Privacy Policy

Last updated: November 10, 2026

This Privacy Policy explains what information kikifonts collects when you use kikifonts.com and app.kikifonts.com (together, the "Service"), how we use it, and the choices you have. kikifonts is operated by the individual behind it ("kikifonts", "we", "us" or "our"), who is responsible for your information.

1. In short

• Your videos and their sound are stored and processed on our own server. Only the text of what is said in them goes to a language model, to choose which words your captions stress.
• We count visits ourselves: no third-party analytics, no advertising or tracking cookies, and no IP addresses kept for statistics.
• We do not sell your personal data and do not use it for advertising.

2. What we collect

• Your account. Your email address. If you sign in with Google, also the name and the link to the profile picture of your Google account, and the keys Google gives us for your sign-in. A guest has no email address, only a random identifier.
• Your videos. The videos you upload, exactly as they are, including what your phone wrote into the file (such as when and, if your phone recorded it, where the video was filmed); their names and sound; a still frame; the words heard in them and your fixes; the style, place and size of your captions; a lighter copy for the editor; and the videos you save, which keep the same information as your original.
• Sign-in and security. For each device you sign in on, its IP address and browser, kept with your session.
• Payments. Your plan, its status and dates, and records of your payments, from Polar. We never receive your card details.
• Usage statistics. Which pages and screens are opened and what is done in the Service: see section 6.
• Bug reports. What you write when you report a bug in the app, the photos you attach (as they are, with what your phone wrote into them), and your browser, screen size and language.
• Messages to us. Whatever you write to [email protected].

3. How we use it

• to provide the Service: sign you in, hear the words of your videos, make your captions and save your videos;
• to take payments and keep your plan;
• to send the emails the Service needs: your sign-in codes, and the code that confirms deleting your account;
• to keep the Service safe and working, and to fix what breaks;
• to understand which parts of the Service are used, so that we can improve it;
• to answer you, follow the law and enforce our Terms.

If you are in the European Economic Area or the United Kingdom, our legal bases are: our contract with you, to provide the Service and take payments; our legitimate interests, to keep the Service secure, fix it and understand how it is used; and the law, where it requires us to keep records.

4. Your videos and AI

Your videos are stored and processed on our own server. The words are heard by a speech recognition model that runs there, and your captions are drawn there; your video and its sound never leave it.

To choose which words your captions stress, we send the text of the words heard in your video, without the video, its sound, your name or your email address, to a language model: Anthropic's Claude, through OpenRouter. We send it for this and nothing else.

We do not use your videos or their words to train AI models. Nobody looks at your videos unless you ask us to, to fix a problem.

5. Who processes data for us

• Cloudflare carries all traffic between you and our server, encrypting and protecting it, so it handles what passes through it, including your IP address. It also tells us which country a visit comes from. Its Turnstile checks, invisibly and with no puzzle, that a person and not a bot makes a video or asks for a code; your interaction with Turnstile is also governed by Cloudflare's Turnstile Privacy Addendum.
• OpenRouter and Anthropic receive the text of the words heard in your videos, to choose the words your captions stress (section 4).
• Resend sends our emails: it receives your email address and your code.
• Google signs you in, if you choose "Continue with Google".
• Polar sells our plans as the merchant of record: it takes your payment, handles taxes and sends your receipts, under its own privacy policy. We give Polar your email address and our identifier for your account.
• Telegram carries notes to our team: a new visit (only its country, the page it came to and where it came from: a search engine, a site or an app, never its address), problems and errors of the Service, and, when we turn them on, a new or deleted account or a payment with its email address.

We may also disclose information if the law requires it, to enforce our Terms, or to protect the safety of the Service and the people who use it.

6. Cookies and statistics

We use only the cookies the Service needs, all of them our own:

• the sign-in cookies of app.kikifonts.com, which keep you signed in, as a guest too, for 60 days after your last visit, and a short-lived one that protects signing in with Google;
• signed_in, for a year: that you are signed in, as a guest or with an account, so that our site can say "Open app" instead of "Sign in". It does not say who you are;
• NEXT_LOCALE, for a little over a year: the language you chose;
• in-app, until you close your browser: that you opened the app inside another app's browser (such as TikTok's or Instagram's), so that we can show you how to open it in your phone's own browser;
• no-stats, for a little over a year, and only if you ask us not to count your visits.

We use no advertising cookies, no third-party tracking cookies and no third-party analytics.

Statistics. We count visits ourselves, on our own server, without cookies: for one day a visitor is recognised by a code made from the IP address and the browser together with a secret key, and that key is deleted two days later. The IP address itself is not stored. With a visit we keep its country, the kind of device, system and browser, the browser's first three languages, its time zone, the page it came to and the site that sent it. Inside the app the statistics are linked to your guest or your account, so that we can see where the Service works and where it does not: they move to your account when you sign up and are deleted with it. A guest's statistics stay after the guest is deleted, no longer linked to anyone. We use statistics only to improve kikifonts, never for advertising, and share them with no one. They are kept for 25 months.

Our legal basis is our legitimate interest in understanding and improving the Service. You can object at any time: don't count my visits. This sets the no-stats cookie in this browser.

7. How long we keep it

• A guest is deleted with its videos a day or two after its last visit.
• Your videos (the ones you upload, their words and what is made for the editor) stay until you delete the video or your account.
• The videos you save are kept for 30 days, or until you save that video again. Keep your own copy.
• Your account stays until you delete it, in the app under Me. That deletes at once your account, your sessions, your videos and their files, the count of your videos for each month and your statistics, and ends your subscription with Polar.
• Backups of our database are made every night; what you delete is gone from them within 30 days. Videos are not in our backups.
• Server logs are kept for 14 days.
• Bug reports stay after your account is deleted, no longer linked to you. Write to us to have one deleted.
• Payment records stay, no longer linked to your account, as accounting requires. Polar keeps its own records under its policy.

8. Your rights

You can delete any of your videos, and your account, in the app. To see or get a copy of your information, to correct it, or for anything else about it, write to us at [email protected]; we answer within 30 days.

Depending on where you live (for example under the EU and UK GDPR, the California CCPA/CPRA, Brazil's LGPD, Korea's PIPA or Japan's APPI), you may have the right to access, correct, delete or receive a copy of your personal data, to restrict its use or to object to it. We will not treat you differently for using these rights. If you are in the EU or the UK, you can also complain to your data protection authority.

9. Security

Your connection to the Service is encrypted, our server is reachable only through Cloudflare's encrypted tunnel, and only we can reach the data on it. No online service is completely secure, however, so we cannot promise absolute security.

10. International transfers

We and the providers above work in different countries; Resend, Google, OpenRouter and Anthropic, for example, in the United States. Your information may therefore be processed outside the country where you live, where data protection laws may differ from yours. By using the Service you understand that it is.

11. Children

The Service is not for anyone under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, write to us and we will delete it.

12. Changes to this policy

We may update this policy. When we do, we change the date at the top of this page and, for important changes, let you know in the Service or by email.

13. Contact

Questions about your privacy or this policy? Write to us at [email protected].