Trust Center

• Private Supabase Storage buckets for user source assets.
• Postgres row-level security for user-owned data.
• Server-side ownership checks before signed source access.
• Service role credentials kept out of the client bundle.
• Content-free operational logs by policy and test coverage.
• Lemon Squeezy webhook signatures are verified before subscription webhooks update plan access.
• Launch monitoring uses aggregate, content-free signals for uptime, worker health, queue age, billing webhook health, provider spend, signup health, and support intake.
• PostHog session replay and Sentry session replay are disabled.

KayBi does not sell user data. KayBi does not train KayBi-owned models on private user data by default. KayBi uses paid Google Gemini APIs for real private user data because provider data-use terms matter for private memory, and current paid Gemini terms say prompts, files, and responses are not used to improve Google products.

KayBi does not claim true end-to-end encryption in V1. The app, workers, database, storage, and AI providers must process source slices to make retrieval and citations work.

KayBi keeps essential, content-filtered Sentry error and security monitoring active. PostHog only receives coarse, allowlisted product events after explicit opt-in. Optional telemetry is for reliability and product learning, not advertising or selling personal information.

PostHog session replay and Sentry session replay are disabled capabilities today. Masking, media blocking, network-body blocking, and sanitizers reduce exposure but are not treated as an absolute guarantee. Replay will remain disabled until its capture boundary and opt-in behavior are separately inspected and approved.

Incognito chat routes are excluded from optional analytics. KayBi also treats Global Privacy Control and Do Not Track as refusal of optional telemetry.

Signed-in users can allow or withdraw optional telemetry under Privacy and access settings. The choice does not affect core access, billing, export, deletion, or essential error and security monitoring.

Signed-in users can export data, request deletion, configure retention, and use incognito mode for non-persistent chats. Users can also contact khaledmoayad2006@gmail.com for privacy-rights requests such as access, deletion, correction, portability, objection, opt-out, or limitation requests where applicable.

KayBi starts with a no-card 7-day trial. Where KayBi offers paid checkout, Lemon Squeezy supports paid plan checkout, subscriptions, invoices, payment methods, tax handling, refunds, chargebacks, fraud prevention, failed-payment recovery, and customer billing portal access. Lemon Squeezy acts as merchant of record for purchases made through its checkout.

KayBi stores billing metadata such as Lemon Squeezy customer and subscription IDs, plan mapping, subscription status, renewal or end dates, and portal/update URLs. KayBi does not store full payment card numbers or raw billing webhook payloads.

Incognito chat can reference existing memory but should write no persistent chats, uploads, chunks, embeddings, citations, traces, corrections, or memory events. Signed-in users can use settings to request exports, delete data, and configure retention.

Current public no-card trial and expected paid launch disclosures, based on non-secret docs and config, include Supabase for auth, Postgres, storage, queues, and database services; Google Gemini APIs for AI processing; Netlify for web hosting; Cloudflare Turnstile for signup abuse checks; the private Dockerized worker host used for ingestion and background jobs; PostHog for optional product analytics; Sentry for content-filtered application error monitoring, with both services’ replay capabilities disabled; and Lemon Squeezy services for checkout, subscriptions, invoices, payment methods, tax, refunds, chargebacks, fraud prevention, failed-payment recovery, and customer billing portal access where offered.

This draft list is not final or complete. It must be verified before broader commercial expansion or general availability, and updated whenever KayBi adds or identifies a provider that can process user data.

Report suspected privacy or security issues to khaledmoayad2006@gmail.com. KayBi should investigate credible reports, protect affected users, preserve content-free operational evidence, and provide legally required notices when applicable.

KayBi is still a launch-stage product. The legal pages remain drafts until a public mailing/service address and qualified review are complete enough to remove the draft posture. Operational monitoring is active from repo tooling, but external alert policies, dashboard ownership, optional telemetry settings, support coverage, and recovery rehearsal remain gates before traffic expands beyond a watched low-volume trial.

August 16, 2026: Public no-card trial legal and trust center draft with adult-only eligibility aligned to Gemini API 18+ provider requirements, under-18 exclusion, CCPA/CPRA-style and GDPR/UK GDPR-style rights request language, provider processing disclosure, Lemon Squeezy billing disclosure, PostHog optional product analytics disclosure, Sentry error monitoring and disabled replay disclosure, no true E2EE disclosure, and placeholder launch gates.