Privacy Policy

1. Introduction

This Privacy Policy explains what personal data Fly-by-wire AB (“we”, “us”), a company registered in Sweden, handles in Koru, why, for how long, who else gets it, and what you can do about it. It covers:

• the Koru app for macOS, its test builds for Windows and Linux, and its command line tool;
• Koru Cloud: your account, sync between your devices, boards on koru.codes and in the iPhone app, the Mirror, quick chat and the GitHub app;
• Koru hosting, which runs the apps you deploy;
• Koru Analytics, which measures the apps you build (together, the “Software”).

In short: your vault (secrets, context files, documents, and your hosting and analytics keys) is end-to-end encrypted: we store it only as ciphertext we cannot read. What you share with your team (projects, boards, cards, comments and attachments), your notes and your devices are stored readable, so they open in a browser, can be searched and reach the people you invite. The Koru app sends usage counts and crash reports only if you turn them on. We don't show ads, and we don't sell or share data for marketing.

2. Data Controller

The data controller for the purposes of the GDPR and other applicable data protection laws is:

Fly-by-wire AB
Email: support@flybywire.se
Website: https://flybywire.se

For the personal data inside the apps you run on Koru hosting and measure with Koru Analytics, the people who use your apps are yours: you decide what is kept and why, and we process it on your behalf, to run and measure your apps (sections 3.13 and 3.14). Questions from your apps' users go to you first.

3. What Data We Collect

3.1 On your device

Without Koru Cloud, your projects stay on your device. Koru keeps them in a vault database: the contents (secret values, context files, notes, chats and documents) are encrypted with AES-256-GCM before they are written to disk; names, keys and descriptions are stored as they are. The encryption key is made on your device and kept in the macOS Keychain (on Windows, the Credential Manager; on Linux, the Secret Service). Koru keeps the last ten copies of the vault database as backups.

Some files on your device are not encrypted: your settings and the folders of your projects and worktrees; the last output of each terminal tab (up to 256 KB), so Koru can bring your tabs back after a restart; a copy of your boards; and a log of terminal events, never their content. To warn you when a secret was exposed, Koru reads your Claude Code transcripts on your device; they are never sent anywhere.

We cannot read or recover what is encrypted. If you lose your device, its keychain or your passphrase, encrypted data becomes permanently unrecoverable. We do not hold your encryption keys or passphrase and cannot assist with recovery. Please refer to our Terms of Service for your data responsibility obligations.

3.2 Your Koru Cloud account

Anyone with a Koru Cloud subscription can check whether an email address has a Koru account, which returns its account id and public key, so they can invite that person and share a vault with them; such checks are limited to 60 an hour.

3.3 The vault: end-to-end encrypted

Your secrets, context files, documents and their files, and the keys of your hosting (variables, database connections, bucket keys) and of your Koru Analytics apps are encrypted on your device with your project's vault key before they are uploaded. The vault key is encrypted for each member so that only that member's own passphrase can open it, through a key made from it with PBKDF2-SHA-256 (at least 600,000 rounds); the passphrase never leaves their devices. We store the ciphertext, the encrypted keys and a check that lets your passphrase confirm itself; we cannot derive your passphrase or read your vault. An item you delete leaves its ciphertext behind until its project is deleted.

Adding a browser or phone to your account works by pairing: after you approve its code on a device you are signed in on, your key is sent to it encrypted for that device alone.

3.4 Projects, boards and notes: stored readable

Since August 2026, what you share with your team is stored readable, so it opens in a browser without your passphrase, can be searched, and can be shared with the people you invite:

• Projects: name, description, icon and key.
• Boards: columns, tags, and cards with their title, description, checklist, links, priority, due date and assignee; what an agent records on a card (the repository, branch, commit and pull request it worked in, its progress, its name and the model it reports), and who claimed it, on which device; comments and the project's activity.
• Attachments: files of up to 25 MB on cards and comments.
• Notes: stored readable so you can edit them in a browser, and served only to you, whatever anyone else's role.

The members of a project see its content according to their role, and so do the agent tokens made for it. Anything that must not be readable belongs in the vault.

3.5 Your devices

A device signed in to Koru Cloud tells your account its name and nickname, platform and app version, when it is online, the projects it can start cards for, the full folders and branches of the projects you sync on it (a folder can include your user name on that computer), which cards have a tab open on it, and how it is kept awake, by you and by agents. The commands you send it from elsewhere, such as opening a tab in a folder, are kept too. This is stored readable, which is what lets you start a card, open a tab or keep a Mac awake from the web. The members of a project see your device's name on the cards you claim.

3.6 The Mirror

The Mirror lets you watch and type into your terminal tabs from your browser or phone. It is on by default for signed-in devices with a subscription, and you can turn it off in Settings, Cloud. Your device publishes a description of each open tab (its title, folder, project and card, size, whether it is busy, the program in front and its progress); when one of your browsers or phones attaches, it sends up to 256 KB of the tab's recent output, then its live output, and receives what you type. All of it is encrypted with keys made from your own key, so our relay passes it on without being able to read it, and stores none of it. The relay sees only ids, sizes, timing and the labels of the attached browsers and phones. Attaching needs a fresh authenticator code, valid for 12 hours.

3.7 Quick chat and AI models

Quick chat: with Koru Cloud, your conversation and the model you pick go through our server to Anthropic, which answers it. Our server keeps none of the conversation; it records the model, the number of tokens and the cost of each turn, to count your weekly allowance. With your own Anthropic key, your device talks to Anthropic directly. Either way, your chats are kept only on your device, encrypted, and never synced.

Models in your terminal: Koru can send Claude Code's requests to the AI provider you choose (for example Anthropic, OpenAI, OpenRouter, MiniMax, Z.ai, Moonshot, DeepSeek or your own endpoint), with your own key. They go from your device to that provider, not through us, and that provider's terms and privacy policy apply. Koru also fetches the providers' lists of models, and runs your own Claude Code to show your usage.

3.8 GitHub

If you install the Koru GitHub app, we keep its installation and your GitHub account's name, and receive GitHub's notices about your repositories. For each commit or pull request that names a card, we keep its repository, commit or number, link, the first line of its message or its title, its state, and its author's GitHub name or git name, who may be someone outside your team. These links stay after you uninstall the app, until the project is deleted. To build an app on Koru hosting from GitHub, we use read access to that one repository, for an hour at a time.

3.9 Emails we send

We send email through Resend: sign-in links and confirmations; invitations, sent to the invitee and naming the inviter's email address and role; an alert when your vault is opened on a new browser or phone; warnings before cloud data is deleted, and the notice that it was; and the hosting and analytics alerts you ask for (the app, what happened, and counts, never the content of errors).

3.10 Feedback

If you send feedback from within Koru, we receive the message you write, the app version and a random identifier made for feedback on that device, never your Koru Cloud account. It goes to our license server, and to the team by email. We use the identifier to tell feedback from the same device apart and to limit it to ten messages a week. We may publish a suggestion on our public roadmap in your words, without anything that identifies you, so don't put personal information in feedback. Earlier versions of Koru sent the device's hardware identifier in place of the random one.

3.11 Subscriptions and payments

Koru Cloud and Koru hosting are paid through Stripe, which collects your payment card and billing details under its own privacy policy. For Koru Cloud, our license server keeps your email address, your Stripe customer and subscription ids, the plan, its status, when the period ends and whether it is cancelled, and Koru Cloud checks your subscription with it by your email address. For hosting, we keep your card's brand, last four digits and expiry date, and your invoices, which name your apps and environments. We never see your full card number.

3.12 Updates

Every few minutes the Koru app reads the list of its releases from our file server. The request carries no identifier, but the server sees your IP address. A new version downloads only when you choose to install it.

3.13 Koru hosting

When you deploy an app with Koru hosting, we keep and run:

• the source you upload (up to 200 MB), only until its build ends, and for each build its repository, branch, commit, the first line of the commit message and its author;
• the images we build, in our registry, until you ask us to remove them;
• your app's variables: encrypted on your device or in your browser to our servers' key, and opened only by the servers that run your app; our account server keeps their names and ciphertext;
• your databases, disks and buckets, on encrypted volumes and storage, and their backups, encrypted before they leave our servers: a file deleted from a bucket leaves the backups within 40 days, and each backup of a database or disk is kept for 30 days, what it held staying in the backup store at least 35 days after that;
• your app's logs, which we pass to you as they happen and which stay on the servers that run it until they are replaced;
• your domains, and the certificates we get for them from Let's Encrypt, which publishes every certificate's domain names in public logs;
• your usage, invoices and alerts, and graphs of your usage for 30 days.

The people who use your app reach it with their IP address, which your app sees. What your app keeps about them is yours (section 2). Our operators have access to the servers that run your apps; they use it only to keep Koru hosting running, to fix problems, or when the law requires.

A watcher, if you turn one on for an environment of your app, reads that environment's logs and request lines as they happen and alerts you when something looks wrong. Before anything is kept or leaves our cluster, the values of your app's variables that are 8 characters or longer, numbers, identifiers, network addresses, email addresses, tokens and quoted text are taken out, and like lines are folded into patterns; a shorter value can stay in a pattern. The patterns, their counts and the instances' states, with the names of the app and the environment and when it was last deployed, go to Anthropic, which runs the AI model that judges them. Anthropic keeps nothing after answering, unless the law requires it or its safety systems flag it, and then for up to two years. While the watcher is on we keep the patterns it has found, each with when it was first and last seen, the last hour's counts and the week's usual counts, never the lines themselves. Turning it off deletes them from our cluster; the copies in our cluster's backups go when those backups are deleted. For each time the model was asked we keep when, which model, its verdict and the tokens it used, for 90 days. Its terms are in Privacy for Koru hosting, section 5.

3.14 Koru Analytics

Koru Analytics counts how the apps you build are used and how well they run. From each app it receives the events your app's plan allows, with their values; sessions; logs; and reports of errors, crashes and hangs, whose details are encrypted on the device to your key, so only you can read them. With them come the app's release, the operating system and its version, the kind of device, the region (taken from the device's language settings, never from its address), the language, and the campaign tags and referring site of a visit.

It keeps no identifier of a person or a device, no IP address and no user agent: an IP address is used only in memory, under a key that changes every day, to limit abuse. Hourly counts are kept 35 days, daily counts 25 months, samples 90 days, logs 14 days, and each problem until 13 months after it was last seen. You, the read tokens you make and our operators (for the health of the service only) can read it. Its website code keeps its state in the browser's storage and sets no cookies.

3.15 Koru's usage counts and crash reports

Koru uses Koru Analytics to count how it is used and to learn what goes wrong, and only if you allow it. It asks once, with two switches, Share usage counts and Send crash reports, both off until you turn them on, and keeps both in Settings, Privacy, where you can turn either off at any time. Nothing is sent before you answer.

Usage counts cover sessions (when Koru is opened and for how long, and whether this device opened it earlier the same day, week or month) and these events: app updated, cloud sync changed, context created, feedback sent, integration connected, note created, setting changed, terminal opened, theme imported, theme saved and worktree created. Crash reports cover crashes and errors, and one log line: a failed sync. They come with Koru's version, the kind of device, its system and system version, and the region and language set on it.

Nothing sent is tied to your name, email address, account or any id for this device, and your network address is never stored. Each report holds what went wrong, the parts of the code involved and the last few things done in Koru before it, with the device's model. Reports can contain parts of error messages, so they are encrypted on your device, as log lines are, and can be read only by Koru's developers, and by an AI coding assistant and its provider when they ask one to read them. Koru never sends your secrets, notes, context files or documents, or anything in them; anything typed or shown in a terminal; the names of your projects, folders, files and branches, or of the themes you make or import; or your Koru Cloud account, its email or any id for this device.

Counts are kept for up to 25 months, reports for 90 days and log lines for 14 days. The title of each kind of problem, which says what went wrong and where, is kept with that problem's counts until 13 months after it last happened. Backups keep all of these for up to 30 days more. Because nothing is tied to a person, one person's data cannot be found or deleted on its own: it is deleted when these periods end.

3.16 What we don't collect

• No analytics or usage data from the iPhone app, and none from the Koru app unless you allow it (section 3.15). Earlier versions of Koru could send usage data to our license server if you opted in; it no longer accepts it, and what it received has been deleted.
• No advertising identifiers and no location data.
• No IP addresses on our account server, except briefly in memory to limit sign-in attempts.
• No cookies on koru.codes: the web app keeps your session, your key (sealed with your passkey) and your hosting alerts in your browser's storage.
• No readable copy of your vault, ever.

4. How We Use Your Data

We do not use your data for marketing, profiling or automated decision-making, and we do not sell, rent or trade it.

5. Data Sharing

The members of your projects see each other's email address, display name and colour. Beyond them, these services handle data for us:

6. Data Retention

When a subscription ends: sync stops, and we email you when your cloud data will be deleted, and again 30 days and 7 days before. 90 days after the subscription ended we delete the projects you hold alone, with their vault and boards, and your Koru Analytics apps, and remove your agent tokens, devices and memberships. Projects you share stay for their other members. The copies on your devices are never touched.

To delete your account, write to support@flybywire.se; we delete it and what it holds that no one else shares.

7. Data Security

• On your device: vault contents encrypted with AES-256-GCM, with the key in your device's keychain.
• The vault: end-to-end encrypted; each member's key is wrapped with a key made from their passphrase (PBKDF2-SHA-256), which never leaves their devices.
• Two-factor: an authenticator code before sensitive actions, such as attaching to your terminal through the Mirror.
• In transit: all communication with our servers uses HTTPS and secure WebSockets.
• Hosting: encrypted disks, databases and storage, and encrypted backups.
• Payments: handled by Stripe, a PCI DSS Level 1 certified processor.

No method of storing or sending data is completely secure. If a breach puts you at risk, we will tell you and the authorities as the law requires.

8. Your Rights

Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, to object to processing, and to withdraw consent. EU/EEA users have these rights under the GDPR and may lodge a complaint with a supervisory authority (in Sweden, Integritetsskyddsmyndigheten, https://www.imy.se). California residents have rights under the CCPA, including to know, delete, and opt out of sale (we do not sell personal information). To exercise any right, email support@flybywire.se and we will respond within 30 days or as required by law. If you use an app someone runs on Koru hosting or measures with Koru Analytics, contact its maker first.

9. International Transfers and Children

We keep your data in the EU: in Sweden, and for hosting and analytics in Germany. Resend, Anthropic, GitHub, Stripe and Let's Encrypt are in the United States; for what they receive, we rely on the EU-U.S. Data Privacy Framework where the company takes part in it, and otherwise on Standard Contractual Clauses. Koru is not directed at individuals under 16, and we do not knowingly collect data from children.

10. Changes and Contact

We may update this Privacy Policy from time to time; updated versions are posted here with a revised date, and we will make reasonable efforts to notify users of material changes. For any question about this policy or your data, contact support@flybywire.se.