Privacy Policy

Last updated 28 October 2026

Kopya takes pictures of your screen. That deserves a plain explanation of where those pictures go, so this policy starts there.

Your screenshots

When you press the hotkey, the app captures your primary display, downscales it, and sends it over TLS to our server, which forwards it to our model provider for inference. Then:

Kopya does not intentionally retain it after processing. Our application processes the image in memory for the request and does not add it to our database or application storage.
Provider application storage is disabled. We send each request with the Responses API's storage setting disabled. OpenAI states that API inputs and outputs are not used to train its models by default unless the account owner explicitly opts in.
Limited provider retention can still apply. OpenAI says request content may be retained in abuse-monitoring logs for up to 30 days by default and may be accessed by authorised personnel or contractors for abuse investigation, support, or legal compliance. Images flagged by safety classifiers may be retained for manual review.
Kopya does not intentionally retain the answer either. It is returned to your app and is not added to our database or application storage.

The practical consequence: capture only what you are entitled to capture. If your screen shows someone else's confidential information, sending it to us — or any AI tool — may be something your employer or the law has an opinion about.

What we do store

Account

Your email address, display name and avatar URL, from the provider you sign in with.
How you signed in — Google, or an emailed sign-in link — and the account identifier that came with it.
Your plan, subscription status and renewal date.
Your language preference, so the app can open in the language you chose.

Devices

A name for each desktop install (your computer's hostname), its platform and app version, and when it was last active.
A cryptographic hash of its session token — never the token itself, so a breach of our database does not yield working credentials.

Usage

For each request: timestamp, token counts, computed cost, and whether it succeeded. This is what enforces the limits in the Fair Use Policy and what you see on your dashboard.
Kopya does not add the screenshot, question, or answer to its usage database.

Who else touches your data

OpenAI — receives the screenshot and question to generate the answer, with application storage disabled. Its API data controls still allow abuse-monitoring logs for up to 30 days by default, while API inputs and outputs are not used for training by default. See OpenAI's API data controls.
Polar — our payment provider, authorised reseller and merchant of record. Polar handles checkout and holds your billing details; we never see your card number. Your IP address is forwarded to Polar when checkout begins so it can select the payment currency, prefill the billing country and calculate applicable tax.
Google — if you sign in that way, receives a standard OAuth request and returns your basic profile.
Resend — our email provider, delivers your sign-in link. It sees your email address and nothing else.
NOWPayments — if you pay in crypto, processes that payment. We never see your wallet beyond the confirmation that payment arrived.
Neon and Vercel — our database and hosting providers.
Meta, Reddit and OpenAI advertising — only if you accept advertising cookies. See the next section for exactly what they receive.

Cookies and advertising measurement

Kopya sets a small number of essential cookies for sign-in, security and your language choice. These are needed for the service to work and do not require consent.

We also run ads on Meta (Facebook and Instagram), Reddit and ChatGPT, and we would like to know which of them bring people who actually use Kopya. That measurement is optional and happens only after you accept it in the cookie banner. You can use the whole site, download and use the app, sign up and pay without accepting it, and you can change your mind at any time via Cookie preferences in the footer. Browsers that send a Global Privacy Control or Do-Not-Track signal are treated as a refusal.

Separately, we count visits to kopya.ai without cookies: when you arrive, we record the kind of source (for example a search engine, another site's domain, or an ad campaign name) and the page you landed on, never its query string. To count unique visitors we keep a one-way key computed from your IP address and browser type with a secret that changes every day, so it cannot be reversed or used to recognise you on another day; the IP address itself is not stored. Nothing is saved on your device, the data stays with us, and browsers that send a Global Privacy Control or Do-Not-Track signal are not counted.

When you create an account, we use the same daily key, on our server only, to note which of those sources your visit in the preceding 24 hours came from (for example “Instagram ad” or “Google search”) and save that source with your account. After you sign up, the dashboard may also ask how you heard about Kopya; answering is optional. We use both only to understand which channels bring people to Kopya. They are not shared with advertising partners and do not depend on your cookie choice, because nothing is read from or stored on your device.

With your advertising consent, we also report completed account registrations, website download-button clicks and your first successful desktop-app answer to OpenAI through its Conversions API to measure ChatGPT ads and optimize delivery toward completed registrations. Each report contains the event time, a stable event identifier, your hashed email address and the original OpenAI ad-click identifier when available. No OpenAI advertising Pixel is installed; OpenAI receives no screenshot, question, answer, raw email or device identifier.

If you accept, the following happens:

The Meta Pixel and the Reddit Pixel load on kopya.ai and set their first-party cookies (_fbp, _fbc, _rdt_uuid, _rdt_cid). Their scripts report page views and the events below to Meta and Reddit.
Our servers report the same events to Meta's and Reddit's Conversions APIs: a download click, account creation, the first time the app answers a question for your account, and a completed purchase (with the order value and currency). Each event carries an identifier so both copies of an event are counted once.
To match those events to an ad, we send the pixel cookie values, the click identifier from the ad link, your IP address and browser type as seen on kopya.ai, and, for account-level events, a SHA-256 hash of your email address and of your account id. We never send your screenshots, questions, answers, name, card details or raw email address.
We keep our own record of how you found us (campaign parameters such as utm_source and the campaign, ad set and ad ids in the ad link, the page you landed on, the referring site and the click identifiers) together with your consent, for up to 90 days after your last visit. When you sign in, this record is linked to your account. If you request a sign-in link in one browser and open it in another (for example from Instagram's in-app browser), we keep a one-way hash of your email address for up to 24 hours to connect the two; nothing extra is added to the link.
When the app first answers a question for your account, we save the campaign that brought you alongside that event, so we can count which campaigns lead to real use. We also keep a record of the events above linked to your account. Data needed to send an event to Meta or Reddit, and data needed for OpenAI signup, download-click and activation reports, is deleted as soon as it has been delivered, or after 7 days at the latest.

Withdrawing consent stops the pixels, removes their cookies from your browser, deletes our stored attribution (including the campaign saved with your first answer) and cancels any event that has not yet been sent. Events already delivered are held by Meta and Reddit under their own policies: Meta privacy policy and Reddit privacy policy. OpenAI advertising reports follow the OpenAI privacy policy. Meta and Reddit act as independent controllers for what they do with that data, including combining it with their own account data.

Your rights

You can see everything we hold about you on your dashboard. You can disconnect any device there, which invalidates its session immediately.

To export or delete your account and all associated data, email hello@kopya.ai. Deletion removes your account, devices and usage records; it does not remove invoices we are required to keep for tax purposes.

Depending on where you live you may have additional rights under the GDPR, UK GDPR, CCPA or Turkish KVKK, including access, rectification, portability and objection. The same email address handles all of them.

Retention

Account and device records: until you delete your account.
Usage records: 90 days, then aggregated and the per-request rows deleted.
Advertising consent and attribution: 90 days after your last consent refresh or visit, or immediately on withdrawal.
Campaign saved with your first answer: until you withdraw consent; if you delete your account it is no longer linked to you.
Sign-in link hand-off (email hash): 24 hours, or as soon as the link is used.
Cookieless visit statistics: about 13 months.
Sign-up source and your “how did you hear about us” answer: until you delete your account.
Invoices: as long as tax law requires.

Contact

Questions about this policy go to hello@kopya.ai.