Kohak AIBack to workspacePrivacy Policy
Kohak AI (the "Service") helps with writing, summaries, translation, explanations, and ideas. This policy explains how information is handled in the web service provided at kohak.app and clearask.site.
Text conversation history is stored in your browser. Generated images, videos, and their prompts are stored on Cloudflare. When you use live AI, your input and the recent conversation needed to generate a response are sent to the Kohak gateway and the configured AI provider. Kohak does not hold your card number. Stripe processes payments.
1. Information we handle
- Account information: the email address, authentication provider identifier, Clerk user identifier, and authentication or session information needed for Google or email sign-in.
- Usage information: operational metadata such as usage counts, features, models, response time, and errors. The gateway normally does not store conversation text as usage metadata.
- Conversation information: browser history and saved answers are stored in your browser in the current web version. Live AI requests process the input and recent conversation needed to generate a response.
- Payment information: Stripe processes payment card details for Kohak Premium. Kohak does not receive card numbers, but may retain customer, subscription, and billing status metadata.
- Technical information: infrastructure providers such as Cloudflare may process network information for delivery, security, rate limiting, and incident response.
- Analytics:On the production site, Google Analytics 4 measures visits, registration, successful AI use, trials and successful payments. We may associate cookie-based measurement identifiers with your account and send events, invoice identifiers, amounts paid and currency to Google. We do not send names, email addresses, prompts, conversations, authentication credentials or card details. Ad personalization is disabled.
2. How we use information
- Create accounts, provide sign-in, link accounts, and manage sessions.
- Generate AI responses, apply usage limits and fair-use controls, and investigate quality or incidents.
- Provide Stripe Checkout, subscription status, billing, cancellation, and the Customer Portal.
- Detect and prevent abuse, excessive automation, attacks, and policy violations.
- Improve the Service, respond to support requests, and send important notices.
- Understand aggregate usage of the production site without directly identifying individual users.
3. Third-party services
We use Clerk for authentication, Stripe for payments, Cloudflare for delivery and execution, and the AI provider configured for the Service for inference. The production kohak.app and clearask.site domains use Google Analytics 4 for page views and key funnel events. Staging, workers.dev, and local environments do not initialize analytics. Ad personalization is not configured. Information sent to external services, retention periods, and processing regions also follow their contracts, settings, and policies. Google’s privacy policy applies when you use Google sign-in or Google Analytics.
4. Browser storage and deletion
Conversation history, saved answers, and display settings are stored in local browser storage. You can export or delete them from Settings. To keep you signed in and keep your free session connected, the Service sets one first-party cookie (__Host-kohak_session; HttpOnly; valid for 60 days). It holds only a random value used to renew the connection and cannot be read by page scripts. It is not an analytics or advertising cookie. It stops working when you sign out, switch accounts, disconnect, or clear cookies, or after 60 days without use. Clearing browser data, changing devices, or using private browsing may remove history. Deleting an account, cancelling a subscription, and clearing browser history are separate actions.
5. Retention and security
Accounts, subscriptions, and operational logs are retained only as needed to provide the Service, meet legal obligations, resolve disputes, and prevent abuse. Conversation storage and retention depend on your browser and the configured AI provider. We use safeguards such as encrypted transport, authentication, access controls, and rate limits, but no internet transmission can be guaranteed completely secure.
6. Your choices
You can choose not to send a live AI request, delete browser history, delete your account, or cancel a subscription. For requests to access, correct, or delete personal information, contact the support email shown in the Google sign-in consent screen. Identity verification and legal retention obligations may limit or delay a request.
7. Changes
We may update this policy when features, external services, or legal requirements change. We will communicate material changes on this page or through the Service.
8. Image and video generation
Image and video prompts are sent through the Kohak gateway to OpenRouter and the selected model provider. Generated files are saved in private Cloudflare R2 storage; prompts, ownership, and status are saved in a Cloudflare database. They are retained until you delete them from History or Settings. A valid owner session is required to retrieve or delete files. Signed-in users can retrieve them through the same account. Guest media belongs to the guest session and may become inaccessible if that session is lost before signing in. Clearing browser data does not delete server copies. Videos continue processing and saving on the server after you leave. After deletion, usage and cost metadata without prompts or generated files is retained for allowance and cost controls. Provider retention and processing regions also depend on their contracts, settings, and policies.
9. Sharing answers
When you share an answer, the question, the answer, the displayed model name, and the share date are contained in the URL itself (after the “#”). This content is not sent to or stored on Kohak servers and is not sent to analytics. Anyone who receives or is forwarded the URL can read it. Because nothing is stored, a shared URL cannot be revoked later. Check for personal or confidential information before sharing.
10. Google Calendar and Gmail connections
If you authorize a connection, we retrieve and display the selected service's event titles, times, locations and notes, or email senders, recipients, subjects and bodies, in response to your actions. Creating events or sending email requires additional permission and a review of the exact details before execution. Attachments and background bulk synchronization are not included.
Google OAuth tokens are handled server-side through Clerk and are not stored in Kohak's database or persistent browser storage. We store the connected account identifier, email address, enabled features, and action hashes, states and result identifiers to prevent duplicate execution. The reviewed contents themselves are not stored on our server. Unexecuted confirmations expire after ten minutes; action records older than seven days are removed when another confirmation is prepared.
Calendar and email data is not automatically sent to AI. Only content you choose to add to your message and then explicitly send goes to Kohak and the configured AI provider. This import feature is limited to routes enforcing zero data retention and no data collection. Selected content becomes part of ordinary drafts or browser conversation history and may be preserved as a draft during the Google consent redirect. Unselected displayed content is cleared when the dialog closes or the account changes.
We do not use information obtained from Google APIs for advertising or training general-purpose AI models. Our use and transfer follow the Google API Services User Data Policy, including Limited Use. Disconnecting in Settings stops Kohak's access to that feature. You can also revoke Google's authorization in your Google account connections.
Memory, web search and encrypted backups
Memory and response preferences you edit are stored in this browser and sent with text questions to the AI provider. Nothing is remembered automatically. Web search is optional for each question: only that question goes to the AI provider and Exa through OpenRouter, without earlier turns, memory, response preferences or Google connections. Any private information you type in the question is included.
Signed-in users can manually save and restore text history, memory and response preferences. The browser encrypts the backup with a passphrase before storing it in Cloudflare under your account. The passphrase and decryption key are never sent or stored. A lost passphrase cannot be recovered. The cloud copy remains until deleted in Settings. Deleting local history or memory does not update other devices or existing backups; delete the cloud copy or save an updated backup. This encryption does not cover normal AI processing or generated images and videos.