KinoLight iOS Privacy Policy
Effective date: 4 September 2026.
Rimami Oy provides KinoLight, an app that synchronizes compatible smart lights with the colors on your TV. Rimami Oy is responsible for the personal information we process to provide KinoLight. Contact us at support@rimami.com or visit rimami.com.
KinoLight normally analyzes camera frames on your iPhone. If you enable Online TV detection, selected still images are also sent to our online detection service. You do not need a KinoLight account. We do not show advertisements, sell personal information, or track you across other companies’ apps and websites.
Camera processing and optional online detection
The camera detects your TV and analyzes its colors to control your lights. Continuous color analysis takes place on your device. KinoLight does not record camera video or save camera frames to your photo library. It does not capture audio.
Online TV detection is off by default. When you enable it, KinoLight can send a compressed still image cropped around a candidate TV area, including some surrounding space, to help check the screen boundary. The image may contain visible TV content, objects, or people within that area. The iOS app requires a candidate crop for this upload; it does not upload a full frame solely because local detection found no candidate.
Images are sent over encrypted internet connections to Rimami’s detection service. Fly.io hosts the service, and fal.ai analyzes the images to identify the screen boundary. The result is returned to the app. The service receives selected still images rather than a continuous video stream. Each upload also includes a counter that associates the response with the current camera operation.
Rimami processes these images in memory for the detection request. We do not save the images or detection results as a dataset, and we do not use your camera images to train models. We send fal requests with input/output storage disabled, using the control described in fal’s data-retention documentation. We send image data directly with the request rather than uploading it to a file-sharing CDN.
You can disable Online TV detection in KinoLight’s settings to stop further image uploads. Local detection remains available. Turning the setting off does not recall a request already sent.
Request limits and technical information
KinoLight creates a random installation identifier and stores it in the app’s local preferences. When online detection is enabled, the app sends it to our relay with detection requests and service-availability checks. This identifier is separate from purchase identifiers and is not an advertising identifier. Our relay does not forward it to fal.
The relay uses a hashed version of this identifier for request limits and a short cooldown. The hash and its quota information stay in server memory. The daily quota records are scheduled to clear at the next midnight UTC, or earlier when the server process restarts. They are not written to the relay’s quota file. The file holds only the current UTC date and the service-wide request total, so the overall cost limit survives a restart.
Our relay application does not write individual online-detection requests, outcomes, images, installation identifiers, or upstream request identifiers to its access or operational logs. It keeps aggregate service counters in memory. Network providers necessarily process connection information: Fly receives the connecting IP address and request metadata, while fal receives the relay’s connection and service-request metadata. fal retains service-request metadata such as request identifiers, status, timestamps, and processing duration. Providers may also retain operational, security, and billing records under their own policies. Disabling application request logs does not disable those independent provider records.
Other information and services
- App settings and paired lights. Preferences, calibration values, layouts, device names, local network addresses, and pairing information are stored on your device. Commands to supported Hue, Nanoleaf, WLED, LIFX, Govee, and WiZ lights travel over your local network. These local light-control commands are not routed through Rimami’s server.
- Tuya / Smart Life, when connected. The app communicates with Tuya’s regional cloud APIs using credentials you provide. Credentials, device identifiers, and relevant commands may be sent to Tuya. Tuya access credentials and per-device local keys are stored in the device Keychain, without iCloud Keychain synchronization. Rimami does not receive these credentials.
- Purchases. Apple processes App Store payments. RevenueCat manages purchase and subscription entitlement information using a generated app-user identifier, purchase history, and relevant device/app metadata. A generated identifier is not a guarantee of anonymity. Rimami does not receive your full payment-card details. See RevenueCat’s privacy policy.
- Ratings and reviews. KinoLight may ask Apple to display its rating and review prompt. Apple handles any submission under its own terms and privacy policy.
- Trial state. Cumulative trial time and an expiry flag can be stored in Apple’s iCloud Key-Value Store to keep trial state consistent across devices using the same Apple ID. Rimami cannot access that private iCloud store.
- Casting and calibration video. Google Cast communicates with your selected receiver and may send standard session telemetry to Google. AirPlay uses Apple’s streaming facilities. Calibration videos may be fetched from Bunny’s CDN, which receives the requesting IP address and normal download metadata. These are supplied calibration videos, not camera uploads.
- App configuration and sports features. Downloads of online configuration and, when used, sports information contact Rimami services. Sports connections carry selected match/subscription information and ordinary network metadata. Those connections do not carry camera images. Non-detection service logs may include request or connection identifiers for operating and troubleshooting the service.
- Support. If you email us, we receive your email address and the information you choose to send so we can respond.
Apple, Google, Tuya, and Bunny also describe their own handling of information in their privacy notices. Cloud-detection provider information is available in Fly’s privacy statement and fal’s privacy policy.
Permissions and your controls
KinoLight requests Camera access for screen detection and calibration, and Local Network access for discovering and communicating with your devices. You can revoke either permission in iOS Settings. Features that need the permission will then stop working. The app does not request microphone, photo-library, location, contacts, calendar, or Bluetooth permissions.
KinoLight also uses your iPhone’s motion sensors to detect orientation and movement and stabilize screen calibration. Motion readings are processed on your device and are not uploaded to Rimami or other services.
Local preferences normally remain until you remove the app. Device backups and restoration can preserve or restore local data under Apple’s settings. iCloud trial state and Keychain items can remain after app deletion under Apple’s storage rules. Tuya credentials can be removed using available in-app controls; app deletion alone does not guarantee deletion of Keychain items.
Retention, legal bases, and international processing
Online-detection image handling and quota retention are described above. Other relay operational records use rotating logs that overwrite the oldest records when configured size limits are reached; this is based on log volume, not a fixed number of days. Fly’s hosted application-log search currently retains logs for seven days. That period does not establish a limit for every separate provider security or billing record. Purchase records remain for entitlement management, applicable accounting requirements, and the providers’ retention purposes. Support correspondence is kept as needed to handle the request and related obligations or disputes.
Where the GDPR applies, we rely on your consent for optional online-detection image processing. You can withdraw it by disabling the feature; withdrawal does not affect the lawfulness of earlier processing. We rely on legitimate interests to protect service availability, limit misuse and costs, and troubleshoot technical problems. Purchase and requested-service processing relies on performing our agreement with you, and applicable legal obligations cover records we must retain.
Our detection relay currently operates in the United States. Our providers may process information outside your country and the European Economic Area (EEA). fal’s Data Processing Addendum includes contractual transfer safeguards where applicable. Fly’s privacy statement describes its participation in the EU–US Data Privacy Framework, a framework for protecting personal information transferred to participating US companies.
Your privacy rights
Depending on the applicable law and processing basis, you may request access, correction, deletion, restriction, or portability of personal information, and object to processing based on legitimate interests. You may also withdraw consent as described above. Contact support@rimami.com. We may need enough information to locate the relevant records; we do not keep a permanent online-detection user profile. There is no KinoLight account to delete. We can assist with requests concerning RevenueCat records.
You may complain to your local data protection authority, including Finland’s Office of the Data Protection Ombudsman.
Children and policy changes
KinoLight is not directed to children under 13. If you believe a child has provided personal information through the app, contact us.
We will publish material changes at this policy’s existing URL and update its effective date. If we introduce a new optional use that requires consent, we will seek that consent before starting it.