Legal

Privacy Policy

Effective September 24, 2026

Codename Jo is a voice assistant for email, in private beta from Kiloforge (“Kiloforge”, “we”, “us”, “our”). This policy covers two different things: this website, where you can ask for access, and the Codename Jo app itself, which is not yet generally available. They collect very different amounts of data, so they are described separately.

This website

This page sets no advertising cookies, carries no ad pixels, and shares nothing with an ad platform or data broker. Its fonts are compiled into the site at build time rather than fetched from a font CDN, and its audio and video are served from this domain — so none of that tells anyone else that you were here.

One thing does. We use PostHog, a product-analytics tool, on this site’s pages — the landing pages and the spot pages described below. It records seven things:

• A pageview when you open a page. For a spot page, the address in that record includes the spot code
• Whether you pressed the sound control in chapter 01, and whether you were switching it on or off
• Whether you pressed the App Store button, and which of the two on the page it was
• Whether you submitted a waitlist form, on the landing pages that still carry one — and this event carries the email address you typed into it
• Or whether you left that form without submitting it. This one records only that it happened, never anything you had typed
• Whether you pressed Copy link or Share on a spot page — the event says which button and which page you were on, nothing else
• Which controls you clickand which form fields you use, recorded as the element and its visible label (“Get notified”, “Copy link”, the email field) — never what you type into a field — and, when you leave a page, how long you were on it and how far down you scrolled

The email is the part worth being plain about: your email address reaches PostHog as well as our own database, and it is attached to the analytics record for your browser rather than held anonymously. PostHog also assigns your browser an identifier and stores it in a cookie and in local storage, so that repeat visits are recognised as the same device. The data goes to PostHog’s US cloud. PostHog processes it on our behalf under contract, not for its own purposes, and we use it to understand how many people reach the page and how far they get.

If you would rather not be counted, a browser-level “Do Not Track” setting is honoured — PostHog is told not to record you — and a tracker-blocking extension will block it outright. Nothing on the page depends on analytics working; the form submits either way.

The introduction audio never plays on its own. It plays only if you press the sound control, and it is not downloaded until you do. The videos on the page are silent unless you start the film yourself.

What the waitlist form collects

Today the Join Waitlist form sends us one thing: your email address. It is required, and it is the only reason the form exists.

The record we keep against that address has room for three more fields — your name, which email client you use, and a free-text answer about when in your day you would want to work hands-free. No form on this site collects them at the moment. If we add one, it will be optional, and this list is the complete set of things we will ever ask it for.

Signing up also mints a spot code— twelve random characters we keep with your record. The code is the address of your spot page, a page that shows your position on the list and nothing else; it does not contain or reveal your email address, and it cannot be guessed from it. Anyone you hand the link can see the number, so share it as widely or as narrowly as you like. This site also keeps the code in your browser’s local storage, only so it can offer you the way back to your own page.

The request also carries a timestamp and your browser’s user-agent string, which we keep alongside the signup. Your IP address reaches our server, as it does with any web request, and is used to rate-limit abuse of the form; it is not stored with your signup.

Signups are written to a private database we control and may be forwarded to an internal notification tool so we see them as they arrive. They are not added to any marketing list, uploaded to an ad platform, or shared with anyone outside Kiloforge.

What we do with it

• Decide who to invite into each beta cohort, and get in touch to arrange it
• Write to you occasionally about the beta — every week or two, as the page says, and nothing else
• Read the free-text answers to decide what to build first

We do not sell your data. We do not use it for anything other than getting Codename Jo into your hands.

The Codename Jo app

Codename Jo is in private beta and is not yet open to the public. Doing its job means reaching two kinds of information that this website never touches — your mailbox and your voice — so the terms below apply once you are actually using the app.

Mailbox access

You connect your mailbox through your provider’s own authorization screen — Google, Microsoft, or Apple — and grant Codename Jo access there. We never receive or store your email password, and you can revoke that access at any time from your provider’s account settings, without asking us. The token that authorization produces is stored on your phone, not on our servers. The app reads the messages it needs to describe your inbox, and sends, archives, or files messages only on your instruction.

Google user data

Codename Jo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

In plain terms, that means this. We do not use anything from your Google account — the raw mail and calendar data, or anything derived, aggregated, or stripped of your name — to train or improve any artificial intelligence or machine learning model, ours or anyone else’s. We do not transfer it to anyone for that purpose, and we do not sell it. We use it for one thing: running the features you switched on when you connected your mailbox.

We do not use your Google data to serve you advertising, and we do not use it to build a profile of you for anything other than doing the job you asked Codename Jo to do.

Voice

When you talk to Codename Jo, what you say is captured as audio and converted to text so the app can act on it. Your spoken instructions and the message content needed to answer them are processed by OpenAI’s API, which generates Codename Jo’s replies. OpenAI does not use data submitted through their API to train or improve their models, and they act on our behalf under contract rather than for their own purposes.

When a message has an attachment — a PDF, an image, or an Office document — Codename Jo sends that attachment to Google’s Gemini API so it can read and summarize the contents for you. Google does not use data submitted through the Gemini API to train its models. No other AI or machine learning service receives your mail or calendar data.

Account and diagnostics

Your Codename Jo account holds an identifier from the sign-in provider you chose, your preferences, and a record of the actions the app took for you. The mailbox connection itself stays on your device, as described below. If Codename Jo is ever a paid product, purchases will be handled by the platform’s app store and we will receive only subscription status — never your card details. We collect anonymized crash reports and basic reliability diagnostics, which do not include the contents of your mail.

How we protect what we hold

Everything travels between your device and us over an encrypted connection, using TLS. Nothing about your mailbox or your voice moves in the clear.

Your mail does not live with us. Jo reads your messages on your phone to answer you, and we keep no copy of message content on our servers. What we do hold — your account record, your preferences, and the record of actions the app took — we store encrypted. The encryption is AES-256, applied at rest by our infrastructure provider.

The mailbox connection is a token, never a password, and it is stored only on your phone. We do not hold a copy, so there is nothing on our side that can open your mailbox. Delete the app and the token goes with it. Revoke access from your provider’s own settings and it stops working immediately.

Access to the production systems holding any of this is limited to the small number of people at Kiloforge who need it to keep the service running. It is granted per person rather than shared. No one at Kiloforge reads your mail out of curiosity. We look at your data only when you have asked us to fix something, when we have to investigate a security problem, or where the law requires it — and the first of those we will always ask you about first.

Retention and deletion

We keep your waitlist entry until you ask us to remove it. Email hello@kiloforge.com from the address you signed up with and we will delete it within 30 days — you do not have to give a reason. Ask us in the same message and we will delete the analytics record for that address too.

If you are in the beta, deleting the app removes the mailbox token from your phone, and deleting your Codename Jo account removes your account record, preferences, and activity history. Deleted data cannot be recovered.

Children

Codename Jo is a work tool and is not directed at children under 13. If you believe a child under 13 has signed up, contact us and we will remove the record.

Changes to this policy

If we make material changes we will update the effective date at the top of this page, and notify anyone on the waitlist or in the beta by email. We will not quietly widen what we collect and leave you to notice.

Contact

Questions, deletion requests, or anything else about your data: hello@kiloforge.com.