Kite AI — Privacy Policy

Last updated: 15 November 2026

1. What Kite AI is

Kite AI is a multi-provider AI chat client. You bring your own API key from a provider you already use (Anthropic, OpenAI, Google AI, OpenRouter, Together, Groq, etc.) and the app sends your prompts directly from your device to that provider’s HTTPS endpoint. Tiny Kite Ltd does not run any backend that processes, stores, or relays your conversations.

2. What stays on your device

• Conversations. Every message, draft, and saved prompt is stored in encrypted local storage (Hive on iOS / Android, encrypted with platform Keystore-protected keys). Nothing is transmitted to Tiny Kite Ltd.
• Provider API keys. Keys you enter in Settings are stored exclusively in your device’s secure enclave (iOS Keychain / Android Keystore). They are never sent anywhere except, in plaintext over HTTPS, to the matching provider’s API endpoint when you send a message.
• Voice dictation audio. Speech-to-text runs on-device using Apple’s Speech framework on iOS / iPadOS / macOS, and Android’s local recognizer on Android. Raw audio never leaves your device. The recognized text — which you have a chance to edit before sending — is sent only when you send the resulting message.

3. What leaves your device, and where it goes

When you send a message, two kinds of payload travel directly from your device to the AI provider you chose, over HTTPS:

1. Your prompt (text, plus any photos you attached).
2. Recent conversation context the model needs to answer coherently.

Both go to the provider, not to Tiny Kite Ltd. We do not see, log, proxy, or have any record of these requests. Each provider’s privacy policy governs what they retain on their side. As a general rule, mainstream API providers retain prompts and responses transiently (typically up to 30 days for abuse monitoring), unless you have arranged a zero-retention agreement with them yourself.

Image attachments are full-resolution (downscaled by the app only when a provider’s payload limit demands it) and travel inline in the same HTTPS request as the prompt.

Optional web search

When you enable web search for a turn (the globe icon next to the composer), Kite AI uses one of two backends, depending on what’s available:

• Federated open-data search. Kite AI calls a small set of public, no-key APIs directly from your device to fetch background information for the model: Wikipedia, Hacker News, Stack Overflow, and arXiv. Each request sends only your search query (a few words derived from your prompt) over HTTPS to the named source. Tiny Kite Ltd does not run a search proxy; the requests go straight from your device to each source’s public endpoint. The respective source’s privacy policy governs what they retain (typically just rate-limit / abuse-monitoring data).
• Provider-native search. When the model you picked supports it (e.g. Anthropic Claude’s web_search tool), Kite AI lets the provider perform the search server-side instead. In that case, your search query is sent to the provider as part of the same chat request, and the provider’s privacy policy governs all of it.

Search is off by default on every conversation. The globe icon in the composer toggles it per-turn. You can also disable web search globally in Settings → Search.

Search results returned to your device — page titles, URLs, brief snippets — are appended to your conversation as context for the model and persisted with the conversation history (locally and, if you opted in, in your GitHub sync repo). They are never sent to Tiny Kite Ltd.

Voice conversation

Voice mode lets you talk to your selected AI provider hands-free. The audio path is built so your voice never leaves the device.

• Speech-to-text (what you say). Kite AI uses Apple’s Speech framework on iOS / iPadOS / macOS and Android’s local recognizer where available. On iOS we explicitly set requiresOnDeviceRecognition = true, which keeps audio on the device at the cost of slightly lower transcription accuracy than Apple’s online recogniser. On Android, recognition runs offline if the device has the relevant language pack pre-downloaded; if it doesn’t, the system recogniser may fall back to Google’s online service. We surface a one-time banner the first time voice mode opens on Android telling you whether your device is currently in offline-only mode.
• Recognised text. The text the recogniser produces is sent to your selected AI provider over HTTPS, exactly the same way a typed message is. Your provider’s privacy policy governs what they retain.
• Text-to-speech (what the model says back). Kite AI uses your operating system’s built-in voice synthesiser (Apple AVSpeechSynthesizer, Android TextToSpeech, macOS NSSpeechSynthesizer). Audio is generated on the device. Tiny Kite Ltd does not run a TTS proxy and does not contract a third-party voice service for v1.
• No audio recording. Raw microphone audio is never recorded to disk, sent to Tiny Kite Ltd, or sent to your AI provider.
• Voice turns persist as text only. A voice conversation appears in your chat history as ordinary text turns with a small microphone adornment indicating the user spoke. The audio itself is not stored.
• Permissions. Voice mode requests microphone access and speech-recognition permission at first use. Both are required for the feature; declining either disables voice mode but the rest of the app keeps working.

4. AI-generated content disclosure

Responses in Kite AI are produced by third-party large language models. They may be inaccurate, incomplete, biased, or otherwise inappropriate. Kite AI does not pre-screen prompts or post-screen responses beyond what the chosen provider applies on its side; we expose the provider’s response as-is so you can judge it for yourself. Verify any information that matters before relying on it.

Every assistant message includes a Report affordance (flag icon in the action row). Tapping it copies a structured report to your clipboard so you can email it to support@tinykite.co. Reports help us decide which providers to recommend and which guidance to surface in-app.

5. Children’s audience

Kite AI is not directed at children under 13 (or under 16 in the EEA / UK). We do not knowingly accept data from children. If you believe a child has used the app and supplied data, contact support@tinykite.co and we will help you locate and remove it.

The app’s age rating reflects this: 17+ on the App Store via the Unrestricted Web Access declaration; equivalent on Google Play.

6. Optional GitHub sync

If you connect a GitHub account in Settings → Sync, the app creates a private repository on your GitHub account (default name kite-ai-conversations) and writes your conversation history there as an append-only log. The repository is owned by you and stored in your GitHub account. Tiny Kite Ltd has no access to it. Your provider API keys are never written to this repository.

You can disconnect the sync at any time without losing in-app data, and you can delete the repository directly on github.com whenever you want.

7. Permissions Kite AI requests

All permissions are optional. Denying any permission only disables the corresponding feature; the rest of the app continues to work.

• Camera — to take a photo and attach it to a chat message.
• Photo library — to pick an existing image and attach it to a chat message.
• Microphone + Speech recognition — for voice dictation. As noted above, audio is processed on-device.

Kite AI does not request location, contacts, calendar, health, file system, or background access.

8. Data deletion

Because Kite AI does not collect or store your data on TinyKite servers, you can delete your in-app data at any time, on your own, with no support request required:

1. Per-conversation: open the drawer (left), long-press a conversation, then use the multi-select toolbar to delete one or many at once.
2. All in-app data: uninstall Kite AI. The app’s storage on iOS and Android is private to the app, so removing it deletes every conversation, draft, saved prompt, and the encrypted local provider-key store.
3. Synced GitHub repository (if you used the GitHub sync feature): sign in to GitHub and delete the kite-ai-conversations repository. Detailed steps: GitHub: Deleting a repository.
4. Provider API keys: rotate or delete the keys at your provider’s dashboard (Anthropic console, OpenAI keys page, Google AI Studio, OpenRouter, Together, Groq) so any cached request history at the provider is no longer associated with an active key you control.
5. Anything else: email support@tinykite.co and we will assist within five business days. Because we do not store your data, this is a courtesy channel — there is no record of your usage we could surface or remove ourselves.

9. Account deletion

Kite AI does not require an account to function, so there is no separate “delete account” flow. Following the steps in § 8 is equivalent.

10. Telemetry, analytics, and tracking

None. The app makes no requests to Tiny Kite Ltd-controlled servers. There is no analytics SDK, no crash reporter SDK, no advertising SDK, no usage telemetry, no device-fingerprinting library. Network traffic from Kite AI consists exclusively of:

1. Provider API calls you initiated by sending a message.
2. GitHub API calls, only if you opted into Sync.

11. Mapping to App Store and Play Store disclosures

• App Store privacy nutrition labels. Data linked to you = none collected by Tiny Kite Ltd. Data not linked to you = none collected by Tiny Kite Ltd. Data collected by third-party AI providers is governed by their respective policies.
• Google Play Data Safety. Messages and image attachments you send are shared (transmitted to a user-selected AI provider) over HTTPS for app functionality. Nothing is collected by Tiny Kite Ltd. Encrypted in transit. Data deletion is supported via the steps in § 8.

12. Changes

We may update this policy as Kite AI evolves. Material changes will be reflected here with an updated “Last updated” date at the top.

13. Contact

For privacy questions about Kite AI specifically:
Email: support@tinykite.co