Privacy Policy

1. What Data We Collect

We collect the following information when you use Kridona:

• Account information: Email address, name, and hashed password when you register.
• Payment information: Processed securely by Stripe. We do not store your credit card numbers — only a Stripe customer ID and subscription status.
• Generated app code: The application code and files you create using the Platform, stored to enable editing, preview, export, and deployment.
• Usage analytics: Page views, feature usage, build counts, and session data to improve the Platform.
• Device information: Browser type, operating system, and IP address for security and rate limiting.
• Communication data: Chat messages sent to the AI editor and build prompts, used to generate and improve your applications.

2. How We Use Your Data

• Provide the service: Generate, preview, edit, deploy, and export your applications.
• Improve build quality: We analyse prompts and generated code to improve our templates and prompts. In practice this means the operator can open a build you made — its prompt, its generated code, whether it deployed, what it cost — to find out why a build came out poorly. Every such view is written to an internal audit log. We do not train AI models on your data, and this never extends to the database inside your generated app: whatever your app's own users enter lives in that app's private database and is not read from here.
• Billing and payments: Process subscriptions, credit purchases, and marketplace transactions.
• Security: Detect abuse, enforce rate limits, and protect against unauthorized access.
• Communication: Send verification emails, password resets, and important service updates.

3. Third-Party Services

We use the following third-party services to operate Kridona:

Two layers matter here, and they store different things. Kridona itself — your account, your plan, your credits and the record of your builds — runs on Supabase, Railway and Vercel. The apps you generate run entirely on Cloudflare: each one gets its own Worker and its own private D1 database, and the data its end-users enter lives there, never in Kridona's database.

Each third-party service operates under its own privacy policy. We only share the minimum data necessary for each service to function.

4. Cookies

• Session cookies: Used to keep you logged in. These are essential for the Platform to function.
• Preference cookies: Store your theme preference (dark/light mode) and editor settings.

We do not use third-party tracking cookies or advertising cookies.

5. Data Retention

We retain your account data and generated applications for as long as your account is active. Build history and generated code are kept until you delete them or delete your account. Payment records are retained as required by tax and accounting regulations. After account deletion, your data is permanently removed within 30 days, except where retention is required by law.

6. Your Rights (GDPR Compliant)

You have the right to:

• Access: Request a copy of all data we hold about you.
• Delete: Request deletion of your account and all associated data.
• Export: Download your generated applications and account data at any time.
• Rectify: Update or correct your personal information through your account settings.
• Restrict processing: Request that we limit how we use your data.
• Object: Object to processing of your data for specific purposes.

To exercise any of these rights, contact us at privacy@kridona.com. We will respond within 30 days.

7. Children's Policy

Kridona is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at privacy@kridona.com.

8. Security Measures

• Passwords are hashed using PBKDF2 with 600,000 iterations and SHA-512.
• All data is transmitted over HTTPS/TLS encryption.
• JWT tokens are used for authentication with server-side blacklisting on logout.
• Rate limiting is enforced on authentication endpoints to prevent brute-force attacks.
• Database access is restricted and monitored.
• Payment data is handled entirely by Stripe — we never see or store your card details.

9. Contact

For privacy-related questions, data requests, or concerns, contact us at privacy@kridona.com.