Krew Privacy Policy
Last Updated: July 26, 2026
Your privacy is important to us. This Privacy Policy explains how Doğukan Özgür Yılmaz ("we", "our", "us") collects, uses, and protects information when you use the Krew mobile application (the "App"). By using the App, you agree to the practices described below. We comply with applicable data protection standards including the California Consumer Privacy Act (CCPA), the Turkish Personal Data Protection Law (KVKK), and the European General Data Protection Regulation (GDPR).
1. Scope
This policy applies to the Krew iOS application and any related services we provide. It does not apply to third-party websites, services, or applications that may be linked from within the App, including the third-party tools you choose to connect (see Section 2.4).
2. Information We Collect
2.1 Information You Provide Voluntarily
Krew is a role-based AI assistant team. To deliver the core experience, the App collects information you choose to enter, such as:
• Your profile details, display name, and avatar (optional)
• The messages, instructions, and prompts you send to your AI team in chat
• Tasks, automations, and schedules you create
• Knowledge or notes you add to your team's "brain" / workspace
2.2 Account Information
Authentication is handled through Supabase Auth and, if you choose, Sign in with Apple. We store a unique user identifier, your sign-in provider, and your email address in our secure cloud database so that your profile, chats, and saved content can be synchronized across sessions and devices.
If you use Sign in with Apple and choose to hide your email, Apple provides us with a private-relay email address. We treat this relay address as your email address.
2.3 Content You Share in Chat
You may attach photos (from your camera or photo library) and files to share with your AI team. When you do, that content is uploaded to our cloud storage (Supabase Storage) under a randomly generated, unguessable address, and that address is passed to our AI provider so it can read the content in order to answer you (see Section 4). We access your camera and photo library only when you explicitly choose to attach a photo. We do not scan or upload your photo library otherwise.
2.4 Connected Integrations
Krew lets you connect third-party tools (such as Gmail, Google Calendar, and other productivity services) so your AI team can perform work on your behalf. Connections are authorized by you through a secure OAuth flow operated by our integration provider, Composio.
• When you connect a tool, you grant access scopes that you explicitly approve during the provider's consent screen.
• We and Composio use the resulting access only to carry out the actions you (or your automations) request — for example, drafting an email or creating a calendar event.
• Access tokens are stored securely and scoped to your account and workspace. You can disconnect any integration at any time from within the App, which revokes our access.
• We do not sell, mine, or repurpose the contents of your connected accounts for advertising or any purpose other than performing your requested tasks.
2.5 Automatically Collected Information
When you use the App, we may automatically collect:
• Device information (device model, operating system version, language, region)
• App version and configuration
• A push notification token (see Section 2.7)
• Diagnostic and error logs needed to keep the App stable
We do not access your contact list, microphone, calendar (on-device), health data, location, or messages — except for the files and photos you explicitly choose to share, and the third-party tools you explicitly choose to connect.
2.6 Subscription Information
Premium subscriptions and energy/credit packs are processed by Apple via the App Store and managed through RevenueCat. We receive only the information needed to unlock features and track your balance — such as subscription status (active, expired, trial), entitlement identifier, and purchase events. We do not collect, see, or store your credit card number, billing address, or any payment instrument data.
2.7 Push Notifications
To notify you when a background task or automation finishes, we register a device push token through Firebase Cloud Messaging (Google). This token identifies your device for delivery only and is not used to track you across other apps or services. You can disable notifications at any time in your device settings.
3. How We Use Your Information
We use the information described above to:
• Provide the core features of Krew, including chat with your AI team and running automations
• Carry out the tasks you request across your connected integrations
• Maintain your profile, chats, and saved content across devices
• Validate your subscription status and enforce free-tier and energy/credit usage limits
• Send you notifications about background work you initiated
• Improve App stability, performance, and user experience
• Communicate critical updates about the service when necessary
• Comply with applicable legal obligations
4. AI-Assisted Features and Third-Party AI Providers
Krew's core functionality is powered by artificial intelligence that we do not run ourselves. To answer you, part of your content is transmitted to the AI companies named below.
4.1 Who receives your content
• OpenAI (United States) — generates your AI team's replies; reads the photos and files you attach; converts your text into numerical "embeddings" so your team can search and recall what you have saved.
• Google (United States) — generates replies using its Gemini models, and performs web searches when you ask for current information.
• Composio (United States) — only when you connect a third-party tool (see Section 2.4). Composio carries out the action you requested on that tool and returns the result, which is then read by the AI providers above.
4.2 What is transmitted
• The message you send, and up to the last 20 messages of that conversation
• Photos and files you attach. Images are read by OpenAI's vision model; text files are read as text.
• Entries from your Brain / workspace knowledge that are relevant to your request
• The configured instructions for the AI employee you are talking to
• Data returned by the third-party tools you have connected — for example, the contents of an email you asked your team to read
• A randomly generated workspace identifier, used to make repeated requests faster. It is not your name, email address, or account login.
• Every message you send and every Brain entry you save is converted into an embedding by OpenAI, including on requests that are not answered by a chat model.
• After a conversation turn completes, the message and the reply are sent once more to OpenAI to identify durable facts about your business that may be suggested for your Brain.
4.3 What is never transmitted to an AI provider
• Your name, email address, or password
• Your payment details. Apple processes payments; we never see them.
• Your contacts, location, health data, or photo library. Only the photos and files you explicitly select are shared.
4.4 Your permission
Before any of the above is sent, Krew shows you an in-app disclosure naming these providers and asks for your permission. Nothing is sent to an AI provider until you agree. You can review that disclosure, and withdraw your permission, at any time in Settings → AI data processing. If you withdraw it, the app stops sending data to these providers, scheduled automations are paused, and your AI team will not be able to reply until you turn it back on.
We send this content only to produce the result you asked for. We do not sell it, and we do not use it for advertising. Each provider processes it under its own privacy policy and data-handling commitments, and we share only the minimum needed to deliver the feature.
4.5 Accuracy
AI-generated content and actions may be inaccurate, incomplete, or unsuitable. They are provided for guidance and convenience only. You are responsible for reviewing AI output and any action taken on your connected tools before relying on it.
5. Third-Party Services
Krew integrates the following third-party services:
• Apple — App Store distribution, Sign in with Apple, in-app purchases
• Supabase — authentication, cloud database, and file storage
• OpenAI — reply generation, image and file understanding, and text embeddings (see Section 4)
• Google — reply generation via Gemini and grounded web search (see Section 4)
• Firebase Cloud Messaging (Google) — push notification delivery
• RevenueCat — subscription and purchase management
• Composio — secure connection to and execution on your authorized third-party tools (e.g., Gmail, Google Calendar)
Each provider operates under its own privacy policy. We share with them only the minimum information needed to deliver the relevant feature.
6. Data Sharing
We do not sell your personal data. We share information only:
• With the third-party service providers listed above, strictly to operate the App
• With the connected third-party tools you have voluntarily authorized, strictly to perform the actions you request
• When required by law, court order, or to protect rights, safety, or property
• In connection with a corporate transaction (merger, acquisition, asset sale), in which case we will notify you
7. Data Retention
• Your profile, chats, automations, and saved content are retained as long as your account is active.
• Integration access tokens are retained until you disconnect the integration or delete your account.
• Diagnostic and error logs are retained for a limited period for stability and improvement purposes.
• You may request deletion of your account and all associated data at any time, either from within the App or by contacting us (see Section 9). Deleting your account revokes all integration access and removes your stored content.
8. Security
We implement industry-standard administrative, technical, and physical safeguards (including encrypted transport, scoped access controls, authenticated APIs, and row-level security) to protect your information. However, no digital system can guarantee absolute security, and you use the App at your own risk.
9. Your Rights
Depending on your jurisdiction, you may have the right to:
• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information ("right to be forgotten")
• Object to or restrict certain processing
• Request portability of your data
• Withdraw a previously granted consent, including your permission for AI processing (Settings → AI data processing) and disconnecting any integration
To exercise these rights, contact us at dogukanozgurylmz@gmail.com. We will respond within 45 days.
10. Children's Privacy
Krew is not directed to children under 13 years of age (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us so we can remove it.
11. International Transfers
Your information may be processed in countries other than the one in which you reside. In particular, the AI providers named in Section 4 (OpenAI, Google, Composio) process content in the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these international transfers.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated through the App. Continued use of the App after a change indicates acceptance of the updated policy.
13. Contact
If you have questions or concerns about this Privacy Policy or your data, contact us at:
Doğukan Özgür Yılmaz
Email: dogukanozgurylmz@gmail.com