Kuku Privacy Policy

Futuro AI, Inc. · Effective Date: October 27, 2026

1. Introduction

Futuro AI, Inc. ("Kuku," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Kuku mobile application, the Kuku web app at delulu.joinkuku.com, the web pages we send to people who are not Kuku users, and related services (the "Services").

By using the Services, you acknowledge the practices described in this Privacy Policy. If you do not agree, please do not use the Services.

Our Privacy Approach

• Optional connections. You may use Kuku without connecting Instagram, TikTok, or YouTube, or allowing album access, where an upload or manual-entry option is available.
• User-directed selection. Connecting a service does not mean that all content from that service is sent to Kuku. Kuku processes the content or data categories you select or authorize for a feature.
• No passwords or private messages. We never ask for or receive your third-party account password. Social profiles are read from what the account shows publicly, and the integrations described here are not designed to read private direct messages.
• No sale of personal information. We do not sell or rent your personal information.

2. Information We Collect

2.1 Account and Profile Information

Depending on the features you use, you may provide:

• a display name, username, profile photo, age, gender (which you choose as pronouns), and other profile details;
• the email address and name that Apple or Google shares with us when you sign in with them;
• a school email address, if you sign up or sign in with one, as described below;
• profile edits, preferences, settings, and information you choose to add to your Kuku profile; and
• other information you deliberately enter while creating or updating your profile.

School email. If you sign up or sign in with a school email address, we send a one-time 6-digit code to that address through Amazon Simple Email Service. The code expires after 10 minutes, and we store it only in scrambled (hashed) form. We also record each address and IP address a code is sent to, to limit how often codes can be requested; those records are deleted after about two days. Once you enter the code, we link the address to your Kuku account and use its domain to recognize your school. Kuku does not send email to that address for any other purpose. The address stays linked until you delete your account.

2.2 Photos and Other Content You Provide

We may process photos, captions, prompts, answers, challenge entries, feedback, and other content that you upload, create, edit, or send through Kuku. Uploaded files may also contain basic file metadata, such as file type, size, and capture date.

Kuku may analyze one or more photos you provide to select relevant visual content, generate editable "Guess What" questions, create profile descriptions or tags, and support other friend challenges. Kuku is not intended to identify individuals from their faces or create biometric identity templates. To keep minors out of generated content, the AI is instructed not to write about anyone who appears to be under 18. That is a judgment about appearance, not an identification.

This analysis is carried out on our behalf by the Microsoft Azure OpenAI Service, except the spooky face sticker, which Google's Vertex AI service draws (see Spooky face below). This Policy describes each feature that sends a photo or text you provide to that service, and what it sends. Content sent to the Azure OpenAI Service is processed under Microsoft’s enterprise service terms and is not used by Microsoft or OpenAI to train their models. Microsoft may keep it for up to 30 days solely to detect abuse of its service, as its terms describe.

Photos from your device. Kuku reads photos from your photo library in the following cases, and only after you grant photo access:

• Album access. If a social profile cannot be read and you tap "allow album access", Kuku reads the 20 most recent photos in your library and uploads them to generate your profile. You may instead upload a screenshot of your social profile page, which Kuku reads to find your public profile.
• AI Scan. If you turn AI Scan on (tap "Find me some" on the camera screen, or turn on Let Kuku pick photos on the Me page), about once a week, including in the background (and again the next time you open the App if a scan does not finish), your phone looks through your recent photos and sets aside screenshots, photos with text or codes, dark or blurry shots, and photos with more than one large face. It then sends small previews (up to 30) to Microsoft Azure OpenAI to suggest photos for Guess What. The checks on your phone count faces and detect text; they do not recognize who anyone is. Kuku does not store the previews; it keeps only which photos were suggested, on your phone. AI Scan stays off until you turn it on, and you can turn it off from the Me page at any time.
• Photos you pick. When you choose a photo for Guess What, Make us meme, or Delulu Dating, Kuku uploads only that photo.

Photos read through album access, AI Scan's previews, and photos you pick for Guess What or Make us meme are sent to Microsoft Azure OpenAI; photos for Delulu Dating are not (see below). The camera screen also shows thumbnails of your two most recent photos, which stay on your device. Kuku does not otherwise access your photo library.

Make us meme and Delulu Dating. Make us meme creates an AI sticker sheet of you and a friend. Unless you choose other photos, it uses your profile photo and your friend's profile photo. Those photos, or one photo of you both, are sent to Microsoft Azure OpenAI to draw the sheet. Only the person who made a meme can see it in Kuku. The sheet and any photos uploaded for it are deleted 7 days after it is made. Because your friends can use your profile photo in Make us meme, choose a profile photo you are comfortable with them using. Delulu Dating asks for a photo of your face to put on a character. Your phone or browser cuts out the face, and Kuku stores the cut-out with that date; it is not sent to an AI service.

Spooky face. After a wrong guess in Guess What, Kuku may ask you to record your spookiest face with your front camera for about two seconds. If you keep it, your phone turns the recording into a short looping image and uploads it, and it becomes a reaction you can send to friends in Guess What. Kuku then uploads one still frame of the recording and sends it to Google's Vertex AI service (a Gemini image model) to draw a cartoon sticker of your face, which replaces the looping image as your reaction. If the sticker cannot be drawn, the looping image stays your reaction. Reactions you already sent keep the face they were sent with, and recording again replaces your spooky face. The frame is used only to draw the sticker, not to recognize who you are. Content sent to Vertex AI is processed under Google Cloud's terms and is not used by Google to train its models.

2.3 Friend Connections and Interactions

When you add or interact with friends, we may collect:

• invite codes, shared links, accepted connections, and friend-list information;
• the sender, recipient, selected participants, and status of a challenge or invitation;
• challenge answers, results, match or compatibility scores, reactions, and interaction history; and
• delivery and participation status needed to operate an invitation or challenge.

Using your device's system share sheet to send an invite does not, by itself, give Kuku access to your address book or private messages.

2.4 Optional Connected Services

Social profiles (Instagram, TikTok, YouTube). To connect a social profile you type its public handle. Kuku does not sign in to the account and receives no password or access token. Instead, a social-data provider acting for us (see Section 5.2) reads what the account shows publicly: display name, bio, profile photo, links, follower, following and post counts, account category, recent public posts with their images or thumbnails, captions, locations, tagged and mentioned accounts, up to five public comments per post, and, for Instagram, the public story highlights shown on the profile (their images, video cover frames and highlight titles). Kuku stores that content, including the provider's original response, to generate your profile and the invite suggestions described in Section 2.7. Kuku reads the account again only when you reconnect it. Private accounts cannot be read. Connect only an account that is yours or that you are entitled to use.

You can disconnect a connected account from the Me page. Disconnecting deletes the content Kuku read from it and the invite suggestions built from it, including the profile photos we copied for those suggestions. A profile Kuku already generated stays until you edit it or delete your account.

2.5 Generated Content and Inferences

Kuku may create profile text, aesthetic or personality-style tags, archetypes, prompts, captions, creative interpretations, challenge pairings, scores, and results based on content you provide and your interactions. These are playful, automated inferences for entertainment and social interaction; they are not verified facts about you or another person.

2.6 Information Collected Automatically

• device and app information, such as device type, operating system, app version, language, and time zone;
• service activity, such as screens viewed, features used, invitations sent, and interaction timestamps;
• diagnostic information, such as performance data and error reports from our servers;
• a device token for notifications, and a separate token for Live Activities (on unless you turn them off), together with your app version and language; and
• your IP address, which our servers record in logs kept for 30 days, and from which our analytics provider estimates your country or region.

2.7 Information About Other People, Including Non-Users

Content you include. A user may include another person's name, photo, or other content in a challenge or invitation. If you provide information about someone else, you represent that you have the right to do so and will respect that person's privacy.

People who appear on your public posts. When you connect a social profile (Section 2.4), the public comments, tags, and mentions Kuku reads carry the public username, display name, and profile photo of other accounts. Kuku uses them to suggest up to ten people you might invite, on the "Invite one of them" screen. Kuku ranks the accounts that comment on, are tagged in, or are mentioned in your posts. To order the list and write a short note about each person (such as "commented on 6 posts"), Kuku sends their username, display name, and up to five of their comments to Microsoft Azure OpenAI. Kuku keeps a copy of their public profile photo so the list loads reliably. These comments and tags may also inform the profile Kuku generates for you. These people are usually not Kuku users. Kuku shows the list only to you, never to other users, does not contact them, and sends them nothing unless you share an invite link yourself. The list, and the profile photos copied for it, are deleted when you disconnect that account or delete your own. If someone joins Kuku through a link you shared, we record that you invited them.

Guess What games for people who are not on Kuku. Members of the Kuku team sometimes make a personalized Guess What game for someone who is not a Kuku user and send them a private link to play it on the web. To make it, our social-data provider reads that person's public Instagram or TikTok profile: their bio, up to 12 recent captions, and up to 8 post images. Microsoft Azure OpenAI writes the questions; the photos in the game are Kuku's own artwork, not the person's. We do not store what was read. We keep the handle, a first name, and the questions only until the game expires: 24 hours if it is never sent, and 7 days after it is sent. The person can delete the game from its page at any time. If they do, we keep only a record of the handle so we never make them another game. When someone opens the game, we count opens, finishes, and downloads and collect the web analytics described in Section 2.6, without linking them to a name or handle.

A non-user may contact us at teams@futuro.live to request removal of information that concerns them, including from invite suggestions.

3. How We Use Information

We may use information to:

• create and operate accounts, profiles, friend connections, invitations, and challenges;
• analyze user-selected content and generate editable prompts, profile text, tags, scores, and results;
• deliver content to the friend or participants you select and show the sharing context before or within the feature;
• maintain optional Instagram, TikTok, and YouTube connections at your direction;
• suggest people you might invite, based on who comments on, is tagged in, or is mentioned in your own public posts (Section 2.7);
• personalize and improve features, including evaluating de-identified or aggregated usage patterns and model performance;
• provide support, send service notices, and respond to requests;
• maintain safety, prevent fraud or misuse, enforce our Terms, and protect users and Kuku; and
• comply with law and establish, exercise, or defend legal claims.

We do not use private, directly identifiable user content to train general-purpose public AI models unless we separately disclose that use and obtain any consent required by law. We may use de-identified or aggregated information to evaluate and improve Kuku and its automated features.

Copies of your Guess What rounds. While Help improve Guess What is on, Kuku keeps a copy of each Guess What round you send: the photo, the questions and answer options Kuku wrote for it, the version you sent, and which option each friend picked. Your friends' answers are kept without their names or account identifiers. Members of the Kuku team review these copies through access-controlled internal tools, and may download them to a team computer to evaluate new versions, deleting them there when you ask us to. We may also send the photos to the Microsoft Azure OpenAI Service again to test new versions of Guess What. We use these copies only to evaluate and improve Kuku's features; we do not use them for advertising, sell them, or use them to train general-purpose public AI models. The setting is on by default for every account, and you can turn it off at any time from the Me page. Turning it off stops new copies; copies already kept remain until you ask us to delete them or you delete your account.

Access by the Kuku team. Authorized members of the Kuku team can view account information, including your profile, the photos and social content used to generate it, and your games and memes, through an access-controlled internal tool. They do so to provide support, investigate reports, prevent misuse, and fix problems. Changes made through that tool are logged.

4. What Friends Can See

Connecting with someone does not give that person access to your imported source data or connected accounts. A friend may see:

• content, invitations, questions, or profile cards you deliberately send to that friend; and
• answers, scores, results, tags, or other outputs that you deliberately send, or that the feature clearly states will be delivered to the selected participants as part of the interaction you started or joined.

Kuku does not give friends automatic access to your full Kuku profile, your connected Instagram, TikTok, or YouTube account, your photo library, or private messages. Friends do see some things automatically:

• your name, profile photo, Kuku character, and when you were last active in Kuku;
• your shared history with them on the relationship page;
• the results of Delulu Dating rounds you finish with another friend, shown to your other friends as a card they can guess on; and
• your profile photo, if they choose to make a meme with you.

If you add a Kuku widget or Live Activity, your friends' names, questions, and photos may appear on your home or lock screen. Please review the recipient and feature before sending content, because recipients may save, copy, or share what they receive outside Kuku.

5. How We Disclose Information

5.1 At Your Direction

We disclose content and results to the friend or participants you select, as needed to deliver an invitation, challenge, result, or other feature you choose to use.

5.2 Service Providers

We may use service providers for cloud hosting, content delivery, artificial-intelligence processing, analytics, security, customer support, authentication, notifications, and diagnostics. They may process information only for services they provide to us and under appropriate contractual restrictions, and they are required to provide protection for your information equivalent to this Policy.

Our principal service providers are:

• Microsoft Azure: the Azure OpenAI Service, which performs the automated analysis and generation described in Sections 2.2, 2.5, and 2.7;
• Google Cloud: the Vertex AI service, which draws the spooky face sticker described in Section 2.2;
• Amazon Web Services: our database, photo storage, and photo delivery (Amazon CloudFront), in the United States (us-west-1), and Amazon Simple Email Service, which sends school-email sign-in codes. CloudFront may briefly cache photos at locations outside the United States;
• ScrapeCreators: reads the public profile, posts, comments, and story highlights of a social handle (Sections 2.4 and 2.7);
• Google Firebase: account creation, sign-in, and authentication;
• Apple and Google: sign-in, if you choose Sign in with Apple or Google;
• Apple Push Notification service: delivery of notifications, and of Live Activities unless you turn them off;
• Adjust: mobile attribution and measurement, as described below;
• Mixpanel: product analytics in the App and on the web, covering the information described in Section 2.6;
• Vercel: hosting for the Kuku web app and our websites;
• Cloudflare: network delivery and security;
• jsDelivr: delivers the code the Kuku web app uses to cut out a face for Delulu Dating, and so receives your IP address when it loads (your photo is not sent to it);
• Sentry: error reports from our servers, limited to an account identifier and the error;
• Google Analytics: visit statistics on our marketing website, joinkuku.com (not in the App or the Kuku web app); and
• Lark, Linear, and GitHub: internal tools where our team handles the reports you send.

We do not sell your personal information, and we do not share it with advertising networks. Kuku includes the Adjust software development kit, which we use for mobile attribution and measurement: to understand how people find and install Kuku and how often the App is opened. Each time the App starts, Adjust receives the identifier Apple assigns to apps from the same developer on your device (the IDFV, which is shared with any other Futuro AI apps you have installed rather than unique to Kuku), device and app information such as device model, operating system, and app version, your IP address, and install and session activity. Adjust also receives Apple's privacy-preserving install attribution (Apple Search Ads, SKAdNetwork, and AdAttributionKit), which does not identify you. When you tap an invite or download link on our websites before installing Kuku, the link passes through Adjust, which can then hand the App the invite code after you install, matching the install to that tap using information such as your IP address and device type. Kuku does not ask for permission to track you under Apple's App Tracking Transparency framework, so Adjust does not receive your device's advertising identifier (IDFA), and Kuku does not track you across other companies' apps or websites. Adjust is not used in the Kuku web app. When you delete your account in the App, Kuku asks Adjust to forget your device.

5.3 Connected Platforms

When you connect or disconnect a third-party service, we exchange information with that provider as needed to authenticate the connection, honor your selections, and operate the requested feature. Each provider also processes information under its own terms and privacy policy.

5.4 Legal, Safety, and Business Events

We may disclose information where reasonably necessary to comply with law or legal process, protect rights or safety, investigate fraud or abuse, enforce our Terms, or complete a financing, merger, acquisition, reorganization, or sale of assets. A successor may continue to process information under this Policy or a policy that provides notice of material changes.

5.5 Aggregated or De-identified Information

We may use and disclose information that has been aggregated or de-identified so that it cannot reasonably be linked to you, subject to applicable law.

6. Data Retention

We keep personal information for as long as reasonably necessary to provide the Services, maintain account and interaction history, meet legal and security obligations, resolve disputes, and enforce agreements. Retention may vary by data type, feature, and legal requirement.

Photos you upload. Photos you upload are stored on our servers (Amazon Web Services S3). They are delivered from a web address that contains a long random identifier and is not listed anywhere, so anyone given that address can open the photo. How long a photo is kept depends on how it is used:

• A Guess What photo you take but do not send is deleted after 24 hours.
• A Guess What round nobody answered loses its photo when the round ends, 7 days after it was sent. A round someone answered keeps its photo as a memory on your relationship page.
• A Make us meme sheet, and any photos uploaded for it, is deleted 7 days after it is made.
• Your spooky face (its looping image and its sticker) is kept as long as a reaction you sent shows it. One that no reaction shows is deleted after 7 days, and so is the still frame used to draw the sticker.
• Your profile photo, the photos in your album, and your Delulu Dating photos are kept until you replace them or delete your account.
• Profile photos we copy for invite suggestions are kept until you disconnect the account they came from or delete your own.
• Any other photo that no part of Kuku still uses is deleted automatically after 7 days.

A separate private copy is kept while Help improve Guess What is on (Section 3). That copy has no fixed time limit and stays until you ask us to delete it or you delete your account. After a photo is deleted, copies cached by our delivery network expire within a day. Some photos are sent to Microsoft Azure OpenAI for automated analysis and generation, as described in Section 2.2.

Connected-account content. What Kuku read from a connected social profile is kept until you disconnect that account or delete your own.

Deleting your account. When you delete your account in the App, it is deleted immediately. This covers your profile, photos, connected-account content, invite suggestions, school email, friendships, games, memes, the notifications your activity created for your friends, Help improve Guess What copies, and your sign-in account. Rounds and memes you shared with friends are removed from their side too. We keep only:

• reports you made or that were made about you, and block records, which we keep to protect users;
• a record that the account existed and was deleted, under its random account identifier; and
• backup copies, which are overwritten within 7 days.

When you delete your account, we remove the location our analytics provider estimated for it and ask Adjust to forget your device. Usage events already sent to our analytics provider stay under the account's random identifier, with no name, email, or photo.

When you delete individual content, we delete or de-identify it within a commercially reasonable period, except where retention is permitted or required for security, fraud prevention, legal compliance, or dispute resolution.

7. Your Choices and Rights

• Edit your profile and content through the available in-app controls.
• Choose whether to connect Instagram, TikTok, or YouTube, to allow album access, or to use AI Scan, and which photos you send.
• Disconnect a social profile from the Me page.
• Turn Help improve Guess What on or off from the Me page (Section 3), turn AI Scan (Let Kuku pick photos) on or off from the Me page, and turn Live Activities on or off when you send a Guess What.
• Manage photo-library, camera, and notification permissions in device settings.
• Remove a friend, report or block a user, or stop participating in a challenge, subject to content already delivered.
• Delete your account from the Me page, which takes effect immediately, or contact us.
• Request a copy of your information by writing to teams@futuro.live; Kuku has no in-app export.

Kuku does not send marketing emails.

Depending on where you live, you may also have rights to request access, correction, deletion, portability, restriction, or objection, and to withdraw consent. You may submit a request at teams@futuro.live. We may verify your identity and may deny or limit a request where permitted by law. You may also appeal a decision or contact your local data-protection authority where applicable.

8. U.S. State Privacy Notice

Kuku does not sell personal information for money and does not currently share personal information for cross-context behavioral advertising. Where applicable law defines these terms differently, we will provide any required notice and choices. We do not use sensitive personal information to infer characteristics for purposes unrelated to providing the Services.

9. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. You are responsible for protecting your account and invite links and for promptly notifying us of suspected unauthorized use.

10. International Data Transfers

Futuro AI, Inc. is based in the United States, and information may be processed in the United States and other countries where we or our providers operate. Where required, we use recognized transfer mechanisms and safeguards. Local privacy laws may differ from those in your home country.

11. Children's Privacy

The Services are not intended for children under 13, and we do not knowingly collect personal information from children under 13. Kuku asks for your age right after you sign in. If you give an age under 13, Kuku deletes the account at once, including the name and email Apple or Google shared with us, and that device cannot sign up again for a day. If that sign-in is no longer recent, the sign-in record kept by our authentication provider (Google Firebase) may remain until the person signs in again. Users under the age of legal majority must use Kuku with the consent of a parent or legal guardian where required. If we learn that we collected information from a child under 13, we will delete it.

12. Third-Party Services

Instagram, TikTok, YouTube, Apple, Google, app stores, and other third-party services are governed by their own terms and privacy policies. Their features, permissions, and availability may change. Kuku is not endorsed or sponsored by those providers unless expressly stated.

Separately, we engage the service providers listed in Section 5.2 to operate Kuku. Those providers act on our instructions under contract, rather than as services you connect yourself.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes to Kuku, our practices, or applicable law. We will post the updated version and revise the Effective Date. If a change is material, we may provide additional notice in the App or as required by law. Continued use after the effective date means the updated Policy applies to your use, subject to any consent required by law.

14. Contact Us

For privacy questions, requests, or complaints, contact:

We aim to respond within a reasonable period and within any time required by applicable law.

See also the Kuku Terms of Service.