Kohet is operated by the Kohet operator, the data controller for the personal data described here. For any privacy question or request, write to [email protected].
| Data | Why | Legal basis |
|---|---|---|
| Username, email address, password (stored only as a hash), and, if you turn on two-step sign-in, its secret (stored encrypted) and recovery codes (stored only as hashes) | To create and secure your account, confirm your address and let you reset your password | Performance of our contract with you |
| Your content: routines, categories, tasks, lists, schedules, notes and time constraints | To provide the service itself | Performance of our contract with you |
| Usage records: your sign-in history (the time, IP address, browser and device, and the approximate country and network of each sign-in), schedule event history, reports of suspicious activity you send | To keep the service running, to prevent abuse and to block malicious traffic, and to show you who signed in to your account so you can report what wasn't you | Our legitimate interest in a secure service |
| Google Calendar events, if you connect a calendar | To take your existing commitments into account when building a schedule | Your consent, given when you connect the calendar |
| Marketing preference | To send occasional product updates, only if you asked for them | Your consent |
When you ask Kohet to generate or rearrange a schedule, the routines, tasks and notes needed for that request are sent to OpenAI, which processes them on our behalf and returns a proposed schedule. Your password is never sent. If you prefer to use your own OpenAI key, you can supply one in your profile; it is stored encrypted and used only for your own requests. If you never use schedule generation, none of your content is sent to OpenAI.
You can choose to encrypt your tasks, routines, lists, schedule, career entries, notes, calendar event titles and AI instructions with a passphrase only you know (Profile, Encryption). The passphrase never leaves your browser, and our database, its backups, our logs and our administrators see only encrypted characters. While you use Kohet, the server decrypts your text only for the moment it handles your request, to show it to you and to plan your day; we never store, log or look at the decrypted text, and nothing keeps your key. Schedule generation still sends the needed text to OpenAI. If you forget the passphrase, nobody, including us, can recover the encrypted text.
Only the providers we need to run the service: our hosting and database provider, our email provider (to send confirmation and password-reset messages), OpenAI (as described above), Google (only if you connect a calendar) and IPinfo, which receives only the IP address of each sign-in and tells us its country and network. They act on our instructions. We do not sell your data, and we do not use it for advertising or profiling.
Kohet sets one essential cookie, which keeps you signed in. There are no analytics, advertising or tracking cookies, so there is nothing to consent to beyond keeping the site working.
Your account and its content stay until you delete them. Deleting your account erases your routines, tasks, schedules, notes, calendar data, profile and sign-in history. The sign-in history is kept for 12 months, except sign-ins you reported as suspicious; other security logs are kept for a short period and then discarded. Unverified accounts are removed if the address is never confirmed.
You may ask us to give you a copy of your data, correct it, delete it, export it in a portable form, restrict or object to how we use it, and withdraw any consent you have given — withdrawing does not affect what we did before. Write to [email protected] and we will reply within one month. If you think we have handled your data badly, you may complain to your national data protection authority.
Your data is stored on servers in the European Union. If we ever need to move it elsewhere, we will use transfer safeguards approved by the European Commission. If we change this policy in a way that affects you, we will publish the new version here and, where the law requires it, ask you to agree again.