1. Information handled by the App
Koto may handle the following information when you use the relevant feature:
- Task, list, recurring-task, completion-history, comment, and group information that you enter
- Photos that you choose to attach to tasks, comments, or your profile
- Your name, email address, and account identifier received through Sign in with Apple or Google Sign-In
- A device identifier and push-notification token used for synchronization and notifications
- Subscription product, purchase, and entitlement information supplied by Apple App Store or Google Play
- App settings and notification preferences
An account is optional for the core local task-management flow. Without sign-in, task data is stored primarily on your device and is not synchronized to our servers.
2. How we use information
We use information only to:
- Provide task management, comments, photos, reminders, and private group sharing
- Authenticate your account and synchronize data across authorized devices and group members
- Deliver task and group notifications that you enable
- Verify purchases, restore subscriptions, and provide paid features
- Maintain the security and reliability of the service and respond to support requests
We do not sell personal information. We do not use Koto data for third-party advertising, profiling, or cross-app tracking.
3. Storage and synchronization
Koto follows a local-first design. Local data remains on your device unless you use account, synchronization, sharing, attachment, notification, or purchase-verification features that require communication with our services.
When cloud features are used, relevant account and App data is transmitted using encrypted HTTPS connections and stored by infrastructure providers acting on our behalf. Shared-list content is available only to members of the private group selected in the App.
4. Service providers
The App uses service providers only as needed to operate requested features:
- Apple and Google for authentication
- Apple App Store and Google Play for subscription billing
- Firebase Cloud Messaging for push notifications
- Hosting and storage providers for account, synchronization, and attachment services
These providers process information under their own terms and privacy policies. We do not authorize them to use Koto content for advertising.
5. Permissions
- Photo access is requested only when you choose to add or change an image.
- Notification permission is requested when a feature needs reminders or shared-group notifications.
- Koto does not require precise location, contacts, or microphone access for its task-management features.
6. Data retention and deletion
You control the content you create in Koto. You can delete individual tasks, lists, comments, photos, and other App content from within the App.
You can delete your account and associated server-side account data in Settings > BitFlap account > Delete account. You can also use the full-data reset in Settings to remove local App data. Uninstalling the App removes data stored locally by the App from that device.
If you cannot access the App, request account or data deletion by emailing support@bitflap.app from the address associated with your account. Include "Koto data deletion" in the subject. We may ask you to verify account ownership before deletion.
7. Children
Koto is not directed to children under 13. The Google Play listing is configured for adults aged 18 and over. We do not knowingly collect personal information from children under 13.
8. Security
We use encrypted transport, authentication tokens, access controls, and time-limited signed URLs for attachment transfers. No system can guarantee absolute security, but we take reasonable measures to protect information.
9. Changes to this policy
We may update this policy when the App or legal requirements change. The current version and effective date will be posted at this URL.
10. Contact
- Email: support@bitflap.app
- Web: https://bitflap.app/contact/
BitFlap