Privacy policy

Koyou (“Koyou”, “we”, “us”) helps people find jobs worth their time, prepare strong applications and keep track of every reply. We are based in Nairobi, Kenya, and we are the data controller for the personal data described in this policy.

This policy covers this website, koyou.co, and the Koyou app. Koyou is in early access, so some of the features described here are still being built. This policy describes how they work when you use them.

Questions about privacy? Email sam@koyou.co.

When you visit this website

• Server logs. The company that hosts this website keeps standard logs of requests: IP address, browser type, the page requested and the time. They are used to keep the site secure and working.
• Email you send us. If you write to us, for example to ask for early access, we receive your email address, your name if you include it, and your message.

Like most websites, this one may use cookies and similar technology to work properly, stay secure and understand how it’s used. Section 12 explains more.

When you use Koyou

• Account. Your name and email address, and a password (stored only as a secure hash) or your Google sign-in (see section 6).
• Resume and profile. The resume you upload or paste, and your work history, education, skills and links. If you give us links to your own pages, such as a portfolio or blog, we fetch those pages once, with your permission.
• Your stories and answers. The stories you tell Koyou about your work, the answers you approve, and any writing samples you choose to share so Koyou can learn how you write.
• Job preferences. The roles and places you’re interested in, your pay range, work authorization and sponsorship needs, dealbreakers and target companies.
• Standard answers for application forms. Your legal name, contact details, start date, salary expectations and, if you choose to give them, self-identification answers (gender, race or ethnicity, veteran status and disability). Self-identification answers are set to “I don’t wish to answer” unless you change them.
• Applications and activity. The jobs you save, your documents, application statuses, notes, check-ins and weekly reviews.
• Job email you forward. See section 5.
• Payment details. Payments are handled by Stripe. We receive your subscription status, billing country, and your card’s brand, last four digits and expiry date. We never see or store your full card number.
• Technical data. IP address, device and browser type, and error reports, used to keep Koyou secure and fix problems.

We use personal data only for the purposes below. For each one, we name the legal basis we rely on under Kenya’s Data Protection Act, 2019, and similar laws.

• To run Koyou for you: finding and scoring jobs, preparing documents, helping you answer application questions, planning your days, tracking your applications and sending the notifications you turn on. Basis: our contract with you.
• To keep Koyou safe: protecting accounts, preventing abuse, and spotting scams and text written to trick AI tools. Basis: our legitimate interests, and legal obligations.
• To improve recommendations: using aggregated, de-identified statistics, such as response rates by type of role. These never identify you, and you can opt out in Settings. Basis: our legitimate interests.
• To talk to you: service emails, such as “your plan is ready” or “an interview invite arrived”, each of which you can switch off, and early-access updates if you asked for them. Basis: our contract with you, or your consent.
• To meet legal duties: keeping tax and accounting records and responding to lawful requests. Basis: legal obligation.

Self-identification answers are sensitive personal data. We use them only with your explicit consent, and only to fill in your own application forms. They are encrypted, never sent to an AI provider and never used in statistics.

We don’t sell your data, and we don’t use what you share with Koyou (your resume, stories, applications and email) for advertising or to train AI models.

Koyou uses Claude models from Anthropic to read resumes, judge how well a job fits, draft resumes, cover letters and answers, ask about your experience, and sort job email.

Each task gets only the data it needs. Anthropic processes this data on our behalf and, under its commercial terms, doesn’t use it to train its models.

AI can make mistakes. Koyou checks every claim in a document against what you’ve told us or uploaded, and you review everything before it’s used. Koyou makes recommendations, such as how well a job fits you. It doesn’t make decisions about you, and employers don’t use it to assess you.

Text in job posts, emails and web pages can’t make Koyou do anything. If we find text written to trick AI tools, we ignore it and show it to you.

Forwarding job email to Koyou

Koyou gives you a private forwarding address. You decide what to forward, and we help you set up filters so that only job email is sent. When a forwarded message arrives:

• If it isn’t about a job, it’s deleted straight away. No AI reads it and none of its content is stored. We keep only a daily count of discarded messages.
• If it is about a job, we keep the sender, subject, date, a short summary and the plain-text body (encrypted) until you delete it or your account. The original message file is deleted after 30 days.

You can change your forwarding address at any time. The old one stops working.

Sending from your own email (optional)

You can connect Gmail or Outlook so Koyou can send an email you’ve reviewed, such as an application or a follow-up, from your own address. This connection only lets Koyou send. It sends a message only when you click Send on that message, and you can disconnect at any time in Settings.

If we add other ways to connect your email, such as letting Koyou find job replies in your inbox without forwarding, they will be optional. We’ll update this policy and ask for your permission before you use them, and the rules above still apply: Koyou looks only at job email, and anything else is discarded.

For Gmail, section 6 explains exactly what we receive. For Outlook, we ask Microsoft for the send-only permission (Mail.Send) and the same rules apply.

Koyou asks for Google data in two places. Both are optional: you can sign up with an email address instead, and open any email Koyou drafts in your own email app.

Sign in with Google

When you choose Sign in with Google, Google shares your name, email address, profile picture and a Google account ID with us. We use them only to create your account, sign you in and show your name in Koyou.

Send from Gmail

If you connect Gmail, we ask for one permission: to send email on your behalf (Google calls this the gmail.send scope). Koyou uses it only to send a message you have reviewed, at the moment you click Send on that message, such as an application, a follow-up or a reply to an employer. It never sends on a schedule, in bulk or on its own.

This permission doesn’t let Koyou read, search, change or delete any email in your Gmail account, and we don’t currently ask for any permission that would. If we ever ask for more, it will be optional, and we’ll update this section and get your consent before using it.

What we store

• An access token for your Gmail connection, encrypted.
• For each message you send, a copy of the message and Gmail’s ID for it, so it appears on that application’s timeline.

How we use it, and what we never do

We use Google user data only to provide the Koyou features you choose to use.

• We don’t use it for advertising, and we don’t sell it or transfer it to data brokers or information resellers.
• We don’t use it to develop, improve or train AI or machine-learning models.
• We don’t use it to decide anyone’s creditworthiness or for lending.
• People at Koyou don’t read it, unless you ask us to (for example, in a support request), it’s needed for security (such as investigating abuse), or the law requires it.
• We share it only when needed to provide the features above (for example, with our hosting provider, which stores it for us), to comply with the law, or as part of a merger or sale of our business, and in that last case only with your explicit consent first.

Limited Use

Koyou’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our use of Gmail data also follows the Google Workspace API User Data and Developer Policy.

Disconnecting

You can disconnect Gmail at any time in Koyou’s Settings, or remove Koyou’s access from your Google Account. When you disconnect, we delete the access token. If we ever want to use Google data in a new way, we’ll update this policy and ask for your consent before we do.

We share personal data only with the service providers below, who process it for us under contracts that limit what they can do with it; when the law requires it; to protect someone’s safety; or as part of a merger or sale of our business, in which case we’ll tell you first.

Koyou never sends your data to employers. When you apply for a job, you send the application yourself, on the employer’s site or from your own email.

Service providers

AnthropicUnited States

AI models. Receives the text each task needs, such as resume content, job posts, what you tell Koyou about your work and job email to sort. Never your self-identification answers.

StripeUnited States

Payments. Receives your name, email address, and payment and billing details.

GoogleUnited States

Sign in with Google and sending from Gmail, if you use them. Receives sign-in requests and the emails you choose to send.

MicrosoftUnited States

Sending from Outlook, if you use it. Receives the emails you choose to send.

Hosting and storage

Runs Koyou and stores its data, encrypted. We’ll name the provider here before Koyou opens to the public.

Email delivery

Receives the job email you forward and delivers the emails we send you. We’ll name the provider here before Koyou opens to the public.

Error monitoring

Receives technical data when something breaks. We’ll name the provider here before Koyou opens to the public.

Koyou is based in Kenya, and several of our service providers process data in the United States and other countries. When we transfer personal data outside Kenya, we do so as the Data Protection Act, 2019 allows, with appropriate safeguards such as contracts that include data protection terms. If you are in the European Union or the United Kingdom, we use the transfer safeguards your law requires, such as standard contractual clauses.

• Your account and profile: until you delete them or your account.
• When you delete your account: it’s deactivated straight away. Your personal data, files and everything Koyou prepared for you are deleted within 30 days, and backups that contain them expire within 35 days.
• Job email: as described in section 5. Non-job email is deleted on arrival.
• Payment records: as long as tax and accounting laws require.
• Website server logs: kept by our web host for a limited time, for security.
• Emails you send us: until you ask us to delete them, or until we no longer need them to reply or to contact you about early access.

You can also delete individual emails, documents, stories and facts at any time.

All traffic to Koyou is encrypted. Sensitive fields, such as your phone number, address, work authorization, pay, self-identification answers, email bodies and contacts, are also encrypted in our database. Access is limited to what each part of Koyou needs, and people at Koyou can view your data only when you ask for support and agree to it.

If a breach puts your data at risk, we’ll tell you and the Office of the Data Protection Commissioner as the law requires.

Under Kenya’s Data Protection Act, 2019, and similar laws where you live (such as the GDPR in the European Union and United Kingdom, or the CCPA in California), you have the right to:

• be told how your data is used (this policy);
• get a copy of your data, which you can download from Settings at any time;
• correct data that’s wrong;
• delete your data;
• object to or limit some uses, such as the aggregated statistics in section 3;
• take your data to another service;
• withdraw your consent at any time, without affecting what we did before;
• not be subject to decisions made only by automated means that significantly affect you.

You can do most of this yourself in Settings. For anything else, email sam@koyou.co. We’ll reply as soon as we can, and within the time the law requires.

If you’re unhappy with how we handle your data, please tell us first. You can also complain to Kenya’s Office of the Data Protection Commissioner or to the data protection authority where you live.

We don’t sell personal information or share it for targeted advertising, as those terms are defined in California law.

We use cookies and similar technology to keep koyou.co and the Koyou app working and secure, for example to keep you signed in and to protect against abuse. We, and the providers that host and protect our services, may also use them to understand how Koyou is used so we can improve it.

Where the law requires it, we’ll ask for your consent before using cookies that aren’t essential. You can block or delete cookies in your browser settings, though some parts of Koyou may not work without them.

Koyou is for people aged 18 and over. We don’t knowingly collect data from anyone younger. If you think a child has given us their data, email us and we’ll delete it.

When we change this policy, we’ll update the date at the top. If a change is significant, we’ll tell you by email or in the app before it takes effect. If we change how we use Google user data, we’ll ask for your consent first.

Koyou
Nairobi, Kenya
sam@koyou.co