Privacy policy

Kekkai is operated by [Owner's legal name: to be provided] (“we”). This policy explains what the Kekkai command-line tool, the Kekkai website and email alerts send to us, what we keep, and for how long.

The short version

• Kekkai runs where your project lives. It never sends us your code, findings, reports or secrets, and it has no telemetry.
• Your account needs an email address. Linking a computer, using a project and renewing your license send us a few small facts, listed below.
• With email alerts on, each project's package list is sent so we can email you about new advisories. Turn alerts off and it stays on your machine.
• Your coding agent is a separate product with its own provider and its own rules.

Never sent to us

• Your source code, config files and migrations.
• Findings, evidence, excerpts, test receipts and reports.
• Secrets Kekkai finds, and the credentials your tests use.
• File paths, folder names and repo URLs. A project's name reaches us only if you type one.

What the command-line tool sends

Advisory updates

Everyday commands check for new advisory data at most once a day, and download it when there is some. No request carries anything about your project. Offline mode turns this off.

License renewal

Once a day, while you use Kekkai, it renews its license with our account service. That request tells us that a license was in use on that computer that day. It is separate from the advisory download, which stays anonymous and sends no license, account or project data.

Linking a computer

kekkai login links a computer to your account. We keep the computer's name as the tool reports it (for example “Dana's MacBook Pro”), its operating system and processor type, the Kekkai version, when it was linked and last used, the country it was last used from (we don't keep IP addresses), whether you allowed email alerts from it, and a hash of its key. You can unlink a computer at any time, and one unused for 180 days is unlinked automatically.

Projects

A project counts toward your plan the first time Kekkai is used in it. We keep a random project ID and a nickname (“Project 1” until you rename it).

Counting a project once across your computers. The first time you use Kekkai in a project, it sends our account service one value, so the same repository on your other computers counts as one project, not two. The value is a fingerprint of the repository's first git commit ID, made with a one-way function and a secret key that is different for every account. It contains no folder name, path, remote URL, file contents or package list, and fingerprints cannot be matched between accounts. What it can reveal: for a private repository whose history has never been public, nothing, because nobody outside the repository knows its first commit ID. A public repository's first commit ID is public (and so is that of a private copy or fork of one), so someone with access to our database could test whether your account works on that repository. A fork shares its original's first commit, so a fork and its original count as one project in your account. If a folder has no git history yet, or is a shallow clone without its first commit, Kekkai sends a random value instead, and that folder counts once on each computer where you use it. Removing the project from your account deletes its fingerprint and frees its slot.

Email alerts

Alerts start on when you sign up, and you can turn them off at any time in your account or from any alert email. While they are on, each project's package list is sent when it changes (when you push with git or run a Kekkai command in the project). It contains, for each package: its ecosystem, name, version (or none if unknown), whether it is a direct or development dependency, the hosting platforms detected, and which ecosystems Kekkai could read.

A project's list is uploaded only from a computer where you allowed email alerts when you linked it, and only after Kekkai has shown on that computer what it will upload for that project. kekkai alerts preview prints the exact upload.

Package lists, nicknames and your email address are encrypted where we store them, with one key held by the alerts service. Whoever controls our Cloudflare account could read them. A list is kept until you turn alerts off or remove the project, and is then deleted at once. After 90 days without an update we send one email asking whether you still want alerts.

With alerts off, your package lists never leave your machine. You can still check for new advisories by hand with kekkai watch --once.

What the website keeps

• Your email address, and a session cookie that keeps you signed in. We use no advertising or tracking cookies.
• Sign-in codes, stored as hashes. They expire after 10 minutes.
• Short-lived counts of sign-in attempts per email and per network address, kept as keyed hashes to stop abuse and deleted within a day.
• Your onboarding answers (agents, stack, stage, the risks you chose, how many apps, your alerts choice), used to tailor your setup.
• Your plan and its status. During the beta, payments run in test mode: we don't keep card details.
• A record of each license we issue: which computer, which plan, and when it expires.
• When real payments start, our payment provider (Paddle or Lemon Squeezy) acts as the merchant of record and handles your payment details under its own privacy policy. We receive your plan, its status and a customer reference.

Who processes data for us

• Cloudflare: hosting, databases and email sending.
• Our payment provider, once real payments start.

We don't sell personal data and don't share it for advertising.

How long we keep it

We keep account data while your account exists. When you delete your account or remove a project, we delete the data at once; backups keep it for up to 30 days before it is gone.

Your choices

• Turn email alerts off, remove projects and unlink computers in your account: Alerts, Projects and Computers. These work without a plan.
• Ask for a copy of your data, a correction, or deletion of your account by writing to privacy@trykekkai.com.

Your coding agent

Your coding agent reads your code itself during a review; Kekkai only tells it what to look at. The agent's provider may receive your code under its own terms. Kekkai has no control over that.

Changes

If we change this policy in a way that matters, we'll update the date above and email you before the change takes effect.

Contact

[Owner's legal name: to be provided]. Email privacy@trykekkai.com.