What Kuuko stores about you

And what it never stores.

Kuuko is built to know as little about you as it can. This is what its servers hold, and what they never hold.

Never kept

Your name, phone number or a password: Kuuko never asks for them.
Your 12 words: they never leave your device.
The names your devices look up: Kuuko DNS keeps no log of lookups.
The mail itself: it’s forwarded straight away and not kept. If your mailbox can’t be reached, a mail waits for up to a day.
Who an unexpected mail came from: leak detection counts such mails but doesn’t store the sender.

Kuuko DNS keeps no log of lookups. To stop abuse, it holds your internet address in memory for a few minutes, never on disk.
Recent answers are kept for everyone, for a day at most, without who asked.
The server the app talks to counts requests per internet address, in memory, for an hour at most, never on disk.

Your vault’s random number, which the app shows as your support code.
A fingerprint of the key made from your 12 words, and the public part of each passkey.
A fingerprint of each key your devices get when they open your vault, which ends after 90 days at the latest, and for each device that checks in the background, a fingerprint of its background key, which ends after 30 days.
Your settings, such as the default alias domain, mailbox, sender name, alias format and spam filter level.
Your forwarding mailbox. It’s the only email address of yours that Kuuko stores. If you add a PGP key, its public key too.
For each alias: its address, your note, the mailbox it forwards to, the name on replies if you set one, whether it’s on, and running totals without dates.
A fingerprint of every alias address, also after you delete the alias or your vault. It’s kept as long as Kuuko runs, so an address is never given out again.
Leak detection, only while it’s on: the senders you expect or, if you named none, the domain of the first sender until you confirm it; how many mails came from someone else, the day of the last one, and the automatic pause.
Your ledger: one encrypted file that Kuuko can’t read.
If you subscribe in the App Store while your vault is open: the plan, its end date and Apple’s transaction number. Never your name, Apple Account or card.

The mail server removes email and internet addresses from its logs. Logs of delivery problems are kept only if you switch them on, for 7 days.
A vault that never gets a subscription is deleted 24 hours after it was made.
Deleted data leaves Kuuko’s encrypted backups within 42 days.

Vault › Download my data gives you a readable file with what Kuuko’s server holds for your vault. Fingerprints aren’t in it: they can’t be turned back into data. Apple’s transaction details you get on request, by writing to Kuuko.
Vault › Delete vault… removes your vault, aliases, mailboxes, ledger, leak detection data and settings at once. It can’t be undone. The fingerprints of your alias addresses stay, as above.

The full details are in the privacy notice: Privacy at Kuuko.