What KoBar keeps, and what it sends

• KoBar has no account, collects no usage data and sends no crash reports.
• There is no KoBar server. Nothing you do in the app is sent to the KoBar project.
• Your notes, settings, workspaces and plugin data are stored on your PC.
• Some features contact outside services when you use them, for example AI Hub with the AI provider you pick. Every one is listed below.

KoBar stores its data in its own folder in your Windows user profile. That includes:

• your notes, settings, workspaces and the data of your plugins;
• AI Hub chats and your AI Hub API keys. KoBar does not encrypt these keys itself, so they are only as safe as your Windows account. A key is sent only to the provider it belongs to;
• files you drop into KoBox. They are moved there, and later go to the Recycle Bin;
• automatic backups KoBar makes before a data upgrade, a restore or deleting a workspace.

Clipboard. Clipboard Manager reads your clipboard only while its copy mode is on. Content that a password manager marks as private is skipped. Clipboard content is never sent anywhere.

Screenshots are saved only where you choose, or copied to your clipboard.

Microphone and camera. KoBar has no voice or camera features and denies these permissions.

Snippet Vault passwords hide a snippet’s content inside the app, but the password is stored next to the snippet on your PC. Do not rely on it to protect secrets.

Media. While koPlayer is on, KoBar reads what is playing through the Windows media controls (title, artist, cover art). When a browser is playing, it also looks for YouTube links in your open browser windows so it can offer picture-in-picture. This happens on your PC.

Updates. The Microsoft Store version is updated by the Store, under Microsoft’s privacy statement. The version from GitHub checks GitHub Releases for updates.

These are all the outside services the app and its official plugins can contact. Each one receives your IP address, like any website you visit, and is governed by its own privacy policy. A local AI model in AI Hub (Ollama or LM Studio) is reached only on your own machine.

GitHub (github.com, api.github.com, raw.githubusercontent.com)

When: When you open Settings › Plugins › Discover, install or update a plugin, or pick a starter pack on first run.

What is sent: Your IP address and standard request headers, and the name of the plugin repository.

GitHub Releases

When: Only the version installed from GitHub: when KoBar starts, it checks for a newer version.

What is sent: Your IP address and standard request headers. Nothing is downloaded until you agree.

OpenAI, Google Gemini or Anthropic

When: When you send a message in AI Hub with one of these providers.

What is sent: Your messages, the chat history and any attached images, with your API key for that provider.

ipapi.co

When: Calculator: the first time you open it in a session.

What is sent: Your IP address, used to guess your local currency.

open.er-api.com

When: Calculator: when you use the currency converter. Rates are kept for 12 hours.

What is sent: Your IP address and standard request headers.

Google favicon service (t3.gstatic.com)

When: Shortcuts: when a shortcut points to a web address.

What is sent: That web address, to fetch its icon.

YouTube (youtube.com, i.ytimg.com)

When: koPlayer: when it lists YouTube videos open in your browser, and when you play one in a picture-in-picture window.

What is sent: The video’s address. The YouTube player can set its own cookies inside that window.

jsDelivr (cdn.jsdelivr.net)

When: Notes: when you open the emoji picker.

What is sent: Your IP address and which emoji images are loaded.

Web links you click in KoBar, such as this website, GitHub or Patreon, open in your browser. KoBar asks before it opens other kinds of links, and blocks the ones that could run code on your PC.

This policy covers the 13 official plugins. Plugins from other authors run with full access to KoBar and are not covered here. KoBar warns you before installing a plugin from outside the official registry; install only plugins you trust.

• kobar.org is hosted by Vercel. Like any web host, Vercel processes your IP address and request details to deliver the pages.
• We count page views with Vercel Web Analytics, which does not use cookies.
• The page asks the GitHub API for the latest KoBar version and keeps the answer in your browser’s session storage for an hour. GitHub receives your IP address.
• The trailer loads from youtube-nocookie.com only when you press play. Until then, YouTube receives nothing.
• This site sets no cookies and loads its fonts from kobar.org itself.

• Remove a plugin, and it stops contacting the services listed for it.
• Settings › Backup exports your data into one file. API keys and passwords are left out unless you choose to include them; if you do, the file holds them in plain text, so keep it private.
• To remove everything KoBar stored on your PC, delete its data folder after uninstalling it.

When this policy changes, we update this page and the date at the top. The source of KoBar is public, so you can check every statement here in the code on GitHub.

Questions? Write to hello@kobar.org. To report a security issue, follow the security policy.