Privacy

What we collect

• Your account: your email, your name, a one-way hash of your password, and, if you sign in with Google or GitHub, the id they give your account.
• Your connections: the service's address, the label and account name you typed, and its key or sign-in tokens, which are encrypted.
• The tool descriptions your connected services publish.
• Your permissions: what you set to Allow, Ask me or Block.
• Activity: for each attempt, which AI app, which connection and action, the outcome, the time and how long it took. Not the arguments, not the results, and not what was searched for. For each change, and each request that waits for your approval, a one-way hash of its arguments, so it does not run twice.
• The arguments of an action set to Ask me, encrypted, while it waits for your decision.
• The full version of a trimmed result, encrypted, for a short time.
• The result of an approved request, encrypted, for up to one hour after it runs.
• If you pay: Stripe's customer and subscription ids, the price you chose, the subscription status, when the current period ends and when a payment started failing. Never card numbers.
• Request logs: the method, path, status, timing and network address of each request. Google Cloud's own record of each request also has the full address, your browser's user agent and the page that linked to it.

The arguments and results of actions pass through our server on the way between your AI app and the service. They are not stored, apart from the encrypted approval and result cases above.

A public custom server you connect is listed in Explore, by its host name and public tool descriptions and without naming you or including account data, only if you or an AI app you connect shares it. Keep this private starts ticked when you add one, and Never list your connections in the directory, in settings, keeps all of yours out.

Google user data

When you connect a Google service (Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Google Contacts or Google Tasks), Kin Router asks Google only for the access that service's actions need, and only when you add it.

What we access. Gmail: your messages, drafts and labels. Google Calendar: your calendars, events, and free and busy times. Google Drive: your files' names, details, sharing and text, read only, and the folders and shared files Kin Router creates. Google Docs and Google Sheets: the documents and spreadsheets you or your AI app name. Google Contacts: your contacts, read only. Google Tasks: your task lists and tasks. From every Google connection: the account's email address and Google's id for it.

How we use it. Only to run an action that an AI app you connected asks for, when your permissions for that connection allow it, and to return the result to that AI app. Changes ask you first unless you choose otherwise.

What we store. The account's email address and Google's id for it, and the access and refresh tokens Google issues, encrypted. Content normally passes through without being retained. Three exceptions are kept encrypted: the full version of a trimmed result, with access expiring after ten minutes; the arguments of an action waiting for approval, cleared when you decide or with access expiring after one hour; and the result of an approved action, with access expiring one hour after the action ends. Expired copies are cleared by periodic cleanup, and backup copies age out under the retention described on this page.

Who receives it. Only the AI app you connected that ran the action. What that app does with the result is governed by its own terms and settings. We do not sell Google user data, use it for advertising, or use it to create, train or improve any AI or machine learning model. Kin Router itself does not run it through an AI model. People at Kin Router do not read it unless you explicitly agree that we may view specific data for support, it is needed to investigate abuse or keep the service secure, or the law requires it.

How to remove it. Remove the connection in Kin Router. That deletes its tokens at once, and when no other Kin Router connection uses the same Google account, it also revokes Kin Router's access at Google. You can remove Kin Router's access yourself at any time at https://myaccount.google.com/connections.

Kin Router's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Its use of information received from Google Workspace APIs also adheres to the Google Workspace API User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy).

Why we collect it

To run the service, to bill for it, and to keep it secure.

We do not sell your data, use it to train models, or run it through an AI model.

Who else handles it

• The AI apps you connect, which receive the results of the actions they run.
• Google Cloud, for hosting.
• Stripe, for payments.
• Resend, for account email such as password reset links.
• Cloudflare, for DNS.
• PostHog, in the United States, for product analytics.
• Google and GitHub, if you sign in with one of them. We receive your email address, your name and the id of your account there.
• Intercom, for support chat when you open it. If you are signed in, Intercom also receives your email address and account id, so we know who is writing.
• Endorsely, to credit the partner who referred you, only if you arrived through a partner's link.

How long we keep it

• The arguments of an action set to Ask me are deleted when you decline it or once it has run. If nobody answers, they can no longer be used after one hour, and a cleanup that runs every minute while Kin Router is running deletes them.
• The full version of a trimmed result can be read for ten minutes, then the same cleanup deletes it.
• The result of an approved request can be read for one hour after the action ends, then the same cleanup deletes it.
• Google keeps request logs for 30 days.
• Removing a connection deletes its credential.
• Deleting your account deletes it from our database at once, and backups age out within about a week. Stripe, PostHog and Intercom keep what they already hold, as What Kin Router holds describes.

Product analytics

We use PostHog, hosted in the United States, to see how people find and use Kin Router, such as how many visitors sign up and how many go on to connect a tool, and to find and fix errors.

For every visitor, without asking, we send the pages you open (with ids removed, and nothing after a "?" except the campaign tags of a link we shared, such as utm_source=newsletter), the site that referred you, your browser, operating system and device type, and a few milestones: seeing our prices, which part of a page a sign-up button you click is in, starting to sign up and with which plan, signing up and how, a sign-up that did not go through (only a reason from our list, such as "email already used"), connecting a service or failing to (only which one from our directory, or "custom", and a reason from our list), an AI app connecting for the first time and which kind of app it is (only from our list, such as ChatGPT, Claude or Cursor, or "other"), the outcome of the first action an AI app runs, an AI app's action succeeding (at most once a day), deciding a request, creating a profile, reaching a plan limit, choosing to upgrade, starting checkout, subscription changes and deleting an account. When you sign up, the campaign tags and referring site you arrived with are sent with it (through a Google or GitHub sign-in they ride in its short-lived sign-in cookie), so we can tell which links bring people who sign up. These basics use no cookies and nothing stored in your browser.

We also send error reports, from your browser and from our server: the kind of error, where in our code it happened, and its message with addresses, quoted text, email addresses, long numbers and anything that looks like a token removed. Error reports leave out what you typed, the contents of requests, the details of actions and their results.

Milestones and errors are counted per workspace too. A workspace is known to PostHog by an internal number with only its plan, the month it was created and roughly how many connections it has.

If you have an account, all of this is linked to an internal account number, never to your email address or name. We never send PostHog your email, name, password or tokens, the names or addresses of your connections or profiles, the names of your AI apps (only which kind each is, from our list), what your AI apps search for, the details of any action, or any result. Events from your browser pass through our own server, which keeps only the items above and does not forward your IP address.

Three more things run only if you choose Allow when we ask, wherever you are: session recordings, short surveys, and an id kept in your browser so tests of new designs stay consistent. A session recording shows how you moved through our public pages (such as the home page, pricing, sign in and sign up, and these policy pages) and the setup steps that show none of your connected data (your first visit, your list of connections, connecting an AI app). Every word on the page and everything you type is hidden in the recording before it leaves your browser. We never record pages that can show what your connected services hold, such as approvals, activity, Try it, a connection's own page, computers, Explore or settings, and our server refuses any recording from them. Recordings never include data from Google or any other connected service. A survey asks one question at a time, and we receive your answer.

If you choose No thanks, none of these three runs and we do not ask again. You can change your answer at any time under Privacy choices at the bottom of our public pages, or in settings. If your browser sends Do Not Track or Global Privacy Control, it sends nothing to PostHog, and we do not ask. Our server only adds one to an hourly count of visits to our public pages, sign-ups started and sign-ups, split by the campaign tag or referring site you arrived with. Those counts hold no id, network address or browser details, stay on our server, and are never sent to PostHog. Milestones our server records for your account, and errors on our server, are still sent, without the campaign tags or referring site.

Cookies

We set only the cookies Kin Router needs to work: the sign-in session cookie, and short-lived cookies that keep a sign-in with Google, GitHub or a connected service secure while it is under way. The app also keeps a few settings in your browser's storage, such as your answer about analytics. Analytics sets no cookies. If you allow session recordings, surveys and experiments, PostHog's id for you is kept in your browser's storage until you turn them off. There are no advertising trackers, apart from the partner referral cookie described below. If you open the support chat, Intercom sets its own cookies to keep that conversation going, and while the chat is open it sees the address of each page you visit here. Nothing from Intercom loads until you open the chat. If you arrive through a partner's referral link, Kin Router checks the partner's code with Endorsely, our partner program service, and tells Endorsely about the referral so that partner is credited if you subscribe. Endorsely gets the partner's code from our server, not your address or anything from your browser. Kin Router remembers that partner in a cookie of its own for 60 days and keeps the partner with your workspace, so it still counts if you subscribe from another device. Nothing from Endorsely loads in your browser, and a browser that sends Do Not Track or Global Privacy Control is never credited to a partner.

Your choices

You can delete your account in settings, and remove a single connection from its own page. Exporting your data is not built yet.

Questions and privacy requests go to privacy@kinlab.ai.

Changes to this policy

When this policy changes, the new version will be posted on this page.