Koko by Tavora Ordina
Effective: October 22, 2026 · Contact: hello@tavoraordina.com
Koko is a household kitchen assistant. Your family's kitchen is personal, so this policy is written to be read — not skimmed past. The short version: your identity and your household's own data are never for sale — no emails, no names, no "this family's fridge." What we may do is study patterns across many households with identity stripped out — the kind of insight that says "families are switching to store brands this fall," never "the Smiths bought ketchup" — and we hold ourselves to that line in writing, below.
Your account. An email address and a password for the household account. The password is never stored as-is — only a cryptographic hash, managed by our authentication provider.
Your household's kitchen data. Inventory, recipes and cookbook activity, meal plans, the household meal log (what was cooked or eaten, with nutrition estimates), calendar events, chores and stars, dinner votes, shopping carts, and household member profiles (names or nicknames, a chosen avatar and color, optional dietary guardrails such as allergies and customs, optional health notes you choose to add, and — if set — a member PIN stored only as a cryptographic hash). Dietary guardrails and health notes exist solely to shape warnings and meal suggestions for your household; like everything else here, they are never sold, never shared, and never part of aggregate insights. This data lives in two places: on each signed-in device, and in your household's own partition of Koko's cloud database, so every device in the family sees the same kitchen. Access is enforced at the database level: each household can only ever read and write its own data.
Photos. Standby-screen photos stay on the device they were added to. They are not uploaded to Koko's cloud.
Receipts and schedule images. When you scan a receipt (or import a schedule or invitation), the image is sent to our AI provider to be read, and the extracted items or events come back to you for review. Koko does not keep the image after processing.
Voice — read this one, because it matters. Koko is not a listening post, and we built her so she can't become one:
Usage analytics. We record a small set of events to understand whether Koko is helping: that the app was opened, that a voice command was used, that a meal was cooked, that a receipt was scanned, that a vote was held. These events are deliberately content-blind — they never include which meal, which items, or anything your family typed or said. We cannot reconstruct your kitchen from our analytics, on purpose.
Koko's long-term business includes producing de-identified, aggregated market insights — for example, how quickly households in a region replenish a category, which kinds of recipes are rising, or what preferences are trending. These insights can be as local as a ZIP code — "households in 29138 are switching to store brands" — but never more local than that, and never about an individual household. They are built from patterns across many households with all identity removed, and we commit to three hard rules:
1. No identity, ever. Insights never include names, emails, member profiles, locations precise enough to identify anyone, or any single household's data.
2. Crowds, not families. Every figure we produce comes from groups of households large enough that no family — including yours — can be picked out of it. If an area has too few Koko households to hide a family in, we widen the area until it does. We do not attempt to re-identify anyone.
3. It flows one way. Nothing a buyer of insights gives us is ever connected back to your household or used to target you.
If this ever changes in substance, that's a change to this policy — and you'll hear about it in the app before it happens (see Changes, below).
Koko runs on a small set of infrastructure providers, each seeing only what their job requires:
Each processes data on Koko's behalf under their own privacy and security commitments; none of them is permitted to use your household data for their own purposes.
Koko is a family product: household member profiles (a name, an avatar, chores, votes) are created and controlled by the adult who owns the household account. Koko does not knowingly collect personal information directly from children, and member profiles need no more than a first name or nickname.
Household data is partitioned per household and enforced at the database layer; passwords and PINs are stored only as cryptographic hashes; AI provider keys are held server-side, never on devices. No system is perfectly secure, but Koko is built so that the sensitive paths are the well-worn, professionally audited ones (our providers'), not homemade.
If this policy changes in ways that matter, we'll say so in the app before the change takes effect — plainly, not buried.
hello@tavoraordina.com · Tavora Ordina, LLC · Saluda, South Carolina, USA