Privacy Policy

1. Who we are

Kenby (the “Service”), available at kenby.app and mcp.kenby.app, is provided by Kenby, a Delaware limited liability company (“Webomax”, “we”, “us”). For the personal information described in this policy, Webomax is the controller (the business that decides how and why it is processed).

2. Information we collect

Information you give us

• Account details: your name, email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your content: the notes you write or import (text, titles, categories, tags, links), their earlier versions, notes in your trash, the questions you ask and the answers and passages returned to you (your query history). Files you import (PDF, Word, Excel, CSV, HTML, Markdown) are converted to text in your browser; we store the resulting text, not the original file. When you import a web page by its address, our server fetches that page for you.
• Agent connections: API keys you create (we store only a hash of each key, never the key itself), the AI apps you approve through the sign-in for agents (OAuth), the permissions you grant them, and the notes those apps add or edit on your behalf.
• Communications: what you send us when you email us or report a problem.

Information collected automatically

• Usage and billing records: the number of questions and agent searches you run, the size of your knowledge base, the AI processing each request used, and when your API keys and connected apps were last used. We use these to apply plan limits, bill correctly and keep the Service running.
• Technical data: IP address, browser and device type, and request logs, used to deliver the Service, limit abuse and investigate errors.
• Storage on your device: the app keeps a working copy of your knowledge base, your query history, cached verification results and your theme in your browser’s local storage and IndexedDB, and your sign-in session in local storage. See Cookies and local storage.

Information from others

• Payments: our payment processor, Stripe, tells us the status of your subscription and purchases, your billing country and the last digits and brand of your card. We never receive or store your full card number.
• Google: the profile details listed above, if you choose Google sign-in.

3. How we use information

• To provide the Service: store and sync your knowledge base across your devices, index it for search, verify which passages answer your questions, write cited answers, and serve the agents and AI apps you connect.
• To create and secure your account, and to authenticate you and your agents.
• To process payments, apply plan allowances and prevent fraud.
• To keep the Service safe and reliable: rate limits, abuse prevention, debugging and security monitoring.
• To communicate with you about your account, billing, security, and changes to the Service or these terms. We do not send marketing email without your consent.
• To comply with the law and to enforce our Terms of Use.

We do not sell your personal information, we do not use it for advertising, and we do not use your content to train AI models. We do not read your content except when you ask us to (for example, for support), when needed to investigate abuse or a security incident, or when the law requires it.

Legal bases (EEA, UK and Switzerland)

We process your information to perform our contract with you (providing the Service and billing), for our legitimate interests (security, abuse prevention, improving reliability), to comply with legal obligations (tax and accounting records), and with your consent where we ask for it, which you can withdraw at any time.

4. How AI processes your content

Kenby uses third-party AI models to work with your content. When you add or change a note, its passages are sent to an AI provider to create search embeddings. When you or your agents ask a question, the question and the candidate passages are sent to AI providers to check which passages answer it and to write the answer.

• Only the content needed for the request is sent, and it is sent from our servers, not your browser.
• We use these providers through their business APIs, under terms that do not allow them to use your content to train their models. They may keep request data for a short period for abuse monitoring, as their terms allow.
• AI output can be wrong. Kenby is designed to answer only from passages it has verified, but you should check important answers against the cited sources.

When you connect an AI app or agent (for example through MCP or the REST API), that app receives the content its requests return and, if you allowed it, can add and edit notes. What that app does with your content is governed by its own provider’s terms and privacy policy, not this one.

5. How we share information

We share personal information only with:

• Service providers who process it for us under contract and only on our instructions: cloud hosting and database providers, AI model providers (see above), Stripe for payments, Google for sign-in, and email delivery for account messages. A current list is available on request at info@kenby.app.
• Apps and agents you connect, to the extent you authorize them.
• Authorities and others when we believe in good faith that the law requires it, or to protect the rights, safety or property of our users, the public or Webomax.
• A successor in a merger, acquisition, financing or sale of assets, who will be bound by this policy for the information it receives. We will tell you before your information becomes subject to a different policy.

6. How long we keep information

• Your content stays while your account is open, until you delete it. Deleted notes stay in your trash for 30 days, then are removed for good. Each note keeps up to its 50 most recent earlier versions.
• When you delete your account (Settings → Account), we delete your profile, notes, versions, trash, search index, query history, API keys and connected apps, and cancel any active subscription.
• Billing records (amounts, dates and usage counts) are kept after an account is deleted for accounting and tax purposes, without being linked to you. Stripe keeps its own records of your payments under its privacy policy.
• Backups and logs may hold deleted data for a limited period until they are overwritten on their normal cycle.
• Your browser’s copy is cleared when you sign out (once your changes have synced). You can also clear it through your browser settings.

7. Security

We protect your information with encryption in transit (HTTPS), access controls that limit every account to its own rows in the database, hashed passwords, API keys and access tokens, and AI provider keys kept on our servers only. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Keep your password and API keys private, and tell us at info@kenby.app if you believe your account has been compromised. If a breach affects your personal information, we will notify you and the authorities as the law requires.

8. International transfers

Webomax is based in the United States, and our service providers may process information in the United States and other countries. Where we transfer personal information from the EEA, the UK or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or the EU-U.S. Data Privacy Framework where the recipient participates in it.

9. Your choices and rights

You can do most of this yourself in the app:

• View, edit, export (Obsidian vault or JSON) and delete your notes at any time.
• Delete your query history, revoke API keys and disconnect AI apps.
• Delete your account and its data in Settings → Account.

Depending on where you live, you may also have the right to access, correct, delete or receive a portable copy of your personal information, to object to or restrict certain processing, and to withdraw consent.

EEA, UK and Switzerland

You have the rights above under the GDPR and UK GDPR, and the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.

California and other U.S. states

Residents of California and other states with consumer privacy laws have the right to know what personal information we collect, use and disclose; to delete and correct it; and to opt out of its sale, sharing for cross-context behavioral advertising, and profiling. We do not sell or share personal information for advertising and do not use it for profiling that produces legal or similarly significant effects. We honor Global Privacy Control signals as opt-out requests. The categories of information we collect are listed in Information we collect, and their sources and purposes in the sections that follow. We will not discriminate against you for exercising your rights.

Making a request

Email info@kenby.app from the address on your account. We will confirm your identity before acting and respond within the time the law requires (generally 30 days in the EEA and UK, 45 days in California). You may use an authorized agent; we may ask for proof of their authority. If we decline your request, you may appeal by replying to our decision.

10. Cookies and local storage

Kenby does not use advertising or third-party analytics cookies, and does not track you across other websites. We use only storage the Service needs to work: your sign-in session, the working copy of your knowledge base and query history, cached verification results, and preferences such as your theme and sidebar state. Because this storage is strictly necessary, we do not ask for consent to it. Blocking it will stop the app from working properly.

Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them. During checkout and billing management you are taken to Stripe, which uses its own cookies to process payments and prevent fraud.

11. Children

Kenby is not intended for children. You must be at least 16 years old to use it, and we do not knowingly collect personal information from anyone younger. If you believe a child has given us personal information, contact info@kenby.app and we will delete it.

12. Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new effective date and, for material changes, tell you by email or in the app before they take effect.

13. Contact us

Questions or requests about privacy go to info@kenby.app, or by post to:

See also our Terms of Use.