Legal

Privacy Policy

Effective date: 28 October 2026 · Last updated: 28 October 2026

This policy covers two different things, and the difference matters: the Kavvo app (the software you run) and the Kavvo website (this site). They handle data very differently, so we describe them separately.

1. The Kavvo app: your keys stay with you

Kavvo is bring-your-own-key (BYOK) software. When you connect a model provider, your API key is stored in your own Kavvo installation — on your computer or your server — and is used from there to call the provider directly. Your keys are never transmitted to us, never stored on our infrastructure, and never shared with third parties by the app.

Your conversations, memory, skills, and files likewise live in your installation. When Kavvo sends a prompt to a model, it goes to your chosen provider under your account with them, and that provider's privacy policy governs their handling of it. We operate no relay, proxy, or analytics in that path.

Memory stored by the app is yours to inspect, export, and delete. The in-app privacy guardian can purge a topic from memory entirely and issues a receipt of what was removed.

2. The Kavvo website: accounts

This website offers optional accounts (for the hosted-tier waiting list and release news). The Kavvo app never requires a website account.

  • Demo mode (current default): accounts are stored only in your own browser's local storage, on your device. No email address or password leaves your machine, nothing is sent to any server, and no confirmation email is sent. Clearing your browser data deletes the account completely. Passwords in demo mode are stored as a one-way hash, but demo mode is a preview convenience — do not reuse a password you care about.
  • Hosted auth mode (when enabled): accounts are provided by Supabase, a hosted authentication service acting as our data processor. In that mode we store your email address and account creation date; passwords are hashed and held by the auth provider, never in plain text. Confirmation and password-reset emails may be sent in this mode.

3. What we collect — and what we don't

  • We do not sell personal data. Ever. It is not a revenue line and never will be.
  • We do not run advertising trackers or third-party marketing cookies on this site.
  • If you email us, we receive your email address and the contents of your message, and use them only to reply and to operate the service you asked about.
  • Our hosting provider may keep standard, short-lived server logs (IP address, browser type, pages requested) for security and reliability, as virtually all hosting does.

4. Cookies and local storage

This site uses browser local storage for two functional purposes only: keeping you signed in to your website account, and (in demo mode) holding that account itself. We set no analytics or advertising cookies. If hosted analytics are ever introduced, this policy will be updated first and the change noted with a new effective date.

5. Data sharing

We share personal data only with the processors needed to run the website (hosting, and the auth provider in hosted mode), only for that purpose, and never for their marketing. We may disclose data if required by law. There is no other sharing.

6. Your choices and rights

  • Demo mode: delete your account at any time by clearing this site's browser data, or by signing out and clearing local storage.
  • Hosted mode / email: write to us at the contact below to access, correct, export, or delete your data. We will action requests within 30 days.
  • App data: it is on your hardware; you can export or delete it from within Kavvo at any time, including full topic purges via the privacy guardian.

7. Security

We use HTTPS for this website, hashed passwords for accounts, and access controls on our infrastructure. No system is perfectly secure, but the architecture helps us: the most sensitive material in the Kavvo world — your API keys and your agent's memory — never reaches us in the first place.

8. Children

Kavvo is a productivity tool for adults and is not directed at children under 13. We do not knowingly collect data from children under 13; if you believe we have, contact us and we will delete it.

9. Changes to this policy

If this policy changes materially, we will update the effective date above and, for hosted-mode account holders, notify by email before the change takes effect.

10. Contact

Questions or requests about privacy: support@kavvo.xyz.