Terms and Privacy

Terms of Use

These Terms govern your use of the Koto messenger and related services, sites, and apps (the “Service”), provided by Koto (“we”, “the operator”). By using the Service, you agree to these Terms. If you do not agree, do not use the Service.

1. Who may use it

You must be at least 13 years old, and at least 16 in the European Economic Area (or another age set by local law for independent consent to data processing) without a parent or guardian's consent. By using the Service, you confirm that you have the necessary legal capacity and the right to accept these Terms.

2. Your account

A Koto account is protected by a 12-word secret phrase. You are fully responsible for keeping it safe and for any actions taken from your account. Access can be recovered only with this phrase — we do not store a copy of it and technically cannot restore access. Losing the phrase means irreversibly losing access to the account.

3. Acceptable use

By using the Service, you agree not to do the following, and not to help others do so:

• break the law or use the Service for unlawful purposes;
• send spam, fraudulent messages, or bulk or automated mailings without recipients' consent;
• infringe the rights of third parties, including intellectual property and privacy rights;
• distribute malware or malicious code;
• attempt to gain unauthorized access, disrupt the Service, or circumvent protections or limits;
• collect data automatically (scraping) or create accounts automatically;
• decompile or reverse-engineer the Service beyond the limits expressly permitted by law.

Bots and mini-apps must comply with these Terms and the platform rules.

4. Your content

You retain all rights to the content you create and send, and you are responsible for it. Private chats are protected by end-to-end encryption — we technically have no access to their contents and do not moderate them.

5. Bots, mini-apps, and third-party services

Bots, mini-apps, and integrations may be provided by third parties and are used at your own risk. We do not control them and are not responsible for their actions or policies. When you share data with a bot or mini-app, you do so at your own responsibility.

6. Paid features and in-service points

Some features may be paid. Koto Premium (when available) is an optional subscription; payment, renewal, and refunds are governed by the app store or payment provider rules. “Paws” are in-service points; they are not money, electronic money, or cryptocurrency, and cannot be withdrawn or exchanged for cash.

7. Intellectual property and license

The Service, software, trademarks, and logos belong to Koto or its licensors. We grant you a limited, revocable, non-exclusive, and non-transferable license to use the Service in accordance with these Terms. Open-source components are used under their own licenses.

8. Disclaimer of warranties

The Service is provided “as is” and “as available”, without any warranties, express or implied, including warranties of fitness for a particular purpose, merchantability, and non-infringement. We do not guarantee that the Service will operate uninterrupted, error-free, or fully secure.

9. Limitation of liability

To the maximum extent permitted by applicable law, the operator is not liable for indirect, incidental, special, punitive, or consequential damages, or for lost profits or loss of data. The operator's aggregate liability is limited to the amount you paid for the Service in the last three months, or the minimum amount permitted by law.

These limitations do not affect liability that cannot be excluded or limited under applicable law (for example, for intent, gross negligence, or harm to life and health), and do not deprive consumers of their mandatory rights.

10. Indemnification

You agree to indemnify and hold the operator harmless from third-party claims arising out of your breach of these Terms or the law, your content, or your misuse of the Service.

11. Suspension and termination

We may suspend or terminate access to the Service for a breach of these Terms or the law, or to protect users and the Service. You may stop using it at any time and delete your account.

12. Changes to the Service and Terms

We may change the Service and these Terms. We will notify you of material changes by reasonable means. By continuing to use the Service after the changes take effect, you agree to the updated Terms.

13. Governing law and dispute resolution

These Terms are governed by the law applicable to the operator, and disputes are resolved by the competent court in accordance with that law. Nothing in the Terms deprives a consumer of the mandatory rights granted by the law of their country.

14. Export controls and sanctions

By using the Service, you confirm that you are not on any sanctions lists and that you are not using the Service in violation of applicable export controls and sanctions laws.

15. Miscellaneous

If any provision is found invalid, the rest remain in force. These Terms, together with the Privacy Policy, constitute the entire agreement between you and the operator. For questions related to the Terms, reach us through our website.

Privacy Policy

Koto is designed to minimize data collection. This Policy describes what data we process, on what basis, and what rights you have.

1. Operator and contacts

Personal data controller: Koto. For questions about data processing and exercising your rights, reach us through our website.

2. Our principles

Privacy by default and data minimization. The contents of private conversations are protected by end-to-end encryption.

3. What we do not collect

• phone numbers — registration uses a secret phrase, without a number;
• an advertising profile for targeting;
• the contents of encrypted chats — they are technically inaccessible to us.

4. What data we process

The minimal technical and operational data needed to run the Service: account and device identifiers; message routing and delivery metadata; key packages required for encryption; technical logs and diagnostic data; support request data; payment data (via a payment provider — without storing payment details on our side).

5. Purposes and legal bases (GDPR, Art. 6)

• providing the Service and delivering messages — performance of a contract (Art. 6(1)(b));
• security, abuse prevention, and support — legitimate interest (Art. 6(1)(f));
• compliance with legal requirements — legal obligation (Art. 6(1)(c));
• certain features — based on your consent (Art. 6(1)(a)), which you can withdraw at any time.

6. End-to-end encryption

The contents of private chats are protected by end-to-end encryption: keys are stored on users' devices, and the operator has no access to the text of conversations.

7. Sharing data with third parties

We do not sell your personal data. We may engage processors (hosting, infrastructure, push-notification delivery, payment processing) under data processing agreements. Data is disclosed to government authorities only upon a lawful and justified request.

8. International transfers

When transferring data outside the European Economic Area, we use the mechanisms provided by law (Standard Contractual Clauses or an adequacy decision).

9. Retention periods

We keep data while your account is active and to the extent needed for the processing purposes and legal compliance. Technical logs are usually kept for no longer than 24 months. After account deletion, we delete or anonymize the data, except for what we are required to keep by law.

10. Your rights

Depending on your jurisdiction, you have the right to request access to your data, its correction, deletion, restriction of processing, portability, and to object to processing, as well as to withdraw consent. You may lodge a complaint with a supervisory authority (in the EU, your local data protection authority). For California residents (CCPA): the right to know, delete, and opt out of the “sale/sharing” of data — we do not sell data. To exercise your rights, reach us through our website.

11. Children

The Service is not intended for children under 13 (16 in the European Economic Area). We do not knowingly collect data from such users.

12. Security

We apply technical and organizational safeguards, including end-to-end encryption of conversations. No method of transmission or storage provides absolute protection.

13. Changes to the policy

For material changes, we will notify you by reasonable means. The date of the last update is shown at the top of the page.

14. Contacts

For privacy questions and exercising your rights, reach us through our website.