Trust & security
Security and how KOZMO is built
KOZMO works with how people describe their own behaviour, so we build on established, security-focused services and collect as little as we can. This page covers all four KOZMO sites, says what is in place today, and names the site where something applies to only one.
What we build on
- SupabaseDatabase and server code
- StripePayments
- ResendEmail
- Google AnalyticsSite visits, only with your consent
Website hosting: Bolt (on Netlify).
Logos belong to their owners. Showing them does not mean they endorse KOZMO.
How we protect your data
Encrypted connections
All four KOZMO sites only work over HTTPS, and they tell your browser never to use an unencrypted connection to them.
A locked database
Every table has row-level security switched on, so the database itself checks who may see each row. Visitors’ browsers cannot read or write it directly: on kozmoinsight.com and KOZMO Me, data only moves through our own server code, and KOZMO Team’s admin screens need a signed-in admin.
As little data as possible
KOZMO Me has no accounts: your results open from a private link, and we store that link only in scrambled form. KOZMO Team research answers ask for no names. Where we use your IP address to stop abuse, we store only a scrambled one-way code, never the address.
Payments through Stripe
You pay on Stripe’s own checkout page, so your card details never reach us. The price is set on our server, not in your browser, and a purchase is only unlocked after Stripe confirms the payment to our server.
No tracking without your say
Google Analytics only loads if you accept it, with its advertising features switched off. It never runs on the KOZMO Me test, results or admin pages. Our fonts and everything else load from our own sites and services.
Strict page rules
kozmoinsight.com and KOZMO Me tell your browser exactly what each page may load, which blocks anything we did not put there.
Limits on abuse
Our forms and the KOZMO Me test limit how often they can be used and how much they accept. Our forms also quietly catch automated submissions.
You can delete your results
On KOZMO Me you can delete your results yourself from your results page.
Careful admin access
KOZMO Me admins sign in with a one-time link sent to an approved address, and every change an admin makes, and every time an admin opens or exports someone’s results, is logged.
Who handles your data
| Provider | What it does | Where |
|---|---|---|
| Supabase | Stores data and runs our server code | kozmoinsight.com, KOZMO Me, KOZMO Team |
| Stripe | Takes payments | KOZMO Me, KOZMO Team |
| Resend | Sends our emails | kozmoinsight.com, KOZMO Me, KOZMO Team |
| Google Analytics | Counts site visits, only with your consent | All four sites |
| Bolt (on Netlify) | Hosts the websites | All four sites |
For what each site collects and why, read the privacy policy for this site, the KOZMO Me privacy page and the KOZMO Team participant information.
Report a security problem
If you think you have found a security problem, email hello@kozmoinsight.com. Both founders read it.