Ko Villas runs on two kinds of information that deserve plain explanation: where you are going, and the automated systems that use your profile to suggest people you might get on with. Both are covered here in detail.
We collect what you give us, what your sign-in provider shares with us (Apple or Google), what your bookings generate, and basic device data. If you start on the website before signing in, your answers stay in your browser until you sign in. We use automated matching to suggest people — it is a suggestion, never a decision about your access to anything, and you can switch it off. Location is city-and-dates level, shared with networks you join; we do not track you in the background and we do not sell data. Card details go to Stripe, not to us. In trust mode and for booking-fee rent you pay the host directly, and we only record what you tell us about that payment. You can delete your account in the app at any time.
We Sell Things LLC, a Wyoming limited liability company that operates Ko Villas (formerly Flok), of 30 N Gould St Ste R, Sheridan, WY 82801, United States, is the data controller for the personal data described here. Contact us at [email protected].
Ko Villas is operated from the United States. Personal data is processed in the United States and in the other locations listed in §11.
| Category | What |
|---|---|
| Account | Name, email, phone, password hash, profile photo, date of birth |
| Sign in with Apple or Google | The provider's account identifier for you, your email address and whether the provider has verified it, and your name. From Google, also your profile photo address. From Apple, also a token we store encrypted and use only to revoke Ko's access when you delete your account. See §2.2. |
| Answers before sign-in | On the website, answers you give before signing in stay in your browser until you sign in. See §2.3. |
| Profile | Bio, work and interests, languages, links you add, photos |
| Verification | For Operators who use Ko collects: identity, bank and tax details, collected and held by Stripe. If you complete an identity check with a third-party provider, we store only that it was completed and which provider did it. We never receive or store the document. |
| Bookings | Requests to join and your answers, rooms committed to, stay dates, check-in flags, payment records (amounts and status, not card numbers), and in trust mode your "I paid" declaration and the host's confirmation |
| Location | Cities and date ranges you declare, stay locations, device location if you allow it, photo metadata. See §5. |
| Content | Messages, posts, photographs, milestone proof, event RSVPs, dispute submissions |
| Ratings | Thumbs you give and receive after a stay. Individual ratings are never shown to the person rated. |
| Device and usage | IP address, device and OS, app version, crash logs, pages viewed, approximate location from IP |
| Session recordings | We record how you move through the mobile app — screens visited, taps, scrolling and time spent — so we can find where it is confusing or broken. All text and images on screen are masked. See §2.1. |
| Communications | Support and safety correspondence, and reports you make about other users |
We do not intentionally collect special-category data such as health, religion, political opinion or sexual orientation. If you publish such information in your profile, you do so voluntarily and it becomes visible to others.
To understand where the app is confusing or failing, we record app sessions — which screens you visit, what you tap, and how long things take. Recordings are linked to your account so we can investigate a problem you report.
What is masked and never recorded: all text and all images on screen, so card details, identity documents, messages, answers and dispute content are not captured.
You can turn session recording off at any time in Settings → Privacy. Recordings are deleted after 30 days.
If you sign in with Apple or Google, the provider confirms who you are and sends us your account identifier with that provider, your email address and whether it is verified, and your name if you share it. Google also sends the address of your profile photo, which we use as your starting avatar. If you use Apple's "Hide My Email", we receive only the relay address Apple gives us.
With Apple, we also receive a token that we store encrypted. We use it for one thing: to revoke Ko's access to your Apple ID when you delete your account.
If an account with the same verified email already exists, we link the sign-in to that account. We never receive your Apple or Google password. Apple and Google handle your sign-in under their own privacy policies.
On the website you can start before you have an account: answer onboarding questions, or begin opening or joining a house. Until you sign in, those answers are kept only in your own browser, in its local storage or a first-party cookie. We do not receive them. When you sign in with Apple or Google, the website sends them to your new account so you don't have to answer twice. If you never sign in, they stay on your device until you clear your browser's site data.
| Purpose | Basis |
|---|---|
| Running your account and bookings | Performance of a contract |
| Signing you in with Apple or Google | Performance of a contract |
| Taking payment and issuing refunds | Performance of a contract |
| Suggesting people and networks (§4) | Consent — you can withdraw it at any time |
| Sharing your dates with networks you join | Performance of a contract; you control what you declare |
| Fraud, safety and abuse prevention | Legitimate interests, and legal obligation |
| Verification and KYC | Legal obligation (anti-money-laundering) |
| Investigating reports and disputes | Legitimate interests in protecting users; legal claims |
| Product improvement and analytics | Legitimate interests |
| Marketing emails | Consent — unsubscribe at any time |
| Responding to law enforcement | Legal obligation; vital interests where life is at risk |
Ko uses automated systems, including machine-learning models, to suggest people you may get on with and to write a short explanation of why. This is the feature that distinguishes Ko, so it is worth explaining exactly.
It does not use your messages, your payment history, your precise device location, or special-category data.
It produces a similarity score, a short written explanation, and a list of overlaps. These are suggestions for you to evaluate.
Matching has no legal or similarly significant effect on you. It does not decide whether you are accepted into a house, what you pay, whether you can book, or whether your account is restricted. Operators make their own decisions and do not see your match scores with other people. A low score does not disadvantage you anywhere on Ko.
Explanations are generated automatically and may be incomplete or wrong. Treat them as a prompt for conversation, not a fact about a person.
We also use automated systems to detect fraud, spam, and content that breaches the Community Standards. These cannot be switched off, because they protect other people. Where such a system restricts your account, a person reviews it before the restriction becomes permanent, and you may request that review.
Some processing uses third-party model providers. Where it does, data is sent under contractual terms that prohibit the provider using it to train their own models, and we send the minimum necessary. Current providers are listed at §6.
Ko is organised around where people are and where they are going. Here is precisely what that means.
| What | How collected | Who sees it |
|---|---|---|
| Declared plans | You type a city and date range | Members of networks you belong to, at city level only. Never a street address. |
| Stay dates | From your booking | Your Operator and the residents of that house |
| Property address | From the Operator | Released to you once the lease is verified. Approximate area only before that. |
| Photo metadata | Photos may carry coordinates | Anyone who can see the photo may be able to read them. Remove location from a photo before uploading it if you don't want to share it. |
| Device location | Only with your permission, only while the app is open, or on the website when you choose to use your location | Not shared. Used to suggest nearby content. On the website it is turned into the nearest city straight away and only that city is kept. |
| IP location | Automatically, at country/city level | Not shared. Used for security and fraud detection, to limit automated traffic, and on the website to choose which place to show you first. |
We do not track your location in the background. We do not build a continuous movement history. We do not sell or share location data with advertisers or data brokers. We do not show your live position to other users — only the city and dates you chose to declare.
You can delete declared plans at any time and revoke device location in your phone's settings.
| Provider | Purpose | Where |
|---|---|---|
| Stripe, Inc. | Card holds and charges, Operator identity and bank verification, payouts, network memberships | US |
| Hetzner Online GmbH | Hosting and databases | Germany, Singapore |
| Cloudflare, Inc. | Delivery and protection of the website, which all website traffic passes through, and storage (R2) of photos and other files you upload | Global |
| Mux, Inc. | Video processing and playback | US |
| Resend | Transactional email and sign-in links | US |
| Twilio Inc. | Text-message verification codes | US |
| Namecheap (Private Email) | Our own inbox — receives mail you send to [email protected] | US |
| Google LLC (Firebase) | Push notifications, crash reporting, app analytics and performance monitoring | US |
| PostHog, Inc. | Product analytics and session recordings in the mobile app (§2.1) | US |
| OpenAI, Anthropic | Matching, match explanations and AI trip planning | US |
| Fal (fal.ai) | Image generation, only when you use an AI image feature | US |
All process data under contract, only on our instructions, and may not use it for their own purposes. Apple and Google also process your data when you sign in with them, as independent controllers under their own privacy policies.
The app and the website load map images from OpenFreeMap, and the website loads a QR code image from goQR.me on a host's share page. Like any server your device fetches from, they receive your IP address, and goQR.me receives the villa link the code points to.
We may disclose data to authorities as set out in §8, to professional advisers, and to an acquirer in a merger or sale — in which case you will be notified.
We do not sell your personal data and we do not share it for cross-context behavioural advertising.
Card payments are processed by Stripe. Card numbers go directly to Stripe and are never stored on Ko systems. We receive amount, status, last four digits and card brand. When you pay a host directly (booking-fee rent and trust mode), that payment never passes through Ko, and we only record whether you or the host told us it was made.
Operators who use Ko collects are Stripe connected account holders. Stripe collects their identity, bank and tax information directly and is a separate controller for it, under Stripe's privacy policy.
We disclose personal data to police, regulators and courts where we receive a valid legal request, where we believe in good faith it is necessary to prevent death or serious injury, where we believe an offence has been committed through the Platform, or to establish or defend legal claims.
Where a serious incident is reported, we preserve the relevant records — messages, dispute threads, photographs with server-side timestamps, payment history and check-in flags — so they remain available for a lawful request.
We tell the account holder about a disclosure unless we are legally prohibited, or unless we believe notification would risk harm to someone or prejudice an investigation.
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account. Deletion in the app is immediate, and files you uploaded are removed from storage shortly after. |
| Booking and payment records | 7 years — tax and accounting obligation |
| Messages and network content | While the network exists; deleted account content is anonymised |
| Dispute records | 6 years from resolution — limitation period for claims |
| Safety reports and removals | 7 years, to prevent banned users returning |
| Declared location plans | Until you delete them, or 24 months after they pass |
| Device and analytics logs | 13 months |
Deleting your account does not delete records we must keep for legal, tax, safety or dispute reasons. Those are retained in restricted form and are not used for any other purpose.
Depending on where you live, you may have the right to: access your data, correct it, delete it, restrict or object to processing, receive a portable copy, withdraw consent, and not be subject to solely automated decisions with legal effect (see §4.2).
Exercise any of these in the app under Settings → Privacy, which routes directly to our admin team, or by writing to [email protected]. We respond within 30 days.
If you are in the EEA or UK you may complain to your local supervisory authority. If you are in California you may exercise CCPA/CPRA rights including the right to know, delete, correct and opt out of sale or sharing — we do not sell or share, but the right stands. We will not discriminate against you for exercising any right.
Ko operates internationally and your data may be processed outside your country, including in the United States, Germany and Singapore. Where data leaves the EEA or UK we rely on adequacy decisions where they exist, and otherwise on Standard Contractual Clauses with additional safeguards. A copy is available on request.
We use encryption in transit and at rest, access controls limiting staff access to what is necessary, audit logging, and regular review. No system is perfectly secure. If a breach affects your rights we notify you and the relevant regulator as required by law.
Our website uses only cookies that are strictly necessary for something you asked for: the cookies that keep you signed in, which scripts on the page cannot read; a cookie that remembers the place you picked on Discover, set only when you pick one and holding only that place; on payment pages, Stripe's fraud-prevention cookies; and security cookies Cloudflare may set to protect the site from automated abuse. It also uses your browser's local storage for conveniences such as villas you viewed recently, and to keep your answers before sign-in (§2.3). The website uses no analytics or advertising cookies, which is why it does not ask for cookie consent. The mobile app does not use cookies. It uses local identifiers for analytics, crash reporting and session recording (§2.1).
Ko Villas is for adults only. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete the account and its data. Contact [email protected] if you believe a minor has registered.
This Privacy Policy forms part of our Terms of Service. The provisions below apply to any claim relating to your personal data, this Policy, or our handling of information, in the same way they apply to everything else on Ko. They are restated here so there is no doubt they cover privacy claims.
You agree to indemnify and hold harmless Ko and its officers, directors, employees and agents from any claim, liability, loss, damage, penalty, fine, cost or expense, including reasonable legal fees, arising from or relating to:
We may suspend or terminate your account and access at any time as set out in the Terms of Service §17, including where necessary to protect the data or safety of others.
On termination we delete or anonymise your data as described in §9, except records we are required or permitted to retain for legal, tax, safety, security or dispute purposes. Termination does not affect any rights or obligations that arose before it.
This Policy is governed by the law of the State of Wyoming, United States, without regard to conflict-of-law rules, and subject to any mandatory consumer and data protection rules of your country of residence.
Disputes are resolved under Terms of Service §19. In summary:
Nothing in this section limits, waives or removes your statutory rights under data protection law — including your rights of access, correction, deletion, portability and objection under §10, and your right to complain to a supervisory authority or regulator. Those rights cannot be contracted away and we do not attempt to. Nothing here limits liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else applicable law does not permit us to exclude.
Some jurisdictions do not allow the exclusion of implied warranties or the limitation of certain damages, so parts of §15.1 and §15.2 may not apply to you. Where a limitation cannot lawfully apply, it is modified to the minimum extent necessary and the remainder stands.
We will notify you in the app or by email at least 30 days before a material change. Every version is archived and identified by version number.
In the app: Settings → Privacy, or Report on any profile, message or listing. By email: [email protected].