Privacy Policy

What we collect

• Account info: a username and a password (stored as a salted hash, so we never see or store your actual password), or, if you use "Continue with Google," your Google account's name and email address. If you use Google's "Continue as" prompt (Google One Tap) on our website, Google shares your name, email and photo with us only when you tap it.
• Date of birth: asked once, when you sign up (or the next time you open Kibhi), to confirm you're 13 or older and to switch on teen protections for 13-17 year olds. It's never shown on your profile or to anyone else, and you can't change it yourself afterwards (contact us if you made a mistake).
• Contacts (Android app, only if you choose Find friends): after we explain it, the app asks for permission to read your contacts. They are read on your phone; only one-way codes (SHA-256 hashes) of your contacts' email addresses and phone numbers are sent to check which belong to Kibhi members, and they are not stored. Names and the numbers themselves never leave your phone; a phone number is also used to open your messaging app when you tap Invite. You can turn contacts access off at any time in your phone's settings.
• Your phone number (optional): if you add one in Settings, Google Firebase texts you a code to confirm it's yours. We then keep only a one-way code (SHA-256 hash) of the number and its last 4 digits, so friends who have your number in their contacts can find you. Your number is never shown to anyone, and you can remove it in Settings at any time.
• Location (Near you, only if you turn it on): the app asks for your approximate location, or the website asks your browser, and turns it into your city. We keep only that city and coordinates rounded to about 10 km, never your exact location or a history of where you go. Your city is used to show you local businesses and people near you, and you are shown to people near you only if they turned Near you on too. Turning Near you off deletes it. Without it, we may use the city of your internet connection to suggest local businesses.
• Business Pages: if you create one, the business name, category, city, website, phone number, description and logo you provide are public on your profile and in Discover. The business email you give us is used only to verify the business and to contact you about it; it is never shown to anyone else. Recommendations you give a business are counted on its page.
• Payments: donations, sponsorships, memberships and promotions are processed by Stripe, which handles your card details; we never see or store them. We keep a record of each payment (amount, date, what it was for, and the email Stripe gives us) for our accounts, receipts, refunds and the law.
• Content you post: notes, photos, and videos you post, their captions, and a bio you add during onboarding. If you edit a post's text, the earlier versions are kept (visible only to Kibhi's moderators) so reports can be reviewed fairly, and are deleted with the post.
• Sign-ins and devices: for each place you're signed in, the IP address it was last used from, the approximate location that address points to (country, and sometimes region or city), and the kind of device and app or browser (for example "Kibhi Android app on a Samsung phone"). We use this only to keep accounts safe: spotting sign-ins that aren't you, stopping spam and ban evasion, and investigating reports. You can see and sign out your devices in Settings.
• Activity and recommendations: the posts you like, save, comment on, repost, watch (and roughly how long) or mark Not interested, and who you follow. We use these to show your activity back to you and to pick what For You shows you, using the hashtags and creators of posts you engaged with. This all happens on Kibhi's own servers; it isn't shared with anyone or used for advertising.
• Moderation records: when Kibhi's team reviews a post we keep what was decided (left up, featured, limited or hidden), which rule it was about, who decided and when; plus any warnings, strikes, suspensions, reports and appeals on your account. We keep these to enforce the Terms of Service fairly and consistently, and they're deleted with your account unless the law or an open investigation requires us to keep them longer.
• Emails: your email address is used to confirm your account, reset your password, tell you about decisions on your posts, reports and appeals, and, unless you unsubscribe with the link in any of them, send a daily summary of what you missed. Emails are sent by Resend (a service provider).
• Usage events: a small set of product milestones, such as opening the app, starting signup, verifying your email, a first video playing, and the days you're active, so we can see where new people get stuck and fix it. They're stored in Kibhi's own database (no third-party analytics), aren't used for advertising, and are deleted with your account. Events from before you sign up carry no identifier at all.
• Invites: if you join through someone's invite, we record who invited you. They see only a count of friends who joined, not who.
• Comments and direct messages: what you write is stored so it can be shown to the people it's meant for, including photos, videos and files you send in a message (stored with Cloudinary, see Service providers). We also record when a message reaches the other person's app and when they open the conversation, and show that to the sender as delivery ticks. Site administrators can view comments and messages for moderation purposes (for example, responding to a report of abuse). Deleting a message you sent removes it for both of you; its file is deleted once no copy of the message (for example, a forwarded one) still uses it.
• Group chats and communities: the groups and communities you create or join, who is in them and who runs them, and the messages sent there, which every member can see. Group admins can add and remove people and delete messages in their group.
• Chat features: voice messages you record (stored as audio files); polls and events you create and your answers to them, which everyone in that chat can see, with your name; and whether you're in a chat, typing, recording or scrolling, and when you were last seen, shown only to the people you chat with. Turning off Last seen in Settings hides these, and hides other people's from you too. When a message contains a link, our server fetches that public page to show its title and picture as a preview, so the website sees our server, not you; previews are kept for a week.
• Location you share in a chat: only when you tap Send location. It sends where your device is at that moment (and an address, if your device can work one out) as a message to that chat, where it is stored like any other message. It is never shared live and never updated afterwards. On Android this uses the approximate location permission.
• Contacts you share in a chat: when you share a contact, the name and phone number you choose (or a Kibhi username) are sent as a message to that chat. On Android, picking from your contacts opens your phone's own contact list and reads only the one contact you pick. Only share someone's details if they're happy for you to.
• Forwarded messages: forwarding sends a copy of the message, and any file in it, to the chats you pick, marked "Forwarded". Deleting your copy doesn't delete copies already forwarded.
• Automatic safety checks: photos and videos in posts and in chats (direct and group) are checked automatically for nudity, sexual content, graphic violence and weapons before anyone else can see them, by Sightengine (a service provider) or by Kibhi's own model on our servers. Anything that fails isn't sent or posted. The pictures are sent to the checker only for this check, and never used for advertising.
• Kibhi AI: if you chat with Kibhi AI, what you write to it and its answers are saved to your account so the conversation carries on across devices (Clear conversation deletes them). To answer, your messages are sent to the company that runs our open-source AI model (Groq, a service provider), and a job search is sent to public job boards (Remotive, Jobicy, Remote OK, Arbeitnow, Adzuna) without your name. Kibhi AI can't read your email, send anything or apply to jobs for you, and your conversations aren't used to train AI models or for advertising.
• Job Autopilot: if you set it up, we keep the text of the CV you upload (not the file) and the job profile you fill in: the roles you want, your country and whether you can work there without a visa, other countries you may work in, your education, experience, skills and pay wishes. They're private to you and used only to find, score and write cover letters for jobs (the AI model sees them for that). Remove your CV any time in Job Autopilot; everything is deleted with your account. Kibhi never sends an application for you.
• Message requests: a message from someone you don't follow, and haven't written to, waits in your message requests. They don't see whether you've read it until you accept or reply, and photos or videos from people you don't follow stay covered until you tap them. We use who you follow and who you've written to only to sort this.
• Scanning and photo to text: Scan document and Photo to text read pages on your device (Google ML Kit on Android, your browser on the website). The pictures are not sent to us; only a document you then choose to send is uploaded, like any other file.
• Fingerprint login (Android): your fingerprint never leaves your phone and we never receive it. The app keeps a sign-in for that phone, locked behind your fingerprint by Android. It appears in Settings under Active sessions and ends when you turn fingerprint login off.
• Moments: Moments you post in Chats are shown to people for 24 hours, like stories, and then removed.
• Post views: when you view a post while logged in, your username is added to that post's list of viewers, which anyone who can see the post can open by tapping its view count. Views while logged out are only counted, not named.
• Activity status: while you're using Kibhi, people who are logged in see a tiny glowing Kibhi fox on your picture (on your posts and in messages). It goes away a few minutes after you stop.
• Cookies: a session cookie, a random token that keeps you logged in. If you open someone's invite link, an invite cookie also remembers their invite code for up to 30 days so your new account can be credited to them; it's removed when you sign up or log in. If the birthday given at signup is under 13, a kibhi_age_block cookie stops another signup from that browser for 30 days. None of these is used for tracking or advertising, and no other cookies are set by this app. Your answer to the cookie notice is remembered in a small kibhi_consent cookie (and your browser's storage) so it isn't asked again.
• Calls: when you start or join one, we store who was on it, when, and technical connection details needed to set the call up (see Calling below), never the audio or video itself.
• Push notification token: if you allow notifications, a token identifying your browser or device so we can send them. It identifies your device, not you personally, and is deleted if you turn notifications off.
• Advertiser payments: if you buy an ad through Advertise on Kibhi, payment is handled entirely by Stripe's own hosted checkout. Kibhi never receives or stores your card number; we only get confirmation that payment succeeded, plus the advertiser name and email you enter on the form.
• Removal requests (TAKE IT DOWN Act): if you ask us to remove an intimate image at kibhi.com/take-it-down, we keep your name, email, typed signature, your relationship to the person shown, the links and details you send, and what we decided, with a tracking number. We use them only to handle the request, contact you about it, and keep the record the law requires; they are seen only by Kibhi's safety team and, where the law requires (for example content showing a minor), shared with the National Center for Missing & Exploited Children or law enforcement.

How we use it

To run the app: show you the feed and pick what For You recommends, deliver comments and messages, connect calls, and show your own activity back to you. To keep accounts secure and enforce the Terms of Service, including automatic safety checks, reviewing posts, responding to reports and appeals, and telling you about decisions on your content. For sponsored posts, to show an advertiser how their post performed. We don't build advertising profiles from your activity, and we don't use your data for any purpose beyond what's listed here and in What we don't do below.

Calling

Video and voice calls connect your device directly to the other person's using WebRTC, the same technology behind most browser-based calling. Kibhi's servers help the two devices find each other but never see or store the call's audio or video. A side effect of how that direct connection works: when possible, each side's approximate network location (IP address) becomes visible to the other, the same as most peer-to-peer calling apps. Anyone with a confirmed account can call an adult who hasn't blocked them; people aged 13 to 17 can only be called by people they follow or already talk with.

Where it's stored

Kibhi's servers run on Render, behind Cloudflare. Account and post data lives in a Postgres database hosted by Neon. Videos are stored and served by Mux (or Cloudinary), and photos and chat files by Cloudinary. Sightengine checks photos and videos for harmful content (see Automatic safety checks). Resend sends our emails. Groq runs the AI model behind Kibhi AI (see Kibhi AI). Cloudflare also provides the relay server calls use to connect two devices, Google Firebase delivers push notifications on our native apps and texts the code that confirms a phone number, and Stripe handles payment processing. All are third-party infrastructure providers, not separate companies we share your data with for their own purposes. They host data or route a connection on our behalf, the same way any app relies on hosting and networking providers. Our infrastructure runs in the United States, so your data is processed and stored there regardless of where you use Kibhi from.

How long we keep it

We keep your account and content for as long as your account is active. Deleting a post removes it from the feed and your profile immediately, with the underlying file cleared out on our regular deletion cycle shortly after. Deleting your account deletes your data within a reasonable time, except where we're required to keep something longer, such as to investigate an open report of abuse or to comply with the law.

Promoted and sponsored posts

Kibhi shows paid posts, clearly labeled "Promoted" or "Sponsored," in the feed and, on a computer, beside it. Everyone sees the same promotions: we don't target ads using your activity, build ad-tracking profiles, use third-party ad networks or pixels, or give advertisers your personal information. Viewing or tapping a promotion is recorded as a view or click count, tied to the ad, not to your account. Advertisers are bound by our Advertising Terms.

Children's privacy

Kibhi is not directed to children under 13, and you must be at least 13 to create an account (see the Terms of Service). We don't knowingly collect data from anyone under 13. If we learn an account belongs to a child under 13, we'll delete it. If you believe a child under 13 has a Kibhi account, email the address below.

We ask for your date of birth when you sign up. If it shows you're under 13, no account is created; if the owner of an existing account tells us they're under 13, the account and its content are deleted straight away. For people aged 13 to 17 we switch on extra protections: the account starts private, only people they follow (or already talk with) can message or call them or add them to a group, they aren't suggested to people who don't already know them, and Near you (sharing your city) stays off.

What we don't do

We don't sell your data, use third-party analytics or ad-tracking scripts, or share your information with anyone beyond the hosting providers above.

Do Not Sell or Share My Personal Information: we do not sell personal information and do not share it for cross-context behavioral advertising, and have not in the past 12 months, including for anyone under 16. We honor the Global Privacy Control browser signal as an opt-out request. See Your privacy choices.

Your choices and rights

You can delete individual posts at any time. You can ask for a copy of your data, a correction to it, or to have your account and all associated data deleted entirely, by emailing the address below. California residents specifically have the right to know what personal information we collect and to request its deletion; as noted above, we don't sell personal information, so there's nothing to opt out of on that front. We won't treat you any differently for exercising any of these rights.

Changes to this policy

We may update this policy as the app changes. If we make a material change, we'll update the date at the top of this page. Continuing to use Kibhi after a change means you accept the update.

Contact

Questions about this policy: support@kibhi.com