Privacy notice

This notice explains what the invite-only Kinet pilot and this website do with data. It is a draft. Where something still has to be decided, it is marked "to be confirmed". The Terms of service are a separate draft.

Who is responsible

The pilot is operated by Peter Bi, an individual.

Questions about privacy can go to support@kinet.com for pilot users, or hello@kinet.com for everyone else.

What we store

Your plans, tasks and history are stored as Markdown in a Git repository for each user and agent on the host.

The app store and the audit log are SQLite databases.

Account data includes your verified email, whether email recovery is ready, and any recorded Terms/Privacy consent versions. Legacy accounts do not gain verification or consent automatically.

Kinet records what you asked, what it proposed, what you approved and what happened.

Audit metadata can contain your content.

Admins use an authenticator app, and each user has monthly spend and storage caps, so usage is counted against them.

The current pilot installation is configured with monthly model-spend limits of USD 10 per pilot user and USD 100 per installation, and storage limits of 2 GiB per pilot user and 8 GiB per installation. These are configured limits, not charges or promises about future public accounts, capacity or availability.

Live data is protected by the host operator's disk encryption.

Where your data is processed

Your content is processed on the host that runs the pilot, a server hosted with OVHcloud US in Oregon (US-WEST-OR), United States.

The pilot uses the shared development VPS in OpenStack region os-us-west-or-2, under a pilot-only exception. This is not dedicated per-user hosting.

The operating region label is South California; this label is not the hosting location.

Hosted workflow commands run in rootless containers that make no network calls themselves, and they receive neither the engine socket nor the model provider's credentials.

When you run a workflow, Kinet's host sends the HTTPS requests you approved to the API providers you chose; they receive what the approved request contains. The API keys and tokens you provide are stored write-only by the operator and injected by the host, and the runner never holds them. Responses are reduced to the fields you selected.

The model provider processes the content we send it to produce replies, as described next.

The model provider

Your chat messages and other content are sent to a model provider to produce replies.

The active invitation-only pilot uses DeepSeek, model deepseek-flash through its Anthropic-compatible endpoint.

DeepSeek's own published pages, read on 2026-10-04, say the following. They are DeepSeek's statements to its own customers and users, not a promise to Kinet's users.

• Its privacy policy (last update 2026-02-10) says it collects, processes and stores personal data in the People's Republic of China.
• That policy gives users a right to opt out of the use of their personal data for training its models, and says it keeps personal data for as long as necessary, without a fixed period.
• That policy does not cover the processing rules for end users of applications that developers build on its open platform.
• Its Open Platform Terms (effective 2026-04-29) are governed by the laws of the People's Republic of China in the mainland, leave the customer's rights in what it submits with the customer, and set no retention period for inputs or outputs and do not say whether they are used for training.

The retention and training terms that apply to content the pilot forwards have not been confirmed with DeepSeek, so this notice states none for Kinet's users.

Server web search is not available on this provider in the hosted pilot.

A workflow run can add a report. If you choose a model summary, only the response fields you selected are sent to the provider, in one attempt, with fixed instructions and no tools; without a summary, no model call is made. Report email requires a verified address permitted by the operator's recipient policy. Provider acceptance is not proof of inbox delivery.

Do not put passwords, payment card numbers or other secrets into chat or into a project.

Account and report email

The installed app uses Cloudflare to send account-verification and eligible recovery messages, and separately approved workflow reports. For each message, Kinet sends Cloudflare the sender and recipient addresses, subject and plain-text body over HTTPS. Account message bodies contain verification or recovery links; report messages contain the approved report content. If delivered, the receiving mailbox provider also processes the message.

The current personal configuration permits only the operator-approved personal-test recipient. This restriction applies to both account and report messages, including administrator recovery. A Kinet-verified address alone does not establish delivery eligibility. Cloudflare destination verification is separate from Kinet's account-email verification.

Email recovery preserves an enabled authenticator and revokes existing sessions after a successful reset. Manual invitations and administrator-issued resets remain separate procedures.

No specific outbound-provider retention or training terms are promised here. The DeepSeek uncertainty above remains unchanged. Account and report messages have separate permissions and limits; an uncertain send is not retried automatically, and provider acceptance does not prove receipt.

Media input and analysis

Audio, image and short-video input and analysis are available in the invitation-only pilot. Broader self-service registration is not open.

The browser app supports microphone recording on supported mobile and desktop browsers, and uploads of PNG/JPEG/GIF images, WAV/MP3/WebM/MP4 audio and WebM/MP4 video. Browser and codec support varies; unsupported recording offers file upload instead. Recordings can be reviewed on your device before you choose Upload recording. Live calls, live voice and spoken replies are not available.

Uploading a file or choosing Upload recording stores the media in private storage tied to your account and agent. Uploading alone starts neither decoding nor a model request; you choose processing separately.

• Audio transcription runs locally on the host in a worker with no network access; it does not upload audio to a transcription provider.
• Image analysis sends a locally normalized image and source/digest/dimension metadata to DeepSeek. For an animated image, only its first frame is analyzed.
• Short-video analysis sends up to eight sampled frames, a locally generated transcript, and source/digest/timing metadata to DeepSeek. It does not send the original audio or video to the model provider. Sparse samples can miss events, and the transcript and report can be inaccurate.

Preparing a transcript as an editable chat draft sends nothing. Using the separate Send action may send that text to the model provider. Video analysis already sends its transcript as described above.

Raw media that you have not chosen to retain expires 24 hours after upload or successful processing. Failed or cancelled processing keeps its original expiry. Cleanup can wait for active processing or the next cleanup pass after the service restarts; this is not a promise of physical erasure at an exact time.

Raw media you explicitly retain, and derived transcripts and reports, remain until deletion. Saving reviewed text as project evidence requires typed confirmation of the exact text and destination. That Markdown and Git history can remain after raw media is deleted, until deleted with its account or workspace. Saving evidence does not complete a project task.

Media job and audit records contain identifiers, counts, digests, outcomes and processing provenance, without media payloads, transcript or report text, or filenames. This does not apply to all audit metadata, which can contain user content.

Backups exclude unretained raw media and include retained and derived material. Restore checks current account and artifact deletion evidence. Account purge waits for processing cleanup to be proven; minimal deletion evidence remains. Backup expiry has the operational qualifications below.

Backups

Backups are encrypted with Restic.

Google Drive is the encrypted Restic backup backend. A Production-authorized backup, 30-day pruning and repository check succeeded, and the daily backup timer is enabled and active. Future coverage and expiry depend on successful runs, authorization, pruning and provider availability.

The configured backup policy uses a fixed window of 30 days when backup and pruning run successfully. Future backup coverage and expiry are not guaranteed.

Who can access your data

Admin screens cannot browse your content. They show account metadata and content-free security metadata.

Trusted admins can take over an account through a one-time password reset.

The host operator can access the host. A stronger tier that resists the operator is not built, so Kinet does not offer end-to-end or operator-proof privacy.

The model provider receives the content sent to it for replies.

Cloudflare handles requests to this website, routes inbound contact mail, and processes the app’s outbound account/report messages as described in “Account and report email”.

We do not sell your data and we do not use it for advertising.

Retention and deletion

You can delete your account in the browser app.

Deleting an account revokes access immediately, then purges your live data, including archived agents and private state.

The configured fixed window for backups is 30 days when backup and pruning run successfully. Future expiry depends on successful backup and pruning; an enabled timer does not guarantee that every run succeeds.

Restoring a backup first replays a deletion registry, so a deleted account cannot return.

Minimal deletion evidence, a tombstone and the deletion registry, is kept after deletion.

The operator confirms independent off-host custody of the refreshed deletion evidence. Further deletions require current evidence and may require an updated independent copy for safe restore. This custody confirmation does not guarantee future backups or expiry.

Audit metadata that can contain your content is included when your data is purged.

Cookies

The Kinet app uses host-only session cookies, marked Secure, and a CSRF cookie to keep you signed in.

This website sets no cookies.

This website

This website is a static site hosted on Cloudflare Pages. Access can be limited by a shared password while the site is private; such credentials are not personal accounts.

The website sets no cookies, uses no analytics and loads no third-party scripts, fonts or images. Its content security policy only allows resources from its own address.

The website has no forms and collects no personal data of its own.

Cloudflare, as the host, processes standard request data, such as IP addresses and request details, to serve the site. Cloudflare's customer data processing addendum, which the owner has read and accepted, applies to that processing.

Contacting us

You can write to hello@kinet.com or support@kinet.com. Cloudflare Email Routing forwards the mail to the owner's mailbox. The website does not store mail.

We keep an enquiry only while we are acting on it, and delete it no later than 12 months after the last message.

Please do not send passwords, authenticator codes, payment card details or private documents. Invitations and admin-issued resets use manual delivery; eligible app verification/recovery messages use the separate outbound flow above. Kinet never asks you to email your password or authenticator code.

Your requests

You can ask us to delete a message you sent us. We will delete it, reply to confirm without repeating its content, and keep only the date of the request.

Pilot users can delete their account in the browser app, or write to support@kinet.com.

Depending on where you live you may have further rights. The applicable rights and request procedure remain to be confirmed. to be confirmed

Changes to this notice

Version v6 records installed account/report email, eligible recovery, outbound Cloudflare processing and restricted recipients. Existing media, hosting, conditional backups, retention and deletion boundaries remain disclosed. B4, B5 and B6 remain to be confirmed where marked; these documents remain drafts.

We may change this notice. Each version has a number and a date at the top of the page, and we will say what changed.

While this text is a draft, nothing in it binds anyone.