keep only a salted hash of it (never the password itself) so you can still sign in with your email and password if you lose your Discord. Your username is never used to sign in.
- Date of birth. The first time you sign in we ask when you were born, once, to work out your age group. We keep that date with your account, and only the people who run Kailoom can see it. You can not change it yourself, but you can ask us to correct a mistake.
- What you make and say. Chats, characters, reference pictures, voice samples, generated pictures, music and video, memories, projects, settings and credit history. This is the content the service exists to handle.
- Voice clips. If you upload a voice clip so a character can talk, we use it only to make that character's voice. Some laws (such as Illinois' biometric privacy law) treat a voice as biometric data, so we ask for your clear consent before each upload, never use a clip to identify you or anyone else, never sell or share it, and delete it when you delete it, the character or your account, or after 12 months without being used, whichever comes first. Only upload your own voice, or a voice you have permission to use. People under 18 can't upload voice clips.
- Reference photos. Photos you upload for a character are used only to draw that character. We ask whether they show a real person. If they do, the character becomes a real-person character. Uploaded pictures are checked automatically by our own vision model, on our own servers, to tell photos from drawings: photos are never used for adult pictures, drawings can be used for the adult anime style. Every picture Kailoom makes carries a hidden "AI-generated" tag in the file.
- Takedown and likeness complaints. If you send a copyright notice or a complaint about a real person, we keep it and what we did about it. A copyright notice, including the sender's name and contact details, may be passed to the person who posted the content so they can reply, as US copyright law expects.
- Reviews and reports. Star ratings and reviews you write on store characters are shown with your display name. Reports you send about a store character are only seen by moderators; the character's owner is never told who reported them.
- Credits and invites. Your credit balance and history, when your last weekly bonus was paid, and the invite links you made or used. When you redeem a credit code we record the code, the time and your account, nothing else.
- Technical data. Your IP address and request details appear briefly in server logs and in Cloudflare, which sits in front of the site. We use them to keep the service safe (rate limits, blocking abuse), not to profile you. To stop people farming free credits through invite links, we also keep a scrambled (hashed) version of your IP address for up to 45 days. It cannot be turned back into the address. Cloudflare also tells us roughly where a request comes from (country, and state or region). We use that only at the moment of the request, to switch off adult settings where the local law requires a verified age, and we do not store it.
- Cookies and local storage. A sign-in cookie that keeps you logged in for up to 30 days, a ten minute cookie used while you sign in with Discord, an hour-long cookie that remembers which invite link you came from, and browser storage for your own preferences such as theme and shortcuts. We use no advertising or analytics cookies.
Why we use it, and our legal basis
- To run your account: sign you in, answer your messages, make your pictures and voices, track your credits. This is needed to provide the service you asked for.
- To keep the service safe: rate limits, abuse and fraud checks, enforcing our terms, and the checks that stop content involving anyone under 18. We do this because running a safe service is our legitimate interest, and in some cases because the law requires it.
- To set your age group from your date of birth, so that young people are not shown content meant for adults.
- To send the emails you ask for, such as a sign-up code or a password reset. We do not send marketing email.
We do not sell your data, we do not share it for advertising and we do not show ads.
Who else handles it
- Cloudflare provides our domain, network protection and the email we send you.
- Discord, only if you choose to sign in with it.
- Linked services. If you connect an outside account in your settings (for example Google), the tools you use act on that account with the permission you give, and you can disconnect it at any time.
- Mullvad VPN, only if you switch it on. You bring your own Mullvad account. We store your Mullvad account number encrypted, and use it to register a device on your account so your traffic can leave through Mullvad servers. Mullvad then sees that traffic under your account. Kailoom is not affiliated with Mullvad. You can remove the number and the device in your privacy settings.
- Websites you ask it to visit. A few tools you can switch on, such as web search and browsing, contact outside websites on your behalf. You can send that traffic through Tor or a VPN in your privacy settings.
The AI models that answer you run on servers we operate. Your chats are not sent to outside AI companies. We hand data to authorities only when the law requires it, and we will tell you first where we are allowed to.
Who can see your chats
Your chats are private to your account. The people who run Kailoom do not read them as a routine. We may look at specific content only to investigate abuse reports, to protect someone's safety, or if the law requires it. The store and share links show only what you choose to publish or share.
When the law requires it, we report apparent child sexual abuse material to the National Center for Missing and Exploited Children (NCMEC), which works with law enforcement, together with the account details needed. We answer valid legal requests such as court orders, and may share information to stop serious harm to someone.
Adult settings and identity checks
Adult settings are off by default, need your confirmation that you are an adult, and are only open to accounts with an adult age group. We plan to add an identity check for them. When we do, we will use a specialist verification provider so that we never see or keep your ID photos or face scans ourselves. We will keep only the result (that you were verified as an adult, when, and the provider's reference), and we will ask for your clear consent first. We will name the provider and update this page before the check starts. Nothing in this paragraph is in use yet.
How long we keep it
- Your chats, characters and everything else you make stay until you delete them or delete your account. Sign-in codes expire in 15 minutes and sign-in sessions after 30 days.
- Scrambled IP addresses used for invite checks are kept for up to 45 days.
- Server logs are kept for 7 days and then deleted.
- Backups may hold deleted data for up to 30 days before they are overwritten.
- Takedown, likeness and safety complaints, and what we did about them, are kept for 3 years in case of a dispute. Strikes stay with the account.
- Content we preserve for a child safety report is locked away for one year, as US law requires, and then deleted unless law enforcement asks us to keep it longer.
- When we investigate abuse of the sandbox or an account, the records of that investigation are kept for up to one year.
- Voice clips that go unused for 12 months are deleted.
- A record of when you agreed to the terms (the date, the version, a scrambled IP address and your browser name) is kept for as long as you have an account and 3 years after, as proof of the agreement.
Your choices and rights
- Delete. In Settings, Account, you can clear chats, characters, memory, projects and photo shoots, export everything, or delete your whole account. Deleting your account removes your sign-in details, name, chats, characters, pictures and everything else you made. We keep a minimal record so that deleting and rejoining can not be used to get free credits or to get around a ban or an age limit: your account and sign-in IDs, your date of birth, your credit balance and history, your invite records, and any ban flags. Email us if you want that record removed too; we will remove it unless we have a specific abuse reason to keep it.
- Access and correction. Use the export button for a copy of your data, or email us. Email us to fix a wrong date of birth.
- Other rights. Depending on where you live (for example the EU, the UK or California) you may have the right to access, correct, delete, restrict or object to our use of your data, to take it with you, and to complain to your data protection authority. Email us and we will answer within 30 days. We will not treat you differently for using these rights.
Age
Kailoom is for people aged 16 and over. We ask your date of birth when you first sign in: under 16 is locked out, 16 and 17 stay on the Normal content setting with extra limits (no voice clips, no photos of real people, no privacy routing, no purchases, and friends and messages only with others under 18), and 18 and over can use the adult settings once they confirm they are an adult. We collect nothing extra from 16 and 17 year olds. If you believe a child has made an account, tell us and we will remove it.
Where your data is
Kailoom runs on servers in the United States. If you use it from another country, your data is sent to and stored in the United States, and Cloudflare handles traffic on our behalf in many countries.
Security
Passwords are hashed with scrypt, sign-in codes are stored hashed, sessions can be revoked, and traffic is encrypted in transit. Code the assistant runs for you runs in an isolated sandbox. No system is perfectly secure, so use a password you do not use anywhere else, and tell us at the address below if you find a problem.
Changes
If we change this page in a way that matters, we will tell signed-in users before it takes effect.
Contact
gggravity, Missouri, United States. Questions or requests: [email protected]