Kojo

Privacy

What Kojo stores when you chat or use the API, what trains Kojo and what never does, how long we keep things, and your rights.

Last updated 26 October 2026

Kojo is made by Empero, an independent AI research lab in Germany, and runs on our own server in Germany.
Your chats are kept so you can come back to them: for the browser you used, or for your Empero account once you sign in. A chat is deleted when you delete it or after 90 days without activity.
Chats on kojo.sh and requests made with an account's API key are never used to train Kojo's models. The one exception is feedback you give on purpose: a thumbs up or down, or a choice between two replies, is kept as training data.
To write a reply, Kojo sends the content of the conversation to third-party model providers. Some of them are outside the European Union.
No analytics, no advertising, no tracking cookies.

The chat at kojo.sh

Your conversations

What you write, what Kojo answers and the images you attach are stored on our server so that you can reopen a chat later. Without an account they belong to the browser you used, identified by an anonymous cookie; with an Empero account they belong to the account and follow you across browsers. Each chat is kept until you delete it, or until it has been idle for 90 days. We keep at most 300 chats per visitor; beyond that the oldest go first. Deleting a chat, or clearing all of them, removes them at once.

Attached PDFs and files Kojo makes

They live in a workspace of their own for that chat and are deleted 30 minutes after they were last written or presented to you. Up to 60,000 characters of an attached PDF's text become part of the conversation itself.

Signing in

When you sign in with an Empero account, Kojo receives your account id, email address and name from accounts.empero.org and keeps them to show you your chats, settings and usage. Your custom instructions and the skills you add (uploaded, or imported from a public GitHub repository) are stored with the account, and the chats of the browser you sign in from move into it. Deleting your Empero account also deletes your chats, share links, instructions, skills, API keys and usage records here.

Shared chats

A share link is a snapshot of the chat at that moment, readable by anyone who has the link; we ask search engines not to index it, and we count how often it was opened. Share links do not expire on their own: a link stays available until you remove it, delete the chat or delete your account.

Feedback

When you rate a reply with a thumbs up or down, say whether a regenerated reply was better or worse, or pick one of two replies Kojo shows side by side, we keep the conversation up to that point together with the chosen and the rejected reply, your reason or comment if you gave one, and technical details of how the replies were made. Images and attached files are replaced by a placeholder. This is the one part of the chat that is used to train Kojo's own models. It has no automatic expiry; write to us if you want yours deleted.

Allowances

To share Kojo fairly, we count messages and cost per hour for each browser (its cookie) and its IP address. These counts live in memory for the hour and are not stored.

Cookies and local storage

kojo_visitor: An anonymous id for the browser, so your chats are there when you come back. Kept for a year.
kojo_session: Keeps you signed in with your Empero account. Kept for 90 days.
empero_oidc: Protects the sign-in while it is under way. Gone after 10 minutes.

Your theme choice is kept in the browser's local storage. There are no analytics or advertising cookies, and no third-party scripts.

The API at api.kojo.sh and the console at platform.kojo.sh

Account keys

Keys made on platform.kojo.sh belong to your Empero account. We store a hash of each key and a short hint of it (the key itself is shown once), its name, when it was last used, and for each request the time, the tokens used and the cost, which is what the usage page shows. Requests made with an account key are never used to train Kojo's models, and images in them are not kept. Keys and usage records are deleted with the account.

Keys we issue directly

For beta testers and partner platforms we issue keys by hand. Unless we agreed otherwise with the key's holder, Kojo learns from the traffic of those keys: replies may be graded by other models, alternative replies may be tried, and requests and replies, images included, may be kept as training data for Kojo's own models and to tune how Kojo routes work. The key's holder is told which applies and is responsible for telling the people whose requests they pass on.

Feedback through the API

A rating sent to /v1/feedback is stored with the request it rates.

Service records

Every exchange with Kojo, the request, the reply and the steps in between, is also kept in our service records together with the key or account it belonged to. For the chat and for account keys, images are replaced by a placeholder there. We use these records to run Kojo, to find and fix problems and to deal with abuse; they are not used to train models unless this page says so above. They have no automatic expiry today; write to us and we delete yours.

Services we use

Third-party model providers: Kojo's replies are written by Kojo's own models on our server together with models run by third-party providers. To get a reply, the content of the conversation (text, and images where the model can see them) is sent to those providers, who process it under their own terms. Some of them are outside the European Union. We send what the reply needs, not your account details.
Web search and page reads: When Kojo searches the web, the search runs from our server through public search engines, and when it reads a page, our server fetches it. The sites see the query or the page request from us, not from you.
accounts.empero.org: Signs you in. It has its own privacy page.
billing.empero.org: Handles plans and payments, by card or Bitcoin, under its own terms and privacy page. Kojo tells it how many tokens you used so it can keep your allowance, and learns from it which plan you have. Kojo never sees your payment details.
Cloudflare: Sits in front of our server and terminates TLS. It processes request metadata, including IP addresses, to deliver the connection.
Server logs: Our server keeps standard technical logs of requests (time, path, status and the connecting address) for troubleshooting and abuse prevention.

Why we may do this

We store and process your chats, keys and usage to provide Kojo to you (Art. 6(1)(b) GDPR). Service records, allowances and server logs rest on our legitimate interest in running the service and keeping it available and safe (Art. 6(1)(f)). Training on the feedback you give on purpose rests on our legitimate interest in improving Kojo; you choose whether to give it.

Your rights

Under the GDPR you can access, correct, export or delete your data, restrict or object to processing, and complain to a supervisory authority. Chats, share links and API keys you can delete yourself, and your account on its account page. For anything else write to [email protected].

Controller

Empero, independent AI research lab, Germany. General questions: [email protected]. Data protection: [email protected].

Changes

When the way Kojo handles data changes, we update this page and the date at the top.