Kraftify

Privacy Policy

What we collect, how we use it, and your rights. Last updated: October 2026.

What We Collect

Your content data is four fields — and we cannot read any of them. Everything else we hold is account and operations data listed below, kept only as long as it is needed.

1. Email addressUsed for account authentication, billing notifications, and service announcements (material changes, security incidents). Product news only if you opt in — never by default.
2. Password hashscrypt with a per-password salt, only if you use password login. We cannot recover your password. We cannot see your password.
3. Environment key names and set-flagsThe names of your env keys and whether a value is set — so the console can show what is configured. Secret values never leave your browser, and we hold no hash of them either.
4. Billing recordTarget ID, node ID, and renewal date. Used for billing and account management. Kept 7 years as tax law requires, even after account closure.

Plus the account and operations data the service runs on:

5. OAuth profileGitHub or Discord username, display name, avatar URL and provider account ID — only if you sign in that way.
6. Session tokensRandom 30-day session IDs. Destroyed on logout or expiry.
7. Console snapshotYour targets, env key names and set-flags, ceiling and preferences — synced from your browser so the console looks the same on every machine. Deleted with the account.
8. Support and moderation recordsAppeals including your message, moderation log entries naming the account, domain claims and requests. Kept 1 year after the case closes.
9. Waitlist entryEmail plus what you would run. Kept until you unsubscribe or join.
10. CorrespondenceEmails you send to legal, abuse, or privacy. Kept for the life of the matter plus 1 year.
11. Short-lived edge logsProxy access entries and rate-limit counters (IPs, timestamps), rotated automatically. Days, not years.

What We Do Not Collect

  • Console output
  • Query results
  • Command history
  • Chat logs
  • Crash dumps
  • Query logs
  • Plugin telemetry
  • Application logs
  • Access logs for your target
  • Content of your environment variables
  • Traffic to and from your target

Abuse screening runs automatically on domain requests and public reports — that is how CSAM, phishing, and attack infrastructure get caught. An engineer debugging your box sees kernel logs and resource metrics only. There is no console in our tooling that opens your files, and access to account data is limited to the abuse, appeal, and billing cases described on this page.

How We Use Your Data

  • Account authentication and management
  • Billing and payment processing
  • Service announcements (material changes, security incidents)
  • Legal compliance (valid court orders only)

We do not sell your data. We do not share it with third parties except as required by law. We do not use it for advertising. We do not use it for machine learning. We do not use it for any purpose other than providing the service.

Data Retention

We retain your data for as long as your account is active. When you cancel, we snapshot the target and hold it for seven days. After seven days the target is deleted and the data is gone. We do not keep it "just in case".

Account data is deleted within 30 days of account closure — targets, snapshot, sessions, waitlist entry, appeals. Two things survive that: the billing record (7 years, tax law) and closed case records (1 year, so repeat abuse stays answerable). Everything else on this page goes with the account.

Your Rights

  • Right to access: Request a copy of all data we hold about you
  • Right to rectification: Correct inaccurate data
  • Right to erasure: Delete your account and all associated data
  • Right to data portability: Export your data in a machine readable format
  • Right to object: Object to any processing of your data

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Cookies & Trackers

One strictly-necessary session cookie, kraftify.session: a random ID that keeps you signed in for 30 days. No analytics, no advertising cookies, no cross-site trackers. Dismissing the notice only hides it; signing out deletes the cookie. See /cookies for the full list, including the local-only browser storage the console keeps (draft state, tour progress, notice dismissal) — none of which leaves your machine except the console snapshot described above.

Third Party Processors

A small number of processors act on our behalf, each only on the data named:

  • GitHub and Discord (OAuth sign-in): username, email, avatar — only if you sign in that way.
  • Cloudflare (CDN and tunnel): IP addresses and request metadata in transit, per their privacy policy.
  • Payment processor (named before billing launches): billing information, when you pay.
  • Cloud infrastructure provider: hosts our servers. Sees encrypted traffic and resource metrics, not your content.
  • Avatar and font CDNs (Discord, GitHub): your browser fetches public images and fonts directly from them when pages include them.

No analytics processors. No advertising processors. No data brokers. Ever.

Changes to This Policy

We may update this policy at any time. Material changes will be announced by email at least 30 days before they take effect. Continued use of the service after the effective date constitutes acceptance of the updated policy.

Contact

If you have any questions about this policy or your privacy, contact us at [email protected]. We will respond within 30 days.

kraftify
nonceradev
Written by the noncera team