1. Who We Are

Khanflow is operated by Nobokai, Inc., a Delaware corporation ("Nobokai," "we," "our," or "us"). For the information described in this policy about our users, we are the data controller: we decide why and how it is used.

When you use Khanflow to schedule with, write to, or remember other people, we process some of their information on your behalf. Section 16 explains what that means for them.

2. Information We Collect

Your account

• Your name and email address. If you sign in with Apple, Apple may give us a private relay address instead of your real one; if you sign in with Google or Microsoft, we receive the name and email on that account.
• Your profile, preferences and settings, such as working hours, time zone, appearance and notification choices.
• Sign-in and connection tokens for the services you connect. On your iPhone these are kept in the Keychain.

Your calendars and tasks

• Events from calendars you connect (Google Calendar, Microsoft Outlook): titles, times, locations, notes, video-call links, and the names and email addresses of the people invited.
• Calendars on your iPhone, if you allow access (see Section 3).
• Tasks from services you connect (Google Tasks, Microsoft To Do), and meeting details if you connect Zoom or Microsoft Teams.
• What you create in Khanflow: plans, blocks, goals, life areas, booking pages, share links and your availability.
• When you book something Khanflow suggests, we write it to the calendar you chose and to a "Khanflow" calendar on your iPhone.

What you create and share with the assistant

• Your conversations with the assistant, and what it remembers about you so it can help you better over time. You can see and remove what it remembers.
• Documents and photos you choose to import, so it can find the dates in them and add them to your calendar.
• Your voice when you talk to Khanflow. It is turned into text as you speak; we keep the text, not the recording.
• Your answers during setup: how your days run (when they start and end, weekends, focus and break lengths), what you want more time for and what keeps getting pushed, in the words you type or say, lists you import, the boards and goals you pick, the people you choose to catch up with, and how you heard about Khanflow. We use them to plan around you and to restore your setup on a new phone.
• The names of the people you pick from your contacts during setup, saved with your setup answers. Their phone numbers and email addresses stay on your iPhone, where they address the message you send. Khanflow never asks for access to your contacts and never reads or uploads your address book; only the people you pick are shared with the app.
• A contact you choose to attach from your address book. We receive only that one contact (name, email addresses, phone numbers, company) and never read or upload your address book.

From people who book with you

• When someone books a time through your booking page or answers a share link, we collect the name, email address and any note they give, and show them to you.

Usage, device and diagnostic information

• Which screens you open and what you tap in the app, and pages you visit on the website.
• During early access, a record of your activity in the app, including what's visible in it (Section 9).
• Crash reports and error reports from the app and our servers.
• Device and connection information: device model, operating system and app version, time zone, IP address, and a push-notification token if you allow notifications.
• Server logs of requests to our service, used for security and to fix problems.

What we do not collect

• We do not track your location.
• We read your device's advertising identifier only if you allow tracking when the app asks. You can change that at any time in your iPhone's Settings, under Privacy & Security, Tracking. See "Advertising measurement" in Section 10.
• We do not use health data, and we do not ask for payment details.

3. Personal Data in Your Calendars, Including from Connected Services

Your calendars and tasks can contain personal data about other people, for example in the title or notes of an event, or in its list of guests.

Khanflow lets you connect third-party services (Google Calendar, Microsoft Outlook, Google Tasks, Microsoft To Do, Zoom) and the calendars on your iPhone, and transfers data from them into Khanflow, periodically or when you ask, and stores it on our servers. From your iPhone's calendars we store each event's title, time and place, from a week ago to two months ahead. We store this data so Khanflow can offer features that need it: planning around your whole week, the assistant, widgets and the Apple Watch app, the website, and the availability shown on your booking pages.

When the assistant works on a particular event, the event's notes and the people invited are sent with that request to be processed (Section 8), and are not stored. You can stop sharing your iPhone calendars in the app's Calendars settings, and we remove what we stored from them.

Please do not use Khanflow to process data that reveals someone's racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, or passwords, genetic or biometric data, health data, or data about a person's sex life or sexual orientation.

The personal data of other people in your calendars, tasks and imported documents, and the data imported from services you connect, is called "User Data" in this policy. You decide what User Data to bring into Khanflow, and it is your responsibility to make sure you may do so. For User Data we process it only to provide Khanflow to you, following your instructions, including those you give through the app, and in line with applicable data protection law. Section 16 explains how the people it is about can contact us.

4. People in Your Calendar

• Khanflow learns who you meet from the people invited to your calendar events: their names, email addresses, and when and how often you meet. We use this to show who an event is with, to suggest people you have not seen in a while, and to help you set up time with them.
• You can also add people yourself and say how often you want to see them.
• This is on by default. You can turn it off in the app under Profile, People from your calendar. Turning it off deletes what we learned from your calendar; people you added yourself stay until you remove them.
• The people this is about have not signed up to Khanflow. We only use their details to serve you, never to contact them on our own account, and never sell or share them. See Section 16.

5. Messages We Send for You

• When you ask Khanflow to set up time with someone by email, we send the email from hello@khanflow.com with your name on it. It includes the times you chose and a link for them to pick one. Replies to it come to us and are shown to you in the app.
• When you choose to send a text instead, it opens in your phone's Messages app and you send it yourself. We do not send texts.
• We keep the person's name, the address or number used, the message, and their reply on your account, so you can see where each request stands.
• Sending an email this way is your decision. Only ask Khanflow to write to people you have a reason to contact.

6. How We Use Your Information

• To run Khanflow: show your week, plan it, suggest times and people, answer the assistant, send reminders and notifications, and keep your calendars in sync.
• To act for you when you ask: book events, share your availability, and send the emails described in Section 5.
• To fix and improve it: find where the app breaks or gets stuck, and understand which features help.
• To keep it safe: prevent abuse, fraud and unauthorized access, and protect you, other people and us.
• To talk to you: service messages about your account, and, if you choose, occasional product news, which you can unsubscribe from at any time.
• To meet legal obligations and enforce our Terms of Service.

We do not sell your personal information or build advertising profiles of you. We measure our own ads with Meta and TikTok, as set out under "Advertising measurement" in Section 10. We do not make decisions about you by automated means that have legal or similarly significant effects. The assistant suggests; you decide.

7. Legal Bases (EU and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the service you signed up for, including reading your calendar, planning, booking and syncing.
• Consent: for sharing your information with AI providers to run the assistant, for the early-access activity record, and for access to your iPhone calendars, microphone and notifications. You can withdraw consent at any time; this does not affect processing that already happened.
• Legitimate interests: for learning who you meet from your calendar (so we can help you keep in touch), for processing the details of people you schedule with, for analytics, security and preventing abuse. We have balanced these against the rights of the people involved, and you can turn the people feature off.
• Legal obligation: where the law requires us to keep or disclose information.

8. The Assistant and AI Providers

• Anthropic: The assistant runs on Claude, Anthropic's AI model, reached through Amazon Web Services (Amazon Bedrock) and Anthropic's own service. To plan your day, answer you, and write messages for you, we send it what the task needs: your calendar events (titles, times, notes, and the names of people invited), your messages to the assistant, documents and photos you import, and what Khanflow knows about the people involved.
• ElevenLabs: When you talk to Khanflow, your voice is sent to ElevenLabs to be turned into text, unless you turn on "Keep voice on this phone" in the app, in which case Apple's speech recognition is used instead. When Khanflow speaks a reply aloud, the text of the reply is sent to ElevenLabs to be spoken.
• Enterprise AI: we use Anthropic (through Amazon Bedrock and Anthropic's API) and ElevenLabs under enterprise agreements, not their consumer products. Your information is not used to train their models. Amazon does not share it with the model's maker or use it for training. It is processed only to return a result to us.
• Khanflow does not use your information to train AI models either.
• You agree to this when you sign in. The assistant can be wrong: check anything important before you rely on it.

9. Early-Access Activity Record

In the iOS app, which screens you open and what you tap. During early access, we record your activity within Khanflow, including what's visible in the app, to identify and fix bugs. Passwords and other secure fields are never included. You agree to this when you sign in. To stop it, email privacy@khanflow.com. Crash reports from the app are handled the same way. This is tied to your account and seen only by the Khanflow team.

10. Who We Share Information With

We do not sell your personal information. We share it only as described here.

Service providers

These companies process information on our behalf, under contracts that limit them to doing so:

• Amazon Web Services: hosting, servers, storage, and access to Claude through Amazon Bedrock.
• Supabase: our database.
• Anthropic and ElevenLabs: the assistant and voice (Section 8).
• PostHog: product analytics, the early-access record of your activity in the app, and crash reports.
• Sentry: error reports from our servers.
• Resend: sends our emails, including the emails you ask Khanflow to send for you, and receives the replies to them.
• Cloudflare: our domain and incoming email routing.
• Apple: push notifications, Sign in with Apple, and place lookups for the weather on your events.
• Open-Meteo: gets the weather for the place of an event. We send the place's coordinates, never who you are.

The full list is on our subprocessors page.

Advertising measurement

We advertise Khanflow on Meta (Facebook and Instagram) and TikTok. The iPhone app includes Meta's and TikTok's software so we can tell which of our ads lead people to Khanflow:

• What they receive: that the app was installed and opened, that you finished setup, and that you started a free trial or a subscription (the plan and its price), with device information such as model, system version and IP address.
• If you allow tracking when the app asks: Meta and TikTok may also receive your device's advertising identifier, and use these events to measure and improve our ads. TikTok's software only starts if you allow tracking.
• If you do not allow tracking: TikTok receives nothing, and Meta receives the events without the advertising identifier and is told not to use them to track you.
• Never shared with them: your calendar, your conversations with the assistant, what it remembers, your documents, your voice, your contacts, or the people who book with you.

Meta and TikTok handle this information under their own privacy policies. You can turn tracking off for Khanflow at any time in your iPhone's Settings, under Privacy & Security, Tracking.

Services you connect

• Google (Calendar, Tasks, Meet), Microsoft (Outlook, To Do, Teams) and Zoom, with your permission through their sign-in screens. We read and write only what the features you use need. You can disconnect them at any time in the app or in that service's settings.
• Apps you connect to Khanflow yourself, such as an AI assistant using our connector, get only the access you approve on the permission screen, and you can revoke it.

People you choose to share with

• People who open your booking page or share link see the availability and details you chose to show. Teammates see what you share with your team. People you email through Khanflow see the message and your name.

Other cases

• Legal requirements: when required by law, court order or legal process, and where we believe in good faith it is necessary to protect someone's safety or our rights.
• Business transfers: if Nobokai is involved in a merger, acquisition or sale of assets, your information may transfer as part of it. This policy will continue to apply, and we will tell you before it becomes subject to a different one.
• With your consent in any other case.

11. How Long We Keep It

• Your account and everything in it (calendar copies, plans, people, assistant conversations, messages sent for you): for as long as you have an account. When you ask to delete your account, we delete it and everything in it within 30 days.
• People learned from your calendar: until you turn the feature off or delete your account, whichever comes first.
• Imported documents: we keep the dates we found; the original file is deleted within 30 days.
• Voice: we keep the text, not the audio.
• Setup answers: for as long as you have an account; they are deleted with it.
• Activity records, analytics and crash reports: up to 30 days.
• Server logs: up to 30 days, longer only when needed to investigate a security problem.
• Backups: deleted information may remain in encrypted backups until they are replaced in the normal cycle, up to 30 more days.
• We may keep a small amount of information longer where the law requires it, or to resolve a dispute or prevent abuse.

12. Security

• Information is encrypted in transit (TLS) and at rest.
• Connection tokens are stored securely on our servers and in the Keychain on your iPhone, and are never shown to anyone.
• Access to production systems is limited to the people who need it, and we review our systems for security problems.

No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities as the law requires. To report a security problem, email privacy@khanflow.com.

13. Your Choices and Controls

• People from your calendar: Profile, People from your calendar.
• Voice: Profile, Keep voice on this phone, to keep audio on your iPhone; or don't use voice at all.
• iPhone calendars, microphone, notifications: your iPhone's Settings, Khanflow.
• Connected services: disconnect them in the app, or in Google or Microsoft account settings.
• Early-access activity record: email privacy@khanflow.com.
• Product news: unsubscribe link in any such email.
• Delete your account: Profile, Manage account, Request account deletion. You can also email privacy@khanflow.com.

14. Your Rights

Depending on where you live, you have some or all of these rights:

• Access: get a copy of your information.
• Correction: fix information that is wrong.
• Deletion: have your information deleted.
• Portability: get your information in a format you can take elsewhere.
• Objection and restriction: object to, or ask us to limit, processing based on legitimate interests.
• Withdraw consent: where we rely on your consent, at any time.

To use any of these rights, email privacy@khanflow.com from the address on your account. We may need to confirm it is you. We will answer within 30 days (45 days where US state law allows), and will not treat you differently for asking. If you are in the EEA or UK, you can also complain to your local data protection authority.

15. US State Privacy Rights

If you live in California or another US state with a consumer privacy law, this section adds to the above.

• What we collect, in the categories those laws use: identifiers (name, email, account and device IDs, IP address); customer records (profile and contact details); internet and app activity (usage, the early-access activity record); audio (voice, turned into text); professional or personal information in your calendar and documents; and inferences (who you meet and how often).
• Sources: you, your connected calendars and services, your device, and people who book with you.
• Purposes and recipients: as described in Sections 6 and 10. We disclose information to service providers for business purposes only.
• No sale: we do not sell personal information, and have not done so in the past 12 months.
• Sharing for advertising: if you allow tracking, the app events and advertising identifier described under "Advertising measurement" in Section 10 go to Meta and TikTok to measure our ads, which some state laws call "sharing" for cross-context behavioral advertising. To opt out, turn tracking off for Khanflow in your iPhone's Settings, or email privacy@khanflow.com and we will stop. We honor Global Privacy Control signals on the website, which uses no advertising trackers.
• Sensitive information: we do not use or disclose it to infer characteristics about you.
• Your rights: to know, access, correct and delete, and not to be discriminated against for using them. You can use an authorized agent; we may ask them for proof of permission and ask you to confirm your identity.
• Appeals: if we decline a request, you can appeal by replying to our answer or emailing privacy@khanflow.com with "Appeal" in the subject. We will answer within 60 days.

16. If Khanflow Holds Your Information Because of Someone Else

You might be here because someone invited you to an event, booked time with you, or received an email from Khanflow on their behalf. In those cases we hold your name, email address (and phone number if they have it), and, for emails, the message and your reply, on that person's account and only to help them.

• We never contact you on our own account, never add you to a mailing list, and never sell or share your details.
• To ask what we hold about you, have it deleted, or stop receiving emails sent through Khanflow, email privacy@khanflow.com. We will act on it within 30 days.

17. International Transfers

We are based in the United States and our servers are in the United States. If you use Khanflow from elsewhere, your information is transferred to and processed in the United States. For transfers from the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum), or on our providers' certification under the Data Privacy Framework, together with the safeguards in this policy.

18. Children's Privacy

Khanflow is not for children under 13, or under 16 in the EEA and UK. We do not knowingly collect information from them. If you believe a child has given us information, email privacy@khanflow.com and we will delete it.

19. Cookies and Similar Technologies

• The website uses cookies and local storage to keep you signed in, remember your settings, and measure which pages are used (PostHog). We do not use advertising cookies or trackers.
• You can block or delete cookies in your browser; the website may not keep you signed in if you do.
• The app uses storage on your device to keep you signed in, cache your week so it opens quickly, and share information with its widgets and Apple Watch app.

20. Changes to This Policy

We will update this policy when what we do changes, and change the date at the top. If a change is significant, for example a new kind of information or a new company we share it with, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.

21. Contact Us

Questions, requests or complaints about privacy: