Privacy

Kolibo follows a simple principle: as little data as possible – and what the app reads stays with you, unless you send it to your AI yourself as part of a request.

Controller

This website

Hosting and server logs

When you visit the website, our hosting provider processes technically necessary data: IP address, time, requested address and browser identifier. The logs are used only for troubleshooting and preventing abuse, are not used for profiling and are deleted after 7 days. The legal basis is our legitimate interest in secure operation (Art. 6 (1) (f) GDPR).

No cookies, no tracking

We do not set cookies and do not use analytics or advertising services. The examples on this page run entirely in your browser; no actual AI is called. Your language choice is stored locally in your browser only.

Third-party fonts and scripts

• Google Fonts (Google Ireland Ltd.): loads the fonts. Google receives your IP address in the process.
• unpkg (Cloudflare, Inc.): delivers the smooth-scrolling library. Your IP address is transmitted in the process.

The legal basis is our legitimate interest in a consistent, readable presentation (Art. 6 (1) (f) GDPR).

Contact by email

If you write to us, we store the sender, message and attachments for as long as necessary to reply. For support cases, we keep the history for up to 24 months and delete it afterwards.

The Kolibo app

What Kolibo reads – and when

Kolibo only reads when you press the shortcut: the active app, the input field, selected text and – if you allow it in the settings – a screen capture of the current window. Nothing is read or recorded in the background.

Your AI, your account

For answers, Kolibo uses the AI subscription you connect yourself: Claude (Anthropic) via Claude Code or ChatGPT (OpenAI) via Codex. The context that was read goes directly from your account to this provider together with your request. We do not receive this data. The provider’s privacy policy applies to its processing.

Dictation

Speech recognition uses Apple’s speech recognition on your Mac. Audio is not transmitted to us.

Projects and GitHub

Kolibo reads connected project folders read-only and only when a question requires it. Kolibo creates GitHub issues or comments only after your confirmation, through your own GitHub account.

Trial and license

Lemon Squeezy (Lemon Squeezy, LLC) handles purchases as the merchant of record. Lemon Squeezy collects payment and billing data as well as your IP address and issues the invoice; we only receive your email address, name, the purchased product and the license key.

When activating and deactivating, Kolibo sends the license key and the name of your Mac to Lemon Squeezy. At most every 14 days, Kolibo quietly checks whether the key is still valid. The trial period is counted locally on your Mac only. The legal basis is the performance of a contract (Art. 6 (1) (b) GDPR).

Updates

Once a day, Kolibo asks our server (m.codepa.de) whether a new version is available. This transmits your IP address, the Kolibo version and the macOS version. You can turn off automatic checks in the settings. The legal basis is our legitimate interest in secure, up-to-date software (Art. 6 (1) (f) GDPR).

Setting up the AI

When you click “Install” during setup, Kolibo downloads the provider’s official program: Claude Code from Anthropic (claude.ai) or the Codex CLI from OpenAI (github.com). These providers receive your IP address in the process. You sign in directly with Anthropic or OpenAI in your browser.

Stored locally

Settings, what you tell Kolibo about yourself, rules, projects and created documents stay on your Mac. Apart from the license check, the update check and installations you start yourself, Kolibo does not make any connections of its own: no telemetry, no crash reports, no tracking components.

Your rights

Under the GDPR, you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw any consent at any time. Just write to info@codepa.de; we usually reply within 30 days.

You can also lodge a complaint with a data protection supervisory authority, for example the Independent Data Protection Centre Saarland (Unabhängiges Datenschutzzentrum Saarland).

Last updated: November 2026