Privacy Policy

1. Who Controls Personal Information

The Data Fiduciary (or Data Controller) responsible for your personal information is the individual creator and sole operator of PIKO, based in Bangalore, Karnataka, India.

For all data protection inquiries, privacy rights requests, or regulatory questions, contact our desk at support@heypiko.app. Full statutory identity details are maintained in our pre-launch compliance register and will be published alongside formal commercial distribution.

2. Scope of This Policy

This Privacy Policy governs personal data processed when you visit our website (heypiko.app and piko-delta.vercel.app), create an account, download and run the PIKO desktop application for Windows, activate a 7-day trial, purchase a subscription, or communicate with our support and grievance desk.

3. Information Collected

We strictly limit data collection to categories necessary to provide the service and prevent abuse:

• Account & Authentication: Your email address, encrypted authentication credentials, account creation timestamp, and last sign-in timestamp (managed via Supabase Auth).
• Licensing & Device Identity: A one-way cryptographic hash (HMAC-SHA-256) derived from standard Windows system identifiers (MachineGuid and SMBIOS UUID), registration timestamp, and operating system version. Raw hardware serial numbers and personal computer names are never permanently stored.
• Subscription & Transaction Metadata: Dodo Payments customer ID, subscription status (active, past_due, canceled), renewal date, and transaction timestamps. We never receive or store credit card numbers or banking secrets.
• Customer Support & Grievances: Inquiries, bug reports, and grievance records submitted voluntarily via email or our support forms.
• Security Audit Logs: Timestamped records of authentication attempts, device activations, and license validation calls, retained for system integrity and abuse detection.

Prohibited Personal Data Categories (Strict Non-Surveillance Guarantee)

Treating privacy as an immutable architectural constraint, PIKO is engineered so that it strictly never collects, accesses, logs, or transmits:

• Personal files, documents, photos, downloads, desktop files, or folder contents.
• Keystrokes, keyboard input histories, typed text, or clipboard data.
• Mouse movements, cursor coordinates, click logs, or user-activity telemetry.
• Screenshots, screen recordings, desktop visual frames, or webcam video.
• Microphone audio, ambient sounds, or room conversations.
• Browser histories, visited URLs, web cookies, or browsing sessions.
• Emails, chat communications, contacts, or messaging logs.
• Operating system process inventories or lists of unrelated running applications.

4. Purposes of Processing

Your information is processed strictly for the following defined purposes:

• Authenticating your account and delivering secure software downloads.
• Enforcing the 7-day full-access trial (604,800,000 milliseconds) and preventing automated trial farming.
• Enforcing our 1-computer licensing policy and managing authorized device transfers.
• Facilitating subscription billing and payment reconciliation through Dodo Payments.
• Responding to customer support inquiries and statutory grievance complaints.
• Detecting, preventing, and investigating fraud, security incidents, or software tampering.

5. Legal Basis & Consent

We process your personal data under the following recognized legal bases:

• Performance of Contract: Processing necessary to provide account access, software licensing, and subscription services under our Terms of Service.
• Legitimate Interests: Protecting software assets from trial fraud, credential stuffing, and unauthorized multi-computer piracy.
• Consent: Explicit, affirmative consent provided during account registration or when submitting voluntary privacy rights and support inquiries. You may withdraw consent at any time.
• Legal Compliance: Retaining mandatory financial and security records required by applicable cyber and tax regulations.

6. Device Registration & Anti-Abuse Hashing

To honor our single-computer subscription policy and protect against trial abuse without invasive digital rights management (DRM):

• The desktop application reads standard unprivileged Windows system identifiers (the Windows Cryptography MachineGuid and SMBIOS system UUID).
• Upon transmission over encrypted TLS, our server immediately converts these identifiers into a one-way cryptographic hash (HMAC-SHA-256).
• Raw hardware serials, disk volumes, CPU signatures, and user profiles are never permanently stored.
• When you transfer your license to a new PC, the previous device hash is automatically deactivated.

7. Local-First Processing

PIKO's companion intelligence, character state machine, 80 expressions, 16 spontaneous activities, custom audio synthesis, 20-20-20 wellness timer, and color customization themes run 100% locally on your PC.

All companion settings, unlocked expressions, and energy levels are saved locally on your computer in your Windows AppData directory. They are never continuously synchronized or harvested to remote analytics servers.

8. Desktop Window Interaction & Perching

PIKO includes optional native window-perching behavior that allows the character to rest on the top border of active desktop application windows.

This functionality operates entirely locally using standard Windows Win32 API calls (GetWindowRect and EnumWindows) to calculate coordinates. PIKO never reads, captures, parses, logs, or transmits window titles, screen pixels, keystrokes, clipboard data, or application contents.

9. Stay Awake Mode & Native Windows Power Architecture

PIKO includes an optional Stay Awake Mode to keep your computer awake during render jobs, presentations, or long-running work tasks.

• Native Windows Power APIs: Stay Awake communicates directly with Windows power management using standard execution state flags (SetThreadExecutionState via Electron's native powerSaveBlocker). Option A uses prevent-app-suspension (ES_CONTINUOUS | ES_SYSTEM_REQUIRED) to keep the system awake while letting your display sleep per Windows settings. Option B uses prevent-display-sleep (ES_CONTINUOUS | ES_SYSTEM_REQUIRED | ES_DISPLAY_REQUIRED) to keep both awake.
• Strictly Zero Simulated Input: Unlike crude mouse-jiggler utilities or macro scripts, PIKO never fakes keyboard presses, never simulates keystrokes, and never jiggles your mouse cursor.
• 100% Local Execution: Session timers, durations (30m, 1h, 2h, indefinite), and companion animations are processed entirely in local memory. Zero telemetry, usage counts, or session timestamps are sent to our servers.
• Power Source Awareness: Battery state is read locally via Windows powerMonitor.isOnBatteryPower() solely to prompt users before draining an unplugged laptop. Battery profiles and charging metrics are never transmitted.

10. Payment Processing & Dodo Payments

Subscription payments are handled by our Merchant of Record and authorized payment processor, Dodo Payments.

When you purchase a subscription or update your billing details, your payment card number, CVV, and expiration date are entered directly into Dodo Payments' secure, PCI-DSS compliant checkout interface. PIKO only receives confirmation webhooks indicating whether a payment succeeded, failed, or was refunded, alongside anonymous customer reference IDs.

11. Third-Party Service Providers

We engage only vetted, enterprise-grade cloud service providers bound by strict confidentiality and data processing agreements:

• Supabase Inc.: Cloud database hosting, user authentication, and secure session management.
• Vercel Inc.: Website and edge serverless API hosting.
• Dodo Payments Inc.: Merchant of Record, subscription checkout, and tax compliance.

12. Cookies & Local Storage

Our website uses strictly essential session cookies and local storage tokens required for secure user sign-in and CSRF protection.

We do not use third-party advertising cookies, cross-site trackers, Facebook Pixel, Google Analytics, or invasive behavioral tracking scripts. Review our Cookie Policy for complete technical specifications.

13. Data Retention Schedule

We adhere to documented, proportionate data retention schedules:

• Active Account Data: Retained for the duration of your active account or until you request account deletion.
• Pseudonymous Trial Anti-Abuse Records: Retained for exactly 180 days following trial expiration to prevent repeat-trial cycling abuse, after which they are automatically purged.
• Security Audit Logs: Retained for 180 days in accordance with cybersecurity incident baseline guidelines (including CERT-In Directions 2022).
• Billing Invoices & Tax Records: Maintained by our Merchant of Record, Dodo Payments, in accordance with applicable statutory financial record-keeping laws.

14. Account Deletion & Data Erasure

You have the right to delete your PIKO account at any time. When you initiate account deletion via your web dashboard or submit a verified deletion request:

• Your user profile, email address, and authentication records are permanently erased immediately.
• Active paid subscriptions are immediately scheduled for cancellation with Dodo Payments.
• Active registered devices are permanently revoked.
• Historical device trial records are permanently disassociated (the user identifier is set to null), ensuring retained hardware anti-abuse hashes can never be linked back to your personal identity.

15. Security Safeguards

We implement industry-standard technical and organizational security controls:

• All data in transit is encrypted using modern TLS 1.3 encryption.
• HTTP Strict Transport Security (HSTS) with long-term preloading is enforced across all endpoints.
• Database tables are protected by strict Row-Level Security (RLS) policies on Supabase.
• Web applications enforce strict Content Security Policy (CSP) and Permissions Policy blocking camera and microphone access.
• Webhook endpoints enforce cryptographic HMAC signatures to prevent request tampering.

16. International Data Transfers

Our cloud infrastructure providers maintain secure data centers in the United States and the European Union. By accessing the Service, you acknowledge that your account information may be transferred to and processed in these locations.

All international transfers are safeguarded by Standard Contractual Clauses (SCCs) and robust technical encryption adhering to applicable international data protection standards.

17. Children's Privacy & Age Eligibility (Adults-Only 18+)

PIKO is strictly an adults-only desktop application. We do not knowingly collect, solicit, or maintain personal information from individuals under the age of 18.

If we learn that we have inadvertently collected personal data from a minor under 18 years of age without verified parental consent, we will immediately take steps to permanently delete that information and terminate the account.

18. Incident Response & Breach Notification

We maintain an operational Security Incident Runbook to detect, contain, and remediate cybersecurity events.

In the unlikely event of a verified data breach impacting your personal information, we will notify affected individuals and relevant statutory regulatory authorities (including CERT-In where applicable) without undue delay and in compliance with applicable statutory timelines.

19. Your Privacy Rights (DPDP Act & GDPR)

Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and applicable global data protection laws, you possess the following rights regarding your personal data:

• Right to Access & Summary: Request a concise summary of the personal data we process about you.
• Right to Correction: Request the correction or completion of inaccurate personal data.
• Right to Erasure: Request the permanent deletion of your account and personal data.
• Right to Grievance Redressal: Submit a complaint to our designated Grievance Officer.
• Right to Withdraw Consent: Withdraw optional consent previously granted.

To exercise any of these rights, submit a request through our Privacy Rights Portal or email us at support@heypiko.app.

20. Complaints & Grievance Redressal

If you have concerns about our data practices or believe your statutory privacy rights have been infringed, you may submit a formal complaint to our Grievance Desk:

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect product enhancements or evolving legal standards. The updated version will be indicated by the "Effective Date" and "Policy Version" at the top of this document.

In the event of material modifications, we will notify registered users via email or desktop application banner prior to the changes taking effect.

22. Contact Us

For questions or feedback regarding this Privacy Policy, please contact our desk at:

PIKO Support & Compliance
Email: support@heypiko.app
Bangalore, Karnataka, India