Privacy Policy

1. The short version

1.1 We store the minimum needed to run an account, meter credits, show the public parts of the site and keep the service from being abused.

1.2 We do not sell your personal data. We do not share it for advertising. There are no third-party advertising or analytics trackers on kammii.ai.

1.3 We do not train AI models on your prompts, your images or your files, and we do not give them to anyone else to train theirs.

1.4 When you call a text model through the API, we do not store what you sent or what came back. We store that a request happened, to which model, how large it was and how long it took.

2. What an account stores

2.1 Your email address, which is the name of the account.

2.2 If you set a password, a PBKDF2-SHA256 hash of it with a random salt. The password itself is never stored, and it does not leave the sign-in request.

2.3 If you sign in with Google, the account identifier Google returns for you, your email address, and the display name on your Google profile. We never receive your Google password. The access token is exchanged on our server and discarded. Google sign-in does not read your contacts, your mail or your files.

2.4 If you sign in with Discord, the Discord account identifier and the email address on that account. Where you have linked Discord to a supporter role, we read that role in order to set your plan level, and nothing else about your Discord account.

2.5 A session identifier, stored server-side and set as a cookie, valid for 31 days and then deleted. Signing out of all sessions deletes them immediately.

2.6 Your plan level, your credit balance and your credit history. The credit history is a list of grants, where each grant came from, how much of it is left, and a payment reference for a grant that came from a payment.

2.7 Your product settings, such as your generation preferences, your saved prompt list, and your appearance and motion preferences.

3. What email we send

3.1 Email is used to verify a new address, to set or reset a password, and for notices about your own account, your plan or these policies. There is no marketing mail.

3.2 A verification link is valid for 24 hours. A password reset link is valid for 30 minutes. Both are stored only as a hash, and both are deleted the moment they are used.

3.3 Those messages are delivered by an email delivery provider on our behalf, which necessarily receives your address in order to deliver them. Mail is sent from a no-reply address on a Kyrune domain.

4. The public parts of the site

4.1 If you create a public profile, the username, display name, biography, location, links, avatar and banner you put on it are public. So are your public posts, their captions, their tags, the images in them, their comment threads, and the counts of posts, followers and likes.

4.2 Public means public. It is visible to people who are not signed in, and search engines may index it.

4.3 Do not put anything in a profile field, a caption or a comment that you would not want a stranger to read. In particular, do not put your email address, your home address or your phone number there.

4.4 Your account email address is never shown on a public page, and it is never used as your public username.

4.5 Who you follow, who follows you, and what you have liked are shown on your profile according to the visibility settings on it. Your collections are shown according to their own setting. Blocks are never shown to the person blocked, and never shown to anyone else.

4.6 Unpublishing or deleting a post stops us serving it. Copies that other people already made are outside our control.

5. Generated images, prompts and galleries

5.1 A prompt you submit is sent to the model that runs it, and to the compute provider that runs that model. We keep it in the job record while the job runs and in the result record afterwards, so that you can see what produced an image and reuse the settings.

5.2 The full configuration of a generation, including the prompt, the model, the sampler settings, the dimensions and any LoRAs and their strengths, is embedded in the image file itself as metadata. If you share that file, you share that metadata. Strip it first if you do not want to.

5.3 By default your gallery and your recent prompt list live in your own browser, not on our servers. Clearing your browser storage clears them, and they do not follow you to another device.

5.4 If you turn on cloud saving, the images you save are stored in our object storage, associated with your account, until you delete them.

5.5 Images you attach to a post are stored in our object storage and served from a content path. Size variants, including thumbnails, are generated and stored alongside them.

6. K Agent

6.1 A K Agent conversation is stored against your account: the messages, the steps the agent took, the tools it called, the settings it changed and the images it produced.

6.2 If you attach a file to a message, it is stored with that message and read only when the agent asks for it.

6.3 If the agent searches the web or reads a page for you, the search terms it uses and the page it fetches go to the search and fetch providers we use for that. We do not send them your account identity.

6.4 If you connect an external tool server to the agent, what the agent sends it is between you and that server's operator. We hold the connection settings; we are not a party to what happens at the other end.

6.5 Deleting a conversation deletes its record, its steps and its attachments.

7. The API

7.1 To use the API you create a key. We store the key, the account it belongs to, when it was made and when it was last used. One key per account.

7.2 We do not store the content of API requests or responses. For each request we store the model, the time, the number of messages, the size of each message as a count of characters, token counts, timing and status. The message text and the reply text are deliberately dropped before anything is written.

7.3 We keep a short record of each conversation identifier so that a caller can see their own recent usage. Those records carry the same content-omitted shape as clause 7.2.

7.4 Records of requests that had to fall back to a second provider are kept for longer, because they are how we find out what is broken. They too carry no message content.

7.5 Your requests are forwarded to third-party inference providers in order to be answered. Each has its own privacy terms and its own retention. We choose providers that do not require us to hand over your identity, and we do not pass your email address or your account identifier to them.

8. Files

8.1 A file you upload is stored in our object storage with its name, size, type, the time of upload and the account that uploaded it.

8.2 A preview or share link makes the file reachable by anyone holding the link. That is the point of it. Treat a share link as public.

8.3 Files stay until you delete them or until your account is deleted. We do not expire them on a timer.

9. Payment data

9.1 We never see or store your card number. A card payment is handled entirely by our payment processor, on their pages or in their embedded form, and your card details go to them and not to us.

9.2 What we receive back and store is: that the payment succeeded, the amount, the currency, the processor's own reference for it, the last four digits and card brand where the processor gives them to us, the credits it granted, and, for a subscription, its status and renewal date.

9.3 If you pay in cryptocurrency, we store the invoice reference, the coin, the amount and the settlement status. We do not hold your wallet or your keys.

9.4 We keep payment records for as long as tax and accounting law requires.

10. Technical and security data

10.1 Our hosting and network provider processes the ordinary technical data that any website receives: your IP address, your user agent, the pages you requested and the time. This happens before our code runs and it is how the site is delivered and protected from attack.

10.2 We use counters keyed to an IP address and to an email address to rate-limit sign-in attempts, sign-ups, reports and other actions that can be abused. These are short-lived counters, not profiles.

10.3 We keep operational logs about errors, provider failures and timing. They are about the system, not about you, and they carry no message content.

11. Reports and moderation records

11.1 If you report a post, a comment or an account, we store the report: what you reported, the reason you chose, any detail you wrote, and your account identifier as the reporter. Your identity as a reporter is not shown to the person you reported.

11.2 If a moderator acts, we store the action, the moderator, the time and any internal note.

11.3 Removing a post does not delete its files. The record and the files are kept so that an appeal can be reviewed and a lawful request can be answered. A permanent purge is a separate, deliberate step.

11.4 Resolved reports are deleted 90 days after they are resolved.

12. Why we process your data, and on what legal basis

For readers in the EEA and the UK, the bases are as follows.

Account, sign-in, sessions

To give you an account and keep you signed in

Basis Performance of the contract

Generation jobs, results, settings

To do the thing you asked for

Basis Performance of the contract

Credits, payments, invoices

To sell you credits and keep the balance right

Basis Performance of the contract, and legal obligation for tax records

Public profile and posts

To publish what you chose to publish

Basis Performance of the contract

Transactional email

To verify your address and let you reset a password

Basis Performance of the contract

Rate limits, abuse detection, fraud prevention

To keep the service usable and not stolen

Basis Legitimate interests

Operational logs and error records

To keep the service working

Basis Legitimate interests

Reports and moderation records

To enforce the Content Policy and answer appeals

Basis Legitimate interests, and legal obligation where a law requires action

Responding to a legal request

Because we have to

Basis Legal obligation

We do not rely on consent for anything above, because nothing above is optional if you want an account. Where we ever do rely on consent, we will ask for it plainly and you can withdraw it.

We do not knowingly process special category data, and you should not put any into a prompt, a profile or a file.

13. Who else sees your data

We use the following categories of supplier. Each one gets only what it needs for its job.

Hosting, edge network and storage

Serving the site, storing accounts, images and files

What it receives Technical request data, and the stored data itself

GPU compute providers

Running image models

What it receives The prompt and settings for a job, and the resulting image

Third-party AI model providers

Answering text, vision, search and research requests

What it receives The content of that request, without your identity

Web search and page fetch providers

The agent's search and read tools

What it receives The search terms and the URL

Payment processors

Taking payment and handling refunds and disputes

What it receives Your payment details, which go to them and not to us, plus your email address

Email delivery provider

Sending verification and password mail

What it receives Your email address and the message

Sign-in providers you choose

Google or Discord sign-in

What it receives Whatever that provider decides to tell us, listed in clauses 2.3 and 2.4

A current list of the named suppliers behind these categories is available on request from [[SUPPORT_EMAIL]]. We may change suppliers; we will not change the categories without updating this page.

We also disclose data:

• to a professional adviser, auditor or insurer where they need it and are bound to keep it confidential;
• to a law enforcement agency, court or regulator where we are legally required to, or where we reasonably believe there is a risk to someone's life or safety, or where a report concerns material we are obliged to report;
• to a buyer, if the service is ever sold, on the same terms as this policy.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

14. International transfers

14.1 Kyrune runs on an edge network, which means your request is handled at a location near you and your data may be stored in or moved to another country, including the United States.

14.2 Where personal data leaves the EEA or the UK, we rely on the transfer mechanism available for that destination, which for most of our suppliers is the European Commission's standard contractual clauses together with the UK addendum. [[TRANSFER_MECHANISM]]

15. How long we keep things

Account record

Until you delete the account

Password hash

Until you delete the account or change the password

Session record

31 days, or until you sign out of it

Verification link

24 hours, or until used

Password reset link

30 minutes, or until used

Credit grants and balance

Until spent, and then until the account is deleted

Payment records

As long as tax and accounting law requires

Public posts, comments, collections

Until you delete them or delete the account

Cloud-saved images and uploaded files

Until you delete them or delete the account

K Agent conversations and their steps

30 days after the conversation was last used, or until you delete them

K Agent message attachments

7 days, or until you delete the conversation

Removed post, pending appeal

The record and files are kept until the appeal window closes; a purge is separate

Resolved reports

90 days after resolution

API usage records with content omitted

7 days

Provider fallback records with content omitted

Indefinitely, because they are how outages are diagnosed

Rate-limit counters

Minutes to hours, depending on the window

Backups

[[BACKUP_RETENTION]]

Where a period says "until you delete the account", deletion is not instant everywhere at once: caches and backups clear on their own schedule.

16. Your rights

16.1 If the GDPR or the UK GDPR applies to you, you have the right to ask for a copy of your data, to have it corrected, to have it deleted, to restrict how we use it, to object to processing we base on legitimate interests, and to receive it in a portable form. You also have the right to complain to your data protection authority. [[LEAD_SUPERVISORY_AUTHORITY]]

16.2 If you are in California, you have the right to know what we collect and why, to a copy of it, to have it deleted, to have it corrected, and not to be treated worse for asking. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing for you to opt out of. We do not use or disclose sensitive personal information beyond what is needed to provide the service.

16.3 If another privacy law gives you similar rights, we will honour them.

16.4 To use any of these rights, write to [[SUPPORT_EMAIL]] from the address on the account, or ask from inside the account. We will not charge you, we will not make you explain why, and we will answer within one month. If a request is genuinely complex we may take longer, and we will tell you.

16.5 We may refuse to delete a record where we are required to keep it, such as a tax record, or where deleting it would destroy the evidence behind a moderation decision or a legal claim. We will tell you which record and why.

16.6 We will ask you to prove you control the account before we act on a request about it. That is the protection, not an obstacle.

17. Deleting your account

17.1 You can delete your account from your account page, or by writing to [[SUPPORT_EMAIL]].

17.2 Deletion removes the account record, its sessions, any pending verification or reset links, your public profile, your posts, your comments, your collections, your cloud-saved images, your uploaded files, your API keys and your stored settings.

17.3 Deletion does not remove: payment records we must keep for tax; the records behind a moderation decision, for as long as clause 11 says; and copies other people made of something you published.

17.4 Unspent credits are lost when the account is deleted. See the Refunds and Cancellation Policy before you delete an account with a balance you paid for.

18. Children

18.1 Kyrune is not for children under [[MINIMUM_AGE]]. We do not knowingly collect personal data from anyone under that age.

18.2 If you believe a child under that age has an account, write to [[SUPPORT_EMAIL]] and we will look into it and delete the account if that is right.

18.3 The minimum age in this policy is the same number as the minimum age in the Terms of Service. If they ever differ, the Terms are wrong and we will fix them.

19. Security

19.1 Passwords are stored only as salted hashes. Sessions are server-side and revocable. Sign-in attempts, sign-ups and reports are rate limited. Payment webhooks are verified by signature before they are believed. The site is served over HTTPS only.

19.2 No system is perfectly secure. Data sent over the internet cannot be guaranteed, and we cannot promise otherwise.

19.3 If a breach happens that puts you at risk, we will tell you and the relevant authority within the time the law allows.

20. Cookies

See the Cookie Policy. In short: the cookies on kammii.ai keep you signed in, remember a small number of your own preferences, and protect forms from abuse. There are no advertising or analytics cookies.

21. Changes

21.1 We may update this policy. The version on this page, with the date at the top, is the one in force.

21.2 If a change materially affects how we handle your data, we will tell you by email or in the product before it takes effect.

22. Contact

[[LEGAL_ENTITY_NAME]] [[REGISTERED_ADDRESS]] [[SUPPORT_EMAIL]]