Privacy Policy for Koham

Effective Date: 2026-09-19

Key Principles

• Local-First Architecture: Koham has no developer-run servers, accounts, or cloud databases. Your books, reading highlights, notes, and conversation history are stored exclusively on your device.
• Bring Your Own Key (BYOK): AI conversations are powered directly by third-party AI providers using your own API credentials. The developer never acts as a proxy and never has access to your data or keys.
• Explicit User Consent: No data is ever transmitted to any third party without your explicit review and authorization in the app.

Third-Party AI Services & Data Sharing

1. Data Transmitted to Third-Party AI Services

• Messages & Prompts: The questions, prompts, and discussion text you enter in conversation sessions.
• Relevant Book Context: Contextual passages, highlights, or chapter summaries extracted locally from your EPUB files that are relevant to your question.
• Profile & Memory (Optional): Your preferred name and conversation memory (if enabled by you), used for personalized responses.
• Live Microphone Audio (Voice Mode Only): Streamed microphone audio captured exclusively while you actively engage in real-time voice calls.

2. Who the Data is Sent to & How

• Data is transmitted directly from your device via encrypted HTTPS/WSS connections to your chosen AI provider:
  • OpenRouter (OpenRouter Inc.)
  • DeepSeek (Hangzhou DeepSeek AI Co., Ltd.)
  • Google AI Studio / Gemini (Google LLC)
  • Alibaba Cloud Model Studio / Qwen (Alibaba Cloud Computing Co., Ltd.)
  • Or any custom OpenAI-compatible API endpoint specified by you.
• No Proxy Server: Koham does not operate proxy, relay, or logging servers. Your API requests never transit through developer infrastructure.

3. Explicit User Permission Required

• Prior to transmitting any data to a third-party AI provider, Koham presents an explicit "Third-Party AI & Data Sharing" permission sheet disclosing all data categories and recipients.
• You must tap "Agree & Continue" before any AI feature or connection is activated. If permission is denied, no data will ever leave your device, and client initialization remains blocked.

4. Third-Party Equal Protection Confirmation

Data Stored On-Device

• EPUB Books & Reading Metadata: Imported books, reading position, annotations, and bookmarks reside solely in your app sandbox.
• API Credentials: Your API keys are encrypted and stored in the secure Apple system Keychain on your device. They are never written to unencrypted storage or transmitted to the developer.
• AI Memories & Chat History: Conversations and memories are stored locally via SwiftData. You can clear them at any time.

Purchases

• Koham offers optional in-app purchases processed securely by Apple via StoreKit and the App Store. The developer does not receive, process, or store your payment cards, financial details, or billing information.

Device Permissions

• Microphone: Required only for real-time live voice conversations with books. Microphone access is requested only when you initiate voice mode and can be revoked at any time in iOS Settings. Koham does not access location, contacts, photos, or device identifiers.

Your Rights & Data Control

• Inspect & Delete: You can inspect, modify, or erase all conversation memory entries under Settings > Memory. You can delete books and conversations at any time.
• Complete Removal: Uninstalling Koham immediately deletes all local data, cached books, and Keychain keys from your device.

Changes & Contact

• We may update this Privacy Policy from time to time. If material changes are made, notice will be provided within the app or release notes. If you have questions regarding this policy, please contact us: