The defaults
- No account, cloud sync, remote content processing, or content analytics.
- No background network requests — the app works fully offline.
- Clipboard history stays off until you explicitly enable it.
- Typed matching stays off until you complete its permission setup.
- Secure password fields and excluded apps are always ignored.
- Inserting text and saving a selection always require an explicit action.
What Koru stores
Saved-item bodies, titles, tags, match terms, templates, and (if enabled) clipboard history are treated as sensitive. They're encrypted at rest with AES-GCM, using a randomly generated master key held in your Mac's data-protection Keychain — a key that never syncs to iCloud.
Raw keyboard events, window titles, browser URLs, and document names are never written to disk. When typed matching is on, Koru holds only the short current fragment in memory while you type in an eligible field, then discards it.
Clipboard and retention
Clipboard history is a separate, opt-in temporary layer with bounded retention: recent entries expire automatically, and the oldest entries are removed first when a limit is reached. Keeping a clipboard entry means explicitly turning it into a saved item — nothing is silently promoted.
Network behavior
Koru makes no background network requests: no analytics SDK, no crash uploader, no remote configuration, no cloud AI, no automatic updater. “Check for Updates” opens the official release page only after you click it.
This website is static and uses no behavioral analytics, cookies, forms, session replay, third-party fonts, or embedded trackers. Its host may process ordinary request metadata needed to serve and protect the site.
Control and deletion
The app exposes pause, per-app exclusions, clipboard retention settings, clear history, export, delete-all-data, and uninstall preparation. A whole-vault reset deletes the Keychain key and removes local Koru data. Koru doesn't claim forensic erasure of filesystem remnants, snapshots, or your own external backups.
Honest limits
Local encryption can't protect content from an administrator account, a compromised user session, or malware with equivalent permissions — and once you insert text into another app, that app has it. Koru also can't reliably recognize every secret that passes through the general clipboard, which is why exclusions, pause, and short retention exist.
Questions or reports
Email support@builderking.io with questions. For suspected security or privacy vulnerabilities, use the private reporting process.