Trust Center

• Private Supabase Storage buckets for user source assets.
• Postgres row-level security for user-owned data.
• Server-side ownership checks before signed source access.
• Service role credentials kept out of the client bundle.
• Content-free operational logs by policy and test coverage.
• Lemon Squeezy webhook signatures are verified before subscription webhooks update plan access.
• Launch monitoring uses aggregate, content-free signals for uptime, worker health, queue age, billing webhook health, provider spend, signup health, and support intake.
• PostHog and Sentry replay should be masked, sampled, temporary, and access-restricted before broader launch traffic.

KayBi does not sell user data. KayBi does not train KayBi-owned models on private user data by default. KayBi uses paid Google Gemini APIs for real private user data because provider data-use terms matter for private memory, and current paid Gemini terms say prompts, files, and responses are not used to improve Google products.

KayBi does not claim true end-to-end encryption in V1. The app, workers, database, storage, and AI providers must process source slices to make retrieval and citations work.

KayBi uses PostHog product analytics and session replay and Sentry error monitoring and replay-assisted debugging. The launch purpose is reliability, startup learning, support, abuse detection, and debugging, not advertising or selling personal information.

Replay recordings are more sensitive than aggregate metrics. The startup baseline is to mask or block source content, chat text, prompts, assistant answers, filenames where feasible, media, payment and authentication screens, query strings, signed URLs, secrets, and highly sensitive fields before telemetry is sent.

Incognito chat routes are excluded from product analytics, replay, and Sentry event delivery.

Raw replay recordings should be temporary and configured to the shortest practical vendor retention setting, with a target of no more than 30 days for PostHog or Sentry replay unless a specific security, abuse, billing, or legal issue requires preserving content-free evidence. Consent, opt-out, or regional controls still need to be provided where required before collecting non-essential analytics or replay from affected users.

Signed-in users can export data, request deletion, configure retention, and use incognito mode for non-persistent chats. Users can also contact khaledmoayad2006@gmail.com for privacy-rights requests such as access, deletion, correction, portability, objection, opt-out, or limitation requests where applicable.

KayBi starts with a no-card 7-day trial. Where KayBi offers paid checkout, Lemon Squeezy supports paid plan checkout, subscriptions, invoices, payment methods, tax handling, refunds, chargebacks, fraud prevention, failed-payment recovery, and customer billing portal access. Lemon Squeezy acts as merchant of record for purchases made through its checkout.

KayBi stores billing metadata such as Lemon Squeezy customer and subscription IDs, plan mapping, subscription status, renewal or end dates, and portal/update URLs. KayBi does not store full payment card numbers or raw billing webhook payloads.

Incognito chat can reference existing memory but should write no persistent chats, uploads, chunks, embeddings, citations, traces, corrections, or memory events. Signed-in users can use settings to request exports, delete data, and configure retention.

Current public no-card trial and expected paid launch disclosures, based on non-secret docs and config, include Supabase for auth, Postgres, storage, queues, and database services; Google Gemini APIs for AI processing; Netlify for web hosting; Cloudflare Turnstile for signup abuse checks; the private Dockerized worker host used for ingestion and background jobs; PostHog for product analytics and session replay; Sentry for application error monitoring and replay-assisted debugging; and Lemon Squeezy services for checkout, subscriptions, invoices, payment methods, tax, refunds, chargebacks, fraud prevention, failed-payment recovery, and customer billing portal access where offered.

This draft list is not final or complete. It must be verified before broader commercial expansion or general availability, and updated whenever KayBi adds or identifies a provider that can process user data.

Report suspected privacy or security issues to khaledmoayad2006@gmail.com. KayBi should investigate credible reports, protect affected users, preserve content-free operational evidence, and provide legally required notices when applicable.

KayBi is still a launch-stage product. The legal pages remain drafts until a public mailing/service address and qualified review are complete enough to remove the draft posture. Operational monitoring is active from repo tooling, but external alert policies, dashboard ownership, product telemetry/replay settings, support coverage, and recovery rehearsal remain gates before traffic expands beyond a watched low-volume trial.

August 16, 2026: Public no-card trial legal and trust center draft with adult-only eligibility aligned to Gemini API 18+ provider requirements, under-18 exclusion, CCPA/CPRA-style and GDPR/UK GDPR-style rights request language, provider processing disclosure, Lemon Squeezy billing disclosure, PostHog product analytics/session replay disclosure, Sentry error monitoring/replay disclosure, no true E2EE disclosure, and placeholder launch gates.