Kraftify

Subpoena Policy

How we handle legal requests for customer data. Last updated: October 2026.

What We Have

Your content data is minimal — four fields, none of them readable:

  1. Your email address
  2. A scrypt hash of your password (password logins only)
  3. Env key names and set-flags — never secret values
  4. The billing record (target ID, node ID, renewal date)

That is the whole content list. No console logs. No command history. No query logs. No plugin telemetry. No env secret values.

Account and operations data exists too — the same manifest as our privacy policy:

  • OAuth profile (provider username, display name, avatar URL) for OAuth sign-ins
  • Session tokens while valid (30 days), console snapshot (targets, keys, ceiling, prefs)
  • Appeals including your message, moderation log entries naming the account, domain claims and requests
  • Waitlist entry, correspondence with legal/abuse/privacy, short-lived edge logs

What Happens When We Get a Subpoena

1. We review it. Every legal request goes to a human being who checks whether it is valid, enforceable, and properly scoped. Overbroad requests get challenged.

2. We notify you. Unless legally prohibited, we will tell you that we received a request and give you time to challenge it yourself.

3. We produce what the order covers. Email, password hash, env key names, and billing record — plus whatever account and operations records a valid order names. There is no content beyond that to produce, because we never stored it.

What We Will Never Do

  • Voluntarily provide data to anyone without a valid legal basis. The exceptions are written into law, not our discretion: suspected child sexual abuse material goes to NCMEC, and we preserve and disclose what an emergency disclosure requires. Everything else waits for a court order.
  • Build backdoors or quiet access into your targets. Abuse screening and the account records above are the beginning and end of what we can see.
  • Start logging content — console output, secret values, chat history — under any circumstances.
  • Notify third parties about your use of the service.

Contact

If you are a law enforcement officer with a valid legal request, contact us at [email protected]. We will respond within 5 business days.

If you are a customer who has been notified of a request for your data, contact us immediately. We will tell you exactly what was requested and what we produced.

kraftify
nonceradev
Written by the noncera team