Projects
Nothing is written to your plan until you type confirm on the exact proposal. Reject revises it and writes nothing.
Safety and privacy
Safety and privacy, stated plainly
Kinet is a trusted-operator service: the people who run the host can reach it. Here is what that means, and what protects you.
Approval gates
Project external actions
Projects leave bookings, purchases, messages and account changes to you as tasks.
Workflows
A workflow needs a separate confirmation, bound to the exact package, before it runs.
In the hosted pilot, you can run the approved workflow. It can call only the APIs you reviewed, and Kinet refuses private networks and other destinations.
API keys and tokens are write-only. A controlled broker injects them; the isolated runner never holds them.
Your data
Where it lives, and how long
Plans, tasks and history are kept as Markdown in a Git repository for each user and agent on the host. The app store and the audit log are SQLite.
Kinet relies on the operator's disk encryption for live data.
The pilot runs on a shared VPS in Oregon, USA, not dedicated per-user hosting. Read the hosting details.
Audit metadata can contain your content, and it is included when your data is purged.
Backups
- Backups are encrypted with Restic
- The configured retention policy is 30 days when backup and pruning run successfully; automatic expiry is not yet guaranteed
- A Production-authorized Google Drive backup, pruning and repository check succeeded; the daily backup timer is enabled. Future coverage depends on successful operations
Deletion
When you delete your account
Access is revoked immediately, and your live data is then purged, including archived agents and private state.
Restoring an old backup first replays a current deletion registry and refuses to start if that evidence is missing, so a deleted account cannot come back.
Minimal deletion evidence, a tombstone and the deletion registry, is kept after deletion.
The operator confirms independent custody of the refreshed deletion evidence. Further deletions require current evidence for safe restore.
Your account screen
In the browser app, users manage their usage, sessions and deletion.
Who can see what
Admin screens
Admin screens and APIs cannot browse your content. They show account metadata and content-free security metadata.
Account takeover
Trusted admins can take over an account through a one-time password reset. This is a deliberate part of the trusted-operator design.
The host operator
The host operator can access the host. A stronger tier that resists the operator is not built, so Kinet does not offer end-to-end or operator-proof privacy.
The model provider
Your chat messages are sent to a model provider to produce replies. The Privacy notice names the provider and says what is known about it.
Before you process media
Media input and analysis are available in the invitation-only pilot. Uploading alone starts no decoder or model request. You choose processing separately.
The app supports microphone recording on supported mobile and desktop browsers, and supported uploads. Live calls, live voice and spoken replies are unavailable.
Audio transcription runs locally on the host. Image analysis sends a normalized image to DeepSeek. Video analysis sends sampled frames and a locally generated transcript; original audio and video are not uploaded to the model provider. Sparse sampling can miss events.
Unretained raw media has a 24-hour expiry after upload or successful processing, with cleanup subject to processing and service availability. Retained raw media and derived transcripts and reports remain until deletion. Confirmed project evidence can survive raw deletion.
Read the Privacy notice’s media section for the full data flows, retention and deletion details.
Sign-in
How access is protected
The pilot is invite-only: an admin issues an invite and you set your own password.
Invitation delivery is manual: an admin provides the app address and invitation token through a trusted channel. Account verification, eligible password recovery and approved workflow reports use separately configured email delivery.
Cloudflare processes outbound account and report messages. Sending is restricted to the operator-approved personal-test recipient; verifying an address alone does not enable delivery. Read the email data flow.
- Host-only session cookies, marked Secure, with CSRF protection
- Admins must use an authenticator app; ordinary users are not required to
- Recovery uses an admin-issued reset or an eligible verified email. Email recovery preserves your enabled authenticator.
A question about your data?
Write to support@kinet.com, or read the pilot's limits.
Write to support support@kinet.com