This page has not yet been legally reviewed. It is a placeholder describing khipa's actual data practices and will be replaced with reviewed legal text before real customer sign-ups rely on it.

Privacy Policy

Who we are

khipa ("we", "the app") is operated as a personal software project. This policy describes what data we collect and why.

Data we collect

• Account data: your email address, managed by our authentication provider, Supabase.
• Content you create: bookmarks, notes, tags, and spaces you save. This data is stored on your device (IndexedDB) and synced to our backend (Cloudflare D1 and R2 storage) so it's available across your devices.
• Summaries and suggestions: only while you have switched the analysis on in Settings, the content of your items (page text, notes and images) is processed by Cloudflare Workers AI to produce a short summary, keywords, tag suggestions and, for a link, the kind of page it is, which are stored with the item. In a shared space they follow the item owner's setting: your edits to someone else's item are processed when their setting is on, a collaborator's edits to your items when yours is, and everyone who can see an item sees its summary. Switching it off stops new processing; what was already produced stays with the item until the item is deleted.
• Questions: on a paid plan you can ask a question about an item. Asking sends the content of that item (its text and its one image, if it has one) and your question to Cloudflare Workers AI to produce the answer; the answer is shown in the app and is not stored, and nothing is saved unless you tap "Save to note", which appends it to that item's note like any other edit. Your question and the answer are not written to the logs. Asking does not need the analysis switch: the question itself is your consent to that one call, also when the item belongs to someone else and is visible to you. Cloudflare states that it does not use content processed by Workers AI to train models.
• Archived copies: for a link whose owner is on a paid plan, our backend fetches the page and keeps a private copy of it, so that the link stays readable if the page changes or disappears; a paid plan also keeps a screenshot when one can be made. The copy belongs to the item's owner alone and is never shown on a public space; not even a person who can edit the item can read it. It is a snapshot, not a live view, and it is stored with the item in R2. Deleting the item, deleting the account, or the purge of an archived item after 30 days deletes it with the item. A free plan does not create a copy, and copies stored while a plan was paid stay until the item is deleted.
• Reminders and notifications: a reminder puts a time on one of your items, once or repeating (daily, weekly on the days you choose, or monthly). It belongs to your account, not to a device. Reminders, and the push subscription of each device where you turned notifications on (the push service address and two keys that your browser creates), are stored with your account, in the same database as the rest of your data. At the reminder's time our backend sends a Web Push to that device through your browser vendor's push service: Google for Chrome, Edge and other Chromium browsers (Firebase Cloud Messaging), Mozilla for Firefox, and Apple for Safari and for the iOS app on the Home Screen. The message holds the item's title (or, if it has none, the start of its note or its address), cut to 120 characters, the word "Reminder", for a link the host name of its site, and the item's id so that a tap opens it. It is encrypted to your device, so the push service cannot read it, but the push service sees that a notification was sent and to which device. A notification is delivered if the device is back online within 12 hours; older ones are dropped. Your browser asks for permission only when you tap Remind me or the notifications switch in Settings. Turning that switch off, and signing out of a device while it is online, delete that device's subscription. A subscription that the push service reports as no longer valid is deleted as well. When your account deletion takes effect (30 days after you request it, see Your rights), your reminders and the subscriptions of your devices are deleted. Until then, reminders can still arrive. An archived or deleted item never notifies and its reminder is removed.
• Watchers: a watcher is a quiet daily check on one of your saved links, which you turn on from Remind me on that item: for the price of a product, for a change of the page, or for a new release of a GitHub repository. It belongs to your account, not to a device. While a watcher is on, our backend fetches that link's page (for a release, the repository's public release feed on GitHub) once a day, and once more about an hour later when it sees a change, to confirm it before telling you. It also reads the page once when you turn the watcher on, to take the starting value. The last value read is stored with your account, in the same database as the rest of your data, until the watcher is removed: a price and its currency, the latest release tags, or the text of the page (up to 8,000 characters). When a change is confirmed, our backend sends a Web Push to the devices where you turned notifications on, as described under Reminders and notifications; it holds the item's title (or, if it has none, the start of its note or its address), a short description of the change such as the old and the new price or the release tag, and the item's id so that a tap opens it. At most one notice per watcher per day goes out, and when more than three change in the same check, they are sent as one. After seven days of failed checks the watcher stops and tells you once. The number of active watchers depends on your plan: 10 on Free, 50 on Pro, 100 on Max and 200 on Labs. Removing a watcher, an archived or deleted item, and editing the item's address stop the checks. When a watcher is removed, the address and the value stored for it are deleted at once; only a deletion marker without them stays for up to 90 days, so that your other devices learn of the removal, and is then deleted. An archived item keeps its watcher paused, with the stored value, until the item is deleted or its archive is purged after 30 days. Deleting the item removes its watcher, and when your account deletion takes effect (30 days after you request it, see Your rights) your watchers are deleted with it.
• Usage analytics: anonymous, cookieless page view statistics through Cloudflare Web Analytics. No feature usage events, no personal data and no cross site tracking are involved.

Sub-processors

• Supabase (authentication, email delivery for password resets)
• Cloudflare (hosting, database, file storage, web analytics, and Workers AI to process the content of your items: for the analysis while its switch is on, and for a question you ask)
• Push services of your browser vendor (Google, Mozilla or Apple), only for the devices where you turned notifications on, to deliver reminders and watcher notices to them

Your rights

You can export a full copy of your data or permanently delete your account and all associated data at any time from Settings. Account deletion takes effect 30 days after you request it, during which you can cancel.

Contact

Questions about this policy can be sent to our support address, listed in Settings.