Privacy Policy

Last updated: July 13, 2026

Who we are

Kith Rabbit ("Kith", "we", "us") is a messenger with a personal AI companion, operated by Haah, Inc. We are the data controller for personal information processed through kithrabbit.com, api.kithrabbit.com, and the Kith Rabbit apps. For privacy questions, contact privacy@haah.ing.

What we collect

Account data. When you sign in with Apple or Google we receive your name, email address, and a stable account identifier. We never see your password. If you claim an @username, it becomes your public handle on Kith.

Your conversations. Messages you exchange with your kith and with other people — including photos and short videos you attach — are stored so the product can work. Messages you send to other Kith users are delivered into their account too: like any messenger, the recipient keeps their copy. Deleting one of your messages removes its content for everyone in the chat, leaving a "deleted" marker.

Your knowledge graph. The people, companies, places, projects, interests, and books your kith learns about — with notes, quotes, and the connections between them — are stored in a database that belongs to your account alone. Your graph is private to you; other users never see it.

Your profile and network. Your profile (name, bio, location, profile picture, what you're interested in, what you can help with) is shown to other users according to the visibility level you choose: public, connections-only, or anonymous (handle only). Mutual connections and reputation — endorse/caution keywords other users attach to your handle from their own experience — are part of the shared network and visible to other users.

Activity status. While your app is connected we keep the time of your most recent connection, and people who can see your profile may see an "active now" indicator for a few minutes around it. This is a single timestamp, not a history of when you were online, and it resets whenever our servers restart. An anonymous account shows no activity status.

Device signals. Your device timezone (so reminders fire at the right hour). If you grant location access, your current locality is used to inform replies while the app is open — we do not build a movement history. If you grant calendar access, your calendar is read on your device; when a reply needs it, a summary of the requested date range passes through our server to the AI and is not retained outside that conversation. The app also records first-time-use marks for a few gestures (e.g. "has ever used drag-to-connect") so it can stop offering tips — this is not behavioral analytics.

Push notifications. If you enable notifications, we store a delivery token for your device. The notification itself carries only identifiers — never message text or names; your device fetches the content from our servers when it displays the alert, so the push transport (Google Firebase Cloud Messaging on Android, Apple Push Notification service on iOS when available) never sees what was said.

Technical data. We keep short-lived server logs (timestamps, IP address, endpoint) for security, abuse prevention, and debugging. We use no advertising trackers and no third-party analytics.

How the AI works with your data

Your kith's replies are generated by large language models. To generate a reply, the relevant conversation excerpt, your profile, and related pieces of your knowledge graph are sent to the AI provider for processing:

• Z.ai (GLM), routed through OpenRouter — the default engine for replies, and the model behind smaller internal steps such as summarizing conversations and web-search results and drafting a first bio for a new graph entry.
• Qwen (Alibaba), routed through OpenRouter — describes photos you attach, so your kith can see them.
• Mistral, routed through OpenRouter — reads PDFs you attach (text extraction and OCR), so your kith can work with documents you share.
• Anthropic (Claude) — an optional reply engine; your content reaches it only if you select it in settings.
• Apple on-device intelligence — an optional engine that generates replies entirely on your device.
• Voyage AI — turns short excerpts of your conversations and graph entries into numeric embeddings, so your kith can recall relevant past context. Voyage receives the text it embeds and returns numbers; the embeddings are stored only in your own store.

These providers process the content to produce the response you asked for. We do not sell your data, we do not use it for advertising, and we do not use your content to train models of our own. When your kith searches the web on your behalf, the search query (not your conversation) is sent to SerpAPI.

Google user data (Limited Use)

Kith's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google sign-in data (name, email, account identifier) only to create and authenticate your account. We do not use Google user data to train AI models, to serve ads, or for any purpose unrelated to signing you in, and we do not sell or transfer it to third parties except as necessary to operate the service or as required by law.

Where your data lives

Each account's content is kept in its own isolated store on our servers in Singapore. Our AI providers (listed above) operate from other regions, including China (Z.ai, Qwen) and the United States (Voyage, and the optional Claude engine); they receive only what a given reply needs.

Security

Encrypted in transit. All traffic between the apps and our servers uses TLS.

Encrypted at rest. Everything we store for you is encrypted on disk: your conversations, knowledge graph, and profile live in a database encrypted under a key unique to your account, and every photo and video is stored as an encrypted file. The encryption keys are kept separately from the data they protect, so a copy of the stored files alone — a backup, a disk — is unreadable.

What this does and doesn't mean. Messages are not end-to-end encrypted: the server must read them to deliver them and to let your kith help you with them — that's the product. Encryption at rest protects your data as stored files; it does not change who can process it (you, your recipients, and the AI providers above, per this policy). We do not read your content except when needed to debug a problem you report, to investigate abuse, or as required by law.

Retention and deletion

Your content is kept for as long as your account is active. You can delete individual messages and any entry in your knowledge graph from the app at any time. To delete your account and everything in it, open Settings → Delete account in the app — your store and account data are erased immediately and you're signed out; there's no form to fill out and no waiting period. If you can't reach the button because you've lost access to your device or sign-in, email privacy@haah.ing from your sign-in address and we'll delete it for you. Copies of messages you already delivered to other users remain in their accounts, as in any messenger, and a minimal set of safety and moderation records may be retained where required (see our account-deletion page for the full list of what is kept and why).

Lawful basis (EEA/UK)

Where GDPR applies, we process your data to perform our contract with you (running Kith), with your consent for optional features you switch on (location, calendar, trace sharing — each withdrawable in settings), for our legitimate interests in securing and improving the service, and to meet legal obligations.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or object to our processing of your personal data, and to withdraw consent. EEA and UK users can lodge a complaint with their local data protection authority; California residents have the rights provided by the CCPA/CPRA, and we do not sell or share personal information for cross-context behavioral advertising. To exercise any of these rights, email privacy@haah.ing.

Children

Kith is not intended for anyone under 16. We do not knowingly collect personal data from children under 16; if you believe a child has provided us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as the product evolves. Material changes will be posted on this page with an updated date, and flagged in the app when they matter.

Contact

Haah, Inc. — privacy@haah.ing
2261 Market Street STE 16236, San Francisco, CA 94114, United States