privacy policy

Last updated: May 11, 2026

This Privacy Policy explains what information komachat collects, how we use it, and what choices you have. We tried to write it like a human, not a lawyer.

If you have questions, email support@komachat.app.

tl;dr

• We collect the minimum we need to make a messaging app work: your handle, display name, character pick, optional bio, your messages, who you message, who you've saved as contacts.
• We don't sell your data. We don't run ads. We don't share with third parties beyond what's necessary to deliver the service (Apple for push notifications, Supabase for our database).
• You can delete your account at any time by emailing us. Doing so removes your data within 30 days.

1. Who we are

komachat is a manga-styled messaging app made by Austin Self ("we," "us"). The service is operated from the United States. By using komachat you agree to this Privacy Policy.

2. What we collect

2.1 Account information

When you sign in with Apple, Apple sends us a stable opaque identifier and (optionally, if you choose to share it) your email. We store:

• The Apple opaque identifier
• The email you shared, if any — used only to send you account-related messages (we currently send none)

You then create:

• Handle (e.g. @yourname) — publicly visible to other users
• Display name — publicly visible to your contacts and group members
• Character — your manga avatar, publicly visible
• Bio — optional, max 140 characters, publicly visible

2.2 Communications

When you use the app, we store:

• The text of messages you send
• The conversations you're a member of
• Reactions, replies, edits, deletes you make
• Your contacts list and any nicknames you set
• Which users you've blocked
• Whether you've pinned, muted, or archived each conversation
• When you last opened the app (used for the "online" / "last seen" indicator)

We do not read your messages or scan their content. We store them so the service can deliver them to the recipients and show them back to you.

2.3 Device information

To deliver push notifications, we store:

• A device push token from Apple (a long string unique to your device installation)
• The device type ("ios")

We do not collect your IP address, device model, geolocation, or any identifiers beyond what's needed for push delivery.

2.4 What we do NOT collect

• We do not access your contacts list, photos, microphone, camera, or location.
• We do not use third-party analytics (no Google Analytics, no Mixpanel, no PostHog inside the production app).
• We do not place advertising trackers.
• We do not require or accept payment information at this time.

3. How we use what we collect

We use the information we collect to:

1. Sign you in and recognize you across sessions.
2. Deliver messages between you and the people you choose to chat with.
3. Show your profile (handle, name, character, bio) to people you message.
4. Send push notifications when someone messages you (unless you've muted or disabled notifications).
5. Display "online" / "last seen" indicators to your DM partners (respecting any privacy controls you've set).
6. Respond to your support requests.

We do not use your information to train AI models, build advertising profiles, or sell to third parties.

4. Who we share with

Your data sits in two places:

• Apple, only for push notification delivery. Apple receives the device token + message preview when we send a notification.
• Supabase Inc., our database and infrastructure provider. Supabase hosts the Postgres database and edge function infrastructure that runs komachat. They process data on our behalf and do not use it for their own purposes. Supabase's privacy practices are at https://supabase.com/privacy.

We don't share with anyone else. We don't have a "partner network" or data brokers. Government requests would only be honored if legally compelled and would be disclosed where permitted.

5. How long we keep it

• Active account data: while your account is active.
• Deleted messages: removed from our database immediately when you delete them.
• Account deletion: when you ask us to delete your account, your data is removed within 30 days. Some operational backups may retain a copy for up to 90 days before being expired.
• Server logs: we retain minimal operational logs for up to 30 days for debugging and abuse prevention. Logs don't include message content.

6. Your rights

Regardless of where you live, you can:

• Request a copy of all data we hold about you
• Request that we correct anything inaccurate
• Request that we delete your account and all associated data
• Ask any question about how your data is handled

Email support@komachat.app with your handle to make any of these requests. We respond within 30 days.

If you're in the EU/UK, you have rights under GDPR. If you're in California, you have rights under CCPA. All of these are honored by emailing the above address. We don't sell personal information and never have.

7. Children

komachat is not intended for users under 13. Apple Sign In already enforces a minimum age, but if we become aware that a user under 13 has signed up, we will terminate the account and delete its data.

If you are between 13 and 18, please review this policy with a parent or guardian.

8. Security

We use industry-standard practices to protect your data:

• All traffic between your device and our servers is encrypted via TLS
• Database access is restricted via row-level security so users can only read their own conversations
• Push notification keys and database credentials are stored in encrypted secret management
• We do not store passwords (Apple Sign In handles authentication)

That said, no security is perfect. If we ever experience a breach affecting your data, we will notify you within 72 hours via the email Apple provides (if any) and in-app.

9. International transfers

komachat servers are located in the United States. By using komachat, you understand that your data is processed in the US. If you're outside the US, this means your data crosses an international border.

10. Changes to this policy

We may update this policy occasionally — for example, when we add new features or change service providers. If we make material changes, we'll notify you in-app before the change takes effect. The "Last updated" date at the top will always reflect the most recent version.

11. Contact

Questions, complaints, deletion requests: support@komachat.app

Mailing address available on request.