Your circle can see your posts. Nobody else can.

1. Who this covers

Koh is an iPhone app for private feeds, called circles. Whoever starts a circle is its host. They invite family or friends, and anyone in the circle can post. Koh is made by one person. It's open source, and it isn't a business built on your data.

Every circle is stored on a server, and the host picks which one:

• Koh's server. We run it, and this policy covers it fully.
• Your own server. A computer at home, a friend's server, or one you rent. We don't run it and can't see it. Whoever runs it can see the same things listed in section 3, and nothing more, because the app encrypts the same way on any server.

"We" means the person who makes Koh and runs Koh's server.

2. What's encrypted

Posts, photos, videos, captions, comments, chat messages, shared links, people's names and profile photos, circle names, and the text of notifications are encrypted on the phone before they leave it. The keys exist only on the phones in the circle and in the sealed backups described in section 4. The server that stores a circle, and the relay that passes on its notifications, can't read any of it, and neither can anyone who broke into them.

The app removes a photo's location data before encrypting it. The circle stores smaller copies of photos; originals stay on the phone they came from.

Under the hood: posts are sealed with ChaChaPoly, each under its own key, and the circle's keys travel phone to phone sealed with HPKE. The app is tested against a dishonest server. The code and the full list are on GitHub.

3. What the server knows

Encryption hides what's in a post, not that it exists. To run a circle, its server keeps the encrypted content, and:

• which phones belong to which people in which circle, each person's role, and their public keys;
• who posted each post and uploaded its photos and videos, and when;
• roughly how big each photo, video, and piece of text is (sizes are padded, so only roughly);
• a numbered log of the circle's changes and acknowledgments, encrypted, with each entry's size, time, and sending phone, and how far each phone has caught up;
• each request to join, add a phone, recover a circle, or come back, and when it was let in, and who was removed, and when;
• that someone in the circle sent a chat message, liked, commented on, took a screenshot of (unless the host turned screenshot notices off), or reported a post, and when, but not who: comments, chat messages, and likes are sealed so only the circle can open them, and screenshots and reports so only the host's phones can. Right after a key change only a few phones may have caught up, which can narrow down who;
• who to notify about each of those, which can give the author away: a reply tells the server who wrote the comment it answers, and a comment that doesn't notify the post's author is the post author's own;
• the reason for each report, and for serious reports sent to us, who reported it and who posted it;
• whether the host turned on Only you post, and which uploaded files newer posts and comments use;
• a sealed backup of the host's keys that only their recovery code opens;
• that two circles on the same server share a phone;
• each phone's notification address from Apple.

A server also sees each connection's IP address and timing as it happens. Koh's servers don't log requests or keep a record of who connected from where, and they don't run any tracking or analytics.

Notifications go through a small relay that holds the app's Apple push key. It sees a phone's notification address, an encrypted message, and the IDs it needs to route it (the circle, the item, and the circle's key number), and keeps none of them.

4. On your phone

There are no accounts or passwords. Each phone makes its own keys and signs its requests with them; requests that don't say who (section 3) are signed with a key the whole circle shares. When the app is first set up, it asks Apple to confirm it's the genuine app (App Attest); Apple doesn't learn anything about your circles from this.

If you use iCloud Keychain, the keys that open your circles sync to your other Apple devices through it, end-to-end encrypted by Apple. A host also gets a recovery code, which opens a sealed backup on the server: the host's keys as of the day the code was made. Keep it safe: whoever has it can read the circle up to that day. If a host loses every phone, their iCloud Keychain, and the code, nobody, including us, can take the host's place, though people still in the circle can still open it.

5. Subscriptions

Hosting a circle on Koh's server is a subscription bought through Apple. Apple handles payment, and we never see your name, Apple Account, or card. The server learns which plan you have, whether it's active, its Apple transaction ID, and how much storage your circles use. The subscription is tied to a separate key on your phone, so it isn't linked to your Apple Account on our side.

People who join a circle don't pay and don't share any of this.

6. Reports

Reporting a post, comment, or message to a circle's host tells the host which one and why, and the host can already see it.

Serious reports also come to whoever runs the circle's server: us, on Koh's server. Your phone sends us that one post or message with its photos and anything you write, encrypted so only our phone can open it. The caption and the poster's identity are signed, so we can check those are real; photos arrive as the reporter's phone sent them. So we can check that signature, your phone also sends the circle's signed list of people, which gives each person's ID and the name the host invited them by. We see nothing else from the circle, and the names people give themselves stay encrypted.

We use a report only to handle it, and delete what your phone sent once the report is closed. We keep a note of what we did, and the host is told what we did, but not who reported it or what it said. Reports of sexual content involving a child are the exception: the law requires us to report them to the National Center for Missing & Exploited Children (NCMEC) and to keep what was sent for a year, then we delete it.

You can also write to us. Then we see only what you choose to send.

7. Other companies

A few companies help run Koh. None of them can read what's in a circle.

• Apple delivers notifications, confirms the app is genuine, and handles subscriptions. If you've chosen to share app analytics with developers in your iPhone's settings, Apple also sends us crash reports, which don't include what's in your circles.
• DigitalOcean hosts Koh's server, and its backups, in the United States.
• Railway hosts the notification relay. Only servers talk to it, never your phone.
• Cloudflare carries traffic to joinkoh.com and sees visitors' IP addresses to do it.
• Vercel hosts this website's pages. It gets requests from Cloudflare, not from you.

We'll only hand over data when the law requires it, and the server only has what's in section 3.

When you share a link, your phone fetches the page's title and picture once, so that website sees your phone's IP address the way it would if you opened the link. Everyone else gets the preview from inside the circle.

8. This website

joinkoh.com sets no cookies and runs no analytics or third-party scripts. Pages are delivered through Cloudflare, which processes your IP address to do that.

9. Leaving and deleting

Anyone but the host can leave a circle from the app (People › Leave this circle), once every phone they have in it agrees or is removed. That deletes their comments (with any replies), chat messages, and likes from the server, and the circle from their phones. Their name and posts, with those posts' comments and likes, go once all their phones have checked in or the host's phone finishes the leave, and the server keeps only a record with no name. The host's phone then deletes their screenshot records. Reports they made stay: the server can't tell which reports to the host were theirs, and reports to us are kept as described above.

A host can delete the whole circle (People › Delete this circle). That freezes it at once, so nobody can post, and any of the host's phones can cancel for 3 days. After that, the next of the host's phones to open Koh finishes it: every post, photo, comment, name, and recovery backup is deleted from the server, and what's left, people and phones by ID and the encrypted log a phone that's behind needs to catch up, goes after 90 days. If none of the host's phones comes back, the circle stays frozen and isn't deleted.

Koh's server is backed up daily, and each backup is kept for a week, so deleted data can stay in a backup for up to seven days before it's gone for good. Backups hold the same encrypted data as the server, nothing more.

If a subscription to Koh's server ends, its circles become read-only and stay on the server until the host deletes them or subscribes again.

10. Children

Koh is for adults sharing with the people they choose. It isn't meant to be used by children under 13, and we don't knowingly collect anything from them.

11. Changes

If this policy changes, the date at the top changes too. If something important changes, we'll say so in the app.

12. Contact

Questions about privacy: hello@joinkoh.com. There are no accounts, so we can't tell from an email which data on the server is yours; to delete it, leave the circle or delete it in the app. For a circle on someone's own server, contact the person who runs it.