# Privacy policy > What personal data the hosted clai.chat service stores, why, who processes it, how long it is kept, and how to exercise your rights under the GDPR. Canonical URL: https://www.clai.chat/privacy/ Full site index: https://www.clai.chat/llms.txt Last updated: 2026-10-26. This policy covers the hosted service at clai.chat: the docs, the agent hub, the cloud sync stores, billing, and the account you sign in with. The open-source `clai` CLI sends nothing to us unless you run a `clai cloud` command or a `cchub:` target: otherwise it talks only to the model vendors you configure, and to whatever you point it at. Terms of use are in the [terms of service](/terms/). ## Who is responsible Kinagtwo, Tampere, Finland ("we") is the controller of the personal data described here. Contact for privacy questions and requests: [info@kinagtwo.fi](mailto:info@kinagtwo.fi). We have not appointed a data protection officer, as the law does not require one for this service. ## What we store and why | Data | What it is | Why | Basis | | -------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | ----------------------------- | | Account | A random id, your email address as verified by GitHub, Google or a code we email you, the provider's user id, and your GitHub user name when you sign in with GitHub. We store no name or picture. | To create and recognize your account, link sign-ins with one email, and contact you. | Contract | | Email sign-in | When you sign in by email: your address, a hash of the one-time code and link, their expiry, the wrong attempts, and a hash of the network you asked from. | To sign you in, and to stop guessing and mail abuse. | Contract, legitimate interest | | Sessions | A session cookie of 30 days; we store only a hash of its value. A 10-minute cookie holds a sign-in in progress. | To keep you signed in, and to complete sign-in safely. | Contract, necessary cookies | | Handle | The public name you choose the first time you publish, such as `lorentz`. It is shown with everything you publish and comment. | To credit you on the hub without publishing your email address. | Contract | | Hub content | What you publish: kind, name, title, summary, readme, example run, the config itself, every version with its changelog, and the times. All of it is public. | To run the hub. | Contract | | Comments | What you write under an agent, the version it was about, and the time. Comments are public and show your handle and your current rating of that agent. | To run the hub's discussions. | Contract | | Ratings | The stars, 1 to 5, that you give another author's agent, and the time. The hub shows the average and the count, and next to a comment you wrote, your own rating. | To rank the hub and show what helped. | Contract | | CLI logins | For each `clai cloud login` you approve: the name the CLI sent (usually its host name), the country it started from, read or write access, when it was approved, last used and expires, and a hash of its key. While a login waits for approval, a hash of the network it came from. | To let each machine sync, to let you see and revoke them, and to limit abuse. | Contract, legitimate interest | | Synced files | The files you commit: your clai configs (profiles, MCP servers, shell contexts, skills, mode configs, theme) and your conversations with their images and reasoning, and, if you commit them with `--imports`, the conversations clai imported from other tools; each file's path, size and hash, and each commit's message, size and the CLI login that made it. | To keep your stores in sync across your machines. | Contract | | Billing | Once you add a card: your Stripe customer and subscription ids, the status, the billing period, when a payment failed, the most you stored this period, and what we reported to Stripe for it. Card details go to Stripe and never reach us. | To charge for the conversation store, to know whether it is paid, and to keep accounts as the law requires. | Contract, legal obligation | | Account events | A record of sign-ins, sign-outs, things you published or withdrew, and admin actions on your account. | For your account history, security, and support. | Legitimate interest | | Email | Which storage and billing notices we sent you and when, such as a failed payment, commits refused, and conversations about to be deleted or deleted. Besides these we send only sign-in codes and notice of changes to these documents. | To run your account. We send no marketing. | Contract | | Server logs | Cloudflare Workers logs of requests, including the URL (which can name an agent) and the network address, and error messages that can hold ids. | To operate and secure the service. | Legitimate interest | Where the basis is legitimate interest, our interest is running a secure, working service, and you can object to it as described below. We do not run advertising or analytics trackers, and we set no third-party cookies. The only cookies are the strictly necessary ones above, which need no consent. Your browser stores your theme choice locally. The pages load no third-party scripts or fonts. Signing in is optional: reading the docs and the hub, and running a public agent, need no account. We make no decisions about you by automated means that have legal effect. An account is suspended or deleted by a person. The rules that refuse a conversation commit without a card, or a publish that looks like it holds a credential, follow from these documents, and you can ask a person to look at any of them. ## What you publish is public An agent or other config you publish, its versions, and your comments are readable by anyone, without an account, at stable URLs, until you withdraw or hide them or delete your account. Your handle appears with all of it. Do not publish credentials: the form refuses the common key shapes, but you are responsible for what you paste. Nothing you publish is sent to a model provider by us. A person who runs your agent sends it to the model vendor they choose, from their own machine. ## Your sync stores are private Your config and conversation stores are visible only to your own account and the devices you approved. They are not public and not end-to-end encrypted: the files sit in Cloudflare's storage under your account, and our systems read them only to store, count and return them. We do not look at their content, and we do not use it to train models or for anything else, except where you ask us to in a support case or the law requires it. Conversations can hold anything you or a model wrote, including other people's personal data. You decide what to commit. The CLI keeps a config file local when it looks like it holds a credential, but it cannot catch everything. Imported conversations from other tools are committed only when you ask for them. ## Who receives it We use these providers. Each processes data only to provide its part of the service to us, except where the table says otherwise. | Provider | For what | Data | | ----------------- | ------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Cloudflare | Hosting (Workers), database (D1), storage of your synced files (R2), logs, and outgoing email (Email Service) | Everything above, since the whole service runs there | | Stripe | Checkout, the customer portal, invoices and payments for the conversation store | Your email, account id, usage per month, and the payment details you give Stripe. Stripe is also a controller of its own records under the payment and anti-money-laundering laws that apply to it | | GitHub and Google | Sign-in, if you use them | They tell us your provider id and verified email, and GitHub your user name. They are controllers of their own sign-in data | Some of these providers process data outside the European Economic Area, including in the United States. Where that is so, we rely on the EU-US Data Privacy Framework for providers certified under it, and otherwise on the EU Standard Contractual Clauses they offer. We do not sell personal data, and we do not share it with anyone else except where the law requires it, such as an order from an authority. ## How long we keep it - Account, handle, sessions, devices, published content, comments, ratings and account events: until you delete your account. A withdrawn agent or a hidden comment stops being shown at once, and is deleted with your account. - Sync stores: until you delete a store or your account. A deleted file keeps only its path and the time of deletion, so your other devices learn of it. Uploaded bytes that no commit uses are removed after a day. - Unpaid storage: if a bill stays unpaid for 30 days, or 30 days after your subscription ends, your synced conversations are deleted, oldest first. We email you a week before. The config store is never deleted for this. - CLI logins: until you revoke them, they expire after 90 days, or you delete your account; an expired or revoked one is dropped 30 days later. - Email sign-in codes: they work for 15 minutes, are stored only as hashes, and are dropped, with the address and network hash beside them, a day after they expire. Expired sessions and sign-ins in progress are dropped automatically. - Billing records: the bookkeeping records the Finnish Accounting Act requires, such as invoices and payments, are kept for six years after the end of the financial year, also after you delete your account. Stripe keeps its own records under its own privacy policy. - Server logs: for the period Cloudflare keeps them, which we do not control. When you delete your account, we cancel your Stripe subscription, delete your synced files, and remove, in one step, your sessions, sign-in details, CLI logins, every agent you published with its versions, ratings and comments, the ratings and comments you gave, and your events. What remains is one record that an account was deleted, under the random account id, with no email address; the billing records above; and your handle, kept only so that it is never given to someone else, since other people's scripts may name it. Signing in again with the same email creates a new, empty account. Cloudflare may keep recovery copies for a limited time as part of its platform. ## Your rights Under the GDPR, you can ask us to give you access to your data, correct it, delete it, restrict or object to how we use it, and give you a copy in a portable form. You can pull your sync stores with `clai cloud pull`, download anything you published, and delete your account from your account page. For anything else, write to [info@kinagtwo.fi](mailto:info@kinagtwo.fi). We answer within one month, and may ask you to confirm the request from your account's email address. You can complain to the Finnish Data Protection Ombudsman ([tietosuoja.fi](https://tietosuoja.fi/en/home)) or to the data protection authority where you live or work. ## Children The service is not for anyone under 16, and we do not knowingly collect their data. If you believe a child has an account, write to us and we will delete it. ## Security Sign-in goes through GitHub, Google or a one-time emailed code, so this service never holds a password. Session cookies, CLI keys and sign-in codes are stored only as hashes; cookies are marked `HttpOnly` and `Secure` and sent only over HTTPS. Each account's stored files sit under a separate key space. Reads and writes go through one Worker that checks the session or token, and the origin of every form post. No system is perfectly secure; where the law requires it, we will notify you and the authority of a breach that affects you. ## Changes If we change this policy in a way that matters, we will tell you by email or on your account page before it applies. The date at the top shows the last change.