Privacy Policy

Ikuzo AB (org. no. 559323-4569), Pyrolavägen 28, 181 60 Lidingö, Sweden, provides Rimokon and is the controller of personal data described in this policy. “Rimokon,” “we,” and “us” refer to Ikuzo AB.

For any privacy question or request, including access, correction, export, objection, or deletion, email user-support@rimokon.ai. Please do not include passwords, payment-card numbers, or other secrets in your message.

• We do not sell personal data.
• We do not use your data to build advertising profiles or serve targeted ads, and the app contains no advertising or product-analytics services.
• Remote-control commands and microphone audio for your TV travel directly between your phone and your TV or media device on your own network.
• Our main production account database is hosted in Frankfurt, Germany, and our error-monitoring service is hosted in Germany.
• Diagnostics are deliberately limited, never include what you type or say, and you can turn them off in Rimokon’s privacy settings.
• You can delete your Rimokon account and its data at any time.

The information depends on which Rimokon features you use:

• Account and sign-in data: name, email address, a securely hashed password if you set one, profile image if supplied by your sign-in provider, provider account identifiers, sessions, short-lived email codes, and records needed to protect your account.
• Household data: the households you belong to, your role, invitations and join codes, and the name, email address, and profile image that other members of a household can see.
• TV and device data: the TVs and media devices your household adds, including their name, model and type, a device identifier, their last known local network address and port, their network hardware (MAC) address for wake-up, whether they have been paired, and the pairing credentials the household uses to control them.
• Things you create: remote layouts, widget layouts, lists, favourites, watchlists, streaming-service and display preferences, and who you share each layout or list with.
• TV activity: which TV apps were opened or seen in the foreground and which titles Rimokon was asked to open, if TV activity is on (see section 7).
• Ask and support content: your Ask conversations, the titles and list changes in them, feedback, support messages, and other text you deliberately send to a cloud feature.
• Purchase data: the household’s plan, trial dates, purchases, AI-search and TV-slot balances, subscription status, and customer and transaction identifiers from Stripe, Apple, Google, or RevenueCat. When you pay through Stripe, Stripe collects your payment details and the billing name, address, and email needed to charge you and calculate tax. Rimokon never receives or stores complete card numbers.
• Technical data: app and operating-system versions, platform, broad device category, language and region settings, the app store’s country, feature outcomes, performance data, security events, and a random installation identifier. Like any internet service, our servers and Cloudflare process your IP address to deliver requests and to protect the service, for example to limit repeated attempts to guess an invitation code.
• Website data: essential cookies or equivalent session tokens when you sign in, for example on rimokon.ai/account. The website uses no advertising or analytics cookies.

We receive data from you, your device, other members of your household, the TV or media device you ask Rimokon to control, and the providers you choose to use with Rimokon.

You can create an account with your email address and a password. We send a six-digit code to confirm the address before the account can be used, and a similar code if you reset your password. Codes expire after 10 minutes and are stored only in hashed form. Resetting your password signs out your other sessions. We store passwords only as a one-way hash.

If you choose Google or Apple sign-in, that provider authenticates you and gives Rimokon the basic identity information needed to create or find your account. This normally means your provider identifier, name, email address, and profile image where available. Apple may provide a private relay email address if you choose Hide My Email. We never receive your Google or Apple password.

Rimokon requests only sign-in scopes. We do not request access to Gmail, Google Drive, contacts, calendars, iCloud files, or photos. Sign-in data is used for authentication, account security, service emails, and user-requested support, not advertising. Disconnecting Rimokon from Google or Apple does not by itself delete the Rimokon account; see section 13 for how to delete it.

We send service emails, such as sign-in codes, a welcome message, household invitations, and purchase and subscription notices, through our email provider, Resend. We do not send marketing email.

Rimokon uses local-network permission to find and control compatible TVs and media devices. Commands travel directly between your phone and the selected device on your network. We do not use local-network access to create advertising profiles or scan unrelated devices for marketing.

TVs your household adds are saved to the household on our service, so every member’s phone can use them. To let anyone in the household control a paired TV without pairing again, the household’s TV pairing credentials are also stored with the household on our service. These credentials only work with TVs on your own network. On your phone, credentials are kept in the operating system’s protected storage where supported.

Voice. When you hold Talk, the phone’s speech recognition turns your speech into text, on the device where your phone supports it and otherwise through Apple’s or Google’s speech service under their terms. The text is typed into your TV or, in Ask, sent as your question. When your TV opens its own voice search, the phone instead streams microphone audio directly to the TV over your local network, and the TV’s voice assistant handles it under the TV maker’s terms. Rimokon’s servers never receive your voice audio, and we do not log what you say.

Widgets and watches. Home-screen widgets and the Apple Watch and Wear OS apps use layouts and TV details stored on your phone. A watch sends each key press through your phone to your TV; it does not talk to our servers.

When you use Ask, Rimokon sends your question and the context needed to answer it to our service, which runs it through an AI model. Depending on the request, that context can include earlier messages in the same chat, your language and country, your household’s streaming services, titles from your lists, and titles already shown in the chat. Ask can read your lists and, when you ask it to, add or remove titles; each change is shown to you and can be undone.

The AI model runs through Cloudflare’s AI services (Workers AI and AI Gateway). The model we currently use is provided by OpenAI and reached through Cloudflare; we ask it not to store conversations. To find and check titles, Ask also sends search terms and title identifiers, never your account details, to the film and TV data sources listed in section 11. We do not use Ask conversations for advertising, and AI answers can be incomplete or wrong.

Chats saved across devices are private to you: other members of your household cannot read them. They are kept until you delete them or your account or household is deleted, and the app keeps a copy on your phone so they open quickly. While an answer is being written, it is held for up to 10 minutes so the app can resume it if you leave the app.

Rimokon is organized around households. Members of a household can see each other’s name, email address, and profile image, the household’s TVs, its plan, and the layouts and lists shared with them. For each layout or list you choose who can see it: only you, the whole household, or the members you pick. When you invite someone, we email the invitation to the address you enter; invitation links expire after 48 hours.

TV activity is on by default. When it is on, your phone records which TV apps were opened or seen in the foreground and which titles Rimokon was asked to open. This activity belongs to the household and is used only to personalize the Watch tab, for example to favour the services you actually use. Playback itself is not tracked. Any member can stop their phone from recording under Settings › Privacy, and the household owner can delete the recorded activity for everyone.

We process information to:

• create, authenticate, and secure accounts and sessions;
• provide device control, synchronization, households, sharing, discovery, and Ask;
• manage trials, purchases, subscriptions, support, and service emails, including tax and accounting records;
• detect abuse, investigate faults, and improve reliability and usability;
• comply with tax, accounting, consumer-protection, and security obligations; and
• establish, exercise, or defend legal claims and protect users and third parties.

Where European data-protection law applies, our legal bases are performance of our contract with you; our legitimate interests in operating, securing, and improving a reliable service, including diagnostics and TV activity; consent where the law requires it; and compliance with legal obligations. You can object to diagnostics and TV activity at any time by turning them off in the app.

We use layered logging so routine operation produces little data while faults remain diagnosable:

• On-device buffer: the app keeps up to the latest 200 structured log lines in memory. This buffer is not uploaded by itself. It can accompany a crash or reported fault and disappears when the app process ends. Rimokon does not keep log files on your device.
• Error monitoring: crashes, errors, app hangs, and faults the app detects in itself are sent to Sentry, with the recent log lines from the buffer above. Our servers report their own errors to Sentry too. A small sample of performance traces is also sent: about 5% from the app and about 1% from our servers.
• App logs: the app sends its structured information, warning, and error lines through our own servers to Cloudflare’s logging service, where they are kept for about 7 days. They are linked to a random installation identifier and, when you are signed in, to your account ID, never to your email address. A small daily summary of counts is sent the same way. We do not use a separate product-analytics service.
• Server logs: each API request produces a structured record of the route, method, status, duration, request identifier, the Cloudflare data center that handled it, and the broad app or browser family. Some service events, such as purchases, sign-in emails, and Ask usage, also record account or household identifiers, never email addresses. We do not intentionally log request bodies, cookies, authorization headers, full user-agent strings, or URL query values. Server logs are kept in Cloudflare’s logging service for about 7 days.
• Temporary extended logging: when troubleshooting a reported issue, you or support may enable more detailed logging for your installation or account for a limited time. It adds debug lines, protocol-frame metadata, and full performance traces, and switches itself off when that time ends (24 hours when you turn it on in the app). Pre-release test versions of the app always use extended logging.

Our logging rules exclude typed text, recognized speech, programme titles, email addresses, authentication secrets, and message content. Public IP addresses and MAC-address patterns are scrubbed. A private local-network IP address may appear in fault diagnostics because it is sometimes necessary to determine why a TV could not be reached, and the name of the TV app in the foreground may appear when diagnosing voice or typing. Turn off “Share diagnostics” under Settings › Privacy to stop crash reports, error reports, and app logs from that installation.

We use an EU-first setup. Rimokon’s main production database is hosted by PlanetScale in Frankfurt, Germany. Error monitoring uses Sentry’s German region. Pre-release test versions of the app use a separate test database that is also hosted in Frankfurt.

Rimokon runs on Cloudflare’s global network. Requests may be handled at a data center near you, and Cloudflare services, including Workers, Workers AI, AI Gateway, Durable Objects, and Workers Logs, may process data outside the European Economic Area. The AI model provider, our email provider, Google, Apple, Stripe, RevenueCat, Expo, and app marketplaces may also process data internationally, including in the United States. We therefore do not claim that every request stays physically inside Europe. Where European law requires it, international transfers rely on an adequacy decision, contractual safeguards such as the European Commission’s Standard Contractual Clauses, or another lawful transfer mechanism.

We share only the information reasonably needed to provide, protect, and support Rimokon. Our service providers are:

• Cloudflare: hosting, networking, security, logs, and AI services (Workers, D1, KV, Durable Objects, Hyperdrive, Workers AI, AI Gateway).
• PlanetScale: our production database. Neon hosts the separate test database.
• OpenAI: the AI model behind Ask, reached through Cloudflare.
• Sentry: crash and error monitoring, unless you turn diagnostics off.
• Resend: sending service emails.
• Google and Apple: sign-in, the App Store and Google Play, in-app purchases, and speech recognition when it cannot run on your phone.
• Stripe: payments, invoices, tax calculation, and the subscription management page.
• RevenueCat: confirming App Store and Google Play purchases. It receives a household identifier and the store’s purchase records, not your name or email address.
• Expo: delivering app updates. The app checks for updates on launch, which shares your IP address, platform, and app version with Expo.
• Film and TV data sources: TMDB (titles, artwork, and where-to-watch data from JustWatch), Movie of the Night, Wikidata, and Netflix’s public Top 10 lists. They receive search terms and title identifiers from our servers, never your account details. Posters and artwork in the app load directly from TMDB, and trailer thumbnails from YouTube, which lets those services see your IP address.

Providers act under their own terms and, where applicable, data-processing agreements with us. We may also disclose information when legally required, to respond to a valid request from an authority, to protect users or the service, or as part of a merger, financing, reorganization, or sale. We do not disclose personal data to data brokers or advertisers.

We keep personal data only for as long as needed for the purpose described above:

• Account, household, TV, layout, list, and settings data are kept while the relevant account or household exists.
• Ask chats saved across devices remain until you delete them or the relevant account or household is deleted. Each account keeps at most 100 chats per household.
• TV activity remains until the household owner clears it or the household is deleted.
• Email codes expire after 10 minutes and invitations after 48 hours. Session and security records remain until they expire, are revoked, or are no longer needed.
• App and server logs are kept for about 7 days. Crash and error reports are kept by Sentry for about 30 days.
• Purchase, tax, accounting, dispute, and fraud-prevention records may be kept for the period required by law or reasonably necessary to establish or defend a claim.

Deleted information may remain temporarily in restricted backup copies until those copies rotate out under the provider’s normal backup schedule. Backups are used for disaster recovery, not ordinary access. We delete or de-identify information when its retention purpose ends unless the law requires us to keep it.

You can delete your account at any time in the app: tap your name at the top of Settings, then Delete account. You can also sign in at rimokon.ai/account and delete it there. Either takes effect immediately; the steps are also on our account deletion page. If you can use neither, email user-support@rimokon.ai from the email address associated with your account and state that you want your Rimokon account and personal data deleted. We may ask for limited additional information to verify that the request is yours.

We will respond to an emailed request without undue delay and ordinarily within one month. If a legally permitted extension is necessary because a request is unusually complex, we will explain why and when you can expect completion.

Deleting your account removes the account, its sessions and sign-in methods, your Ask chats, your private lists and settings, and your household memberships. A household where you are the only member is deleted with everything in it. A household you own that others share is handed to the member you choose, and its TVs, shared layouts, and shared lists stay with them. Pending household invitations sent to your email are deleted. If the household paid through Stripe, we keep the Stripe customer record for bookkeeping, with your name and email removed or replaced by the new owner’s. Records of administrative actions keep your account identifier, but not your contact details. We may retain the limited records described in the retention section when law, fraud prevention, security, billing reconciliation, or legal claims require it.

Deleting Rimokon does not delete your Google, Apple, Stripe, app-store, TV-manufacturer, or streaming-service account. It also cannot recall data stored only on another household member’s device. If you subscribed through the App Store or Google Play, cancel the subscription there as well; deleting your Rimokon account does not stop store billing.

Depending on where you live, you may ask to access, correct, export, or erase your personal data; restrict or object to processing; and receive portable data you provided. You may withdraw consent where processing depends on consent. These rights can have legal limits; for example, we may need to preserve invoices or security evidence.

Send a request to user-support@rimokon.ai. You may also complain to the data-protection authority where you live or work. Our lead authority in Sweden is Integritetsskyddsmyndigheten (IMY).

We use safeguards intended to match the nature of the data and the risks involved. These include encrypted transport, hashed passwords and email codes, protected secret storage, role-based access, session and authorization controls, rate limits, data minimization, pseudonymous diagnostic identifiers, log scrubbing, dependency updates, and monitoring for faults and abuse. Access to production systems is limited to people and providers who need it to operate or support Rimokon. When investigating a problem you report, authorized staff may view your account as you see it; such access is recorded in an audit log.

No internet service can promise absolute security. Please keep your devices and sign-in method secure and contact us promptly if you suspect unauthorized access.

Rimokon is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided personal data, contact us so we can investigate and remove it where appropriate.

We may update this policy when Rimokon, our providers, or legal requirements change. We will change the “Last updated” date and provide additional notice when required. Material changes apply prospectively. See our Terms of Service for the rules governing use of Rimokon.