Privacy policy

Last updated: 11 October 2026 (simple access) · Draft for the beta

KumbayAI lets you use your AI assistants from one web page while the assistants, your API keys, your files and your chats stay on your own devices — or, if you use KumbayAI without installing the hub, in a vault that your browser encrypts before anything reaches us. This policy explains the little we do process to make that work.

Who we are

KumbayAI is operated by a self-employed business registered in Portugal (the “controller” under the GDPR). Contact: privacy@kumbayai.com.

What we process

Account data: your email address, a hashed password (if you sign in with email and password) or the identifier from Google or Apple sign-in, your two-factor authentication registration, and sign-in timestamps.
Account settings: the groups you belong to (for example, beta access) and your plan.
Your devices: the name you give each paired device, its operating system, its KumbayAI version, when it was paired and last seen, and whether it is currently connected. When you link a new device we send you an email about it.
Your account key (simple access — the default): to make sign-in simple, we keep a protected copy of your account key (the encryption key that lets your browsers use your devices). It is encrypted with a separate key kept in Google Cloud’s secure key storage (in the EU) and is released only to you, over an encrypted connection, after you sign in with your password and your two-factor code. Because we keep this copy, KumbayAI could technically access your account key. Each time it is released we record the time, the browser and operating system (for example “Chrome on Windows”), the first part of the IP address (for example 203.0.113.x) and an identifier of that browser, and we email you the first time a new browser receives it. You see this list on your Account page. Maximum privacy: if you turn it on, we delete the protected copy at once and keep none while it is on.
Locked copies of your account key (optional): its public key, and copies of the key that your browser has locked with a passkey or your recovery key before sending them to us, together with each passkey’s identifier and the label you gave it. We can’t open these copies: the passkey and the recovery key never reach us.
Your encrypted vault (only if you use KumbayAI without a hub): your chats, agents and their settings, API keys, saved prompts and usage figures, each encrypted in your browser with keys derived from your account key before it is stored (with simple access we keep the protected copy of that account key described above; with Maximum privacy we don’t). We hold only the encrypted data and the few details needed to store and sync it: a random-looking identifier per chat, sizes, times and version numbers.
Connectors (only if you connect an AI service such as claude.ai to KumbayAI): the name and return address the AI service registered with us, the access and refresh tokens we issued to it and its temporary sign-in codes (stored only as one-way hashes, with their expiry times), and the permission you granted: which devices, which folders, whether reading, commands, writing files and asking your agents are allowed, need your approval or are off, signed by your account key, plus when it was created and last used.
Technical logs: IP address, browser type and times of requests, kept for security and troubleshooting.

What we do not process

The contents of your chats, prompts, replies, files, voice, API keys, logins for AI services and app settings never reach us in readable form. When you use KumbayAI from a browser or phone, the traffic to your devices passes through our relay end-to-end encrypted with session keys that exist only on your browsers and devices, so the relay cannot read it. Without a hub, your browser encrypts this data with your account key before storing it with us (see “Your encrypted vault” above). Backups are encrypted on your device before they are saved to a local folder.

What simple access changes. With simple access (the default) we keep a protected copy of your account key, as described above. We use it only to give it back to you when you sign in with two-factor authentication. We do not use it to open your vault or to connect to your devices — but because we hold it, we could technically do so. If you want KumbayAI to be unable to access your account key at all, turn on Maximum privacy on your Account page.

There are two cases in which content passes through our relay in readable form. In both, it is only forwarded while in transit (protected by HTTPS on the way), and it is never stored or logged:

The KumbayAI connector. When an AI service you connected (for example claude.ai) uses your computers, that service is the one asking, so the commands, file paths and contents and results of its tool calls go from the AI service through our relay to your device and back. They are not end-to-end encrypted, because the AI service can’t hold your device keys. The AI service processes them under its own terms. Your device checks every call against the permission you granted, and keeps a log of the calls on the device itself (Devices → Connector activity).
The pass-through for browser agents. A few AI services (for example NVIDIA) don’t accept requests sent directly from a web page. When an agent that runs in your browser uses such a service — or when a direct request is refused by your browser — the request, including your prompt and the API key for that service, goes through our relay to that service, and the answer comes back the same way. The relay forwards it only to a fixed list of AI services.

When an agent runs in your browser, your browser sends your prompts directly (or through the pass-through above) to the AI service you chose for that agent, under your own account with that service. If you dictate using your browser’s built-in speech recognition, your browser may send the audio to its maker (Chrome, for example, sends it to Google); the app tells you so in Settings → Voice.

Why, and on what legal basis

To provide the service you signed up for: your account, sign-in, connecting your devices, keeping the protected copy of your account key for simple access (unless you turn on Maximum privacy), storing your encrypted vault, and the connectors you set up (contract).
To keep the service secure and working: logs, new-device and new-browser notifications, the list of browsers your account key was released to, abuse prevention and rate limits (legitimate interest).
To meet legal obligations, for example invoicing once paid plans exist (legal obligation).

We do not sell your data, show ads, or use your data to train AI models.

Service providers

Google Cloud / Firebase (Google Ireland Ltd.) — hosting, sign-in, database and key storage, in the EU (Belgium). Our relay runs in the EU (Belgium) and in the United States (Iowa); your device or browser connects to the nearest one, and traffic can move to the other region if one has a problem.
Resend — sends our service emails (for example “New device linked” and “New browser signed in”), from the EU.
Cloudflare — domain name service and forwarding of email sent to our addresses.
If you choose to sign in with Google or Apple, they process that sign-in under their own policies.
The AI services you choose for your agents or connect to KumbayAI (for example Anthropic, OpenAI, Google) are not our service providers: you use them under your own account and their own terms and privacy policies.

Where a provider may process data outside the EU, this is covered by the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

The protected copy of your account key is kept while simple access is on; it is deleted when you turn on Maximum privacy, replace your account key, or delete your account. The list of browsers it was released to keeps the last 50 releases.
Account data, device data, the locked copies of your account key and your encrypted vault are kept while your account exists and deleted when you delete it. You can also delete your vault when you move your chats onto your own devices.
Connectors: the permission you granted is kept until you disconnect it (Account → Connectors) or delete your account. Sign-in codes expire after 2 minutes, access tokens after 1 hour and refresh tokens after 30 days without use; expired ones are deleted automatically. A registration by an AI service that is never used is deleted after 180 days.
Security logs are kept for up to 30 days.

Your rights

You can ask to access, correct, delete or export your data, or object to or restrict its processing, by writing to privacy@kumbayai.com. You can also complain to the Portuguese data protection authority (CNPD, cnpd.pt) or the authority where you live.

Cookies and storage

We only use what is needed to keep you signed in and to make the app work (stored in your browser): for example your browser’s device key and, without a hub, a local copy of your vault in that browser’s storage, so your chats open quickly and work offline. It stays on that device. No advertising or tracking cookies.

Children

KumbayAI is not intended for people under 16.

Changes

We will post changes here and, for important ones, tell you by email.