Privacy policy

Last updated: 8 October 2026 · Draft for the beta

KumbayAI lets you use your AI assistants from one web page while the assistants, your API keys, your files and your chats stay on your own devices. This policy explains the little we do process to make that work.

Who we are

KumbayAI is operated by a self-employed business registered in Portugal (the “controller” under the GDPR). Contact: privacy@kumbayai.com.

What we process

Account data: your email address, a hashed password (if you sign in with email and password) or the identifier from Google or Apple sign-in, your two-factor authentication registration, and sign-in timestamps.
Account settings: the groups you belong to (for example, beta access) and your plan.
Your devices: the name you give each paired device, its operating system, when it was paired and last seen, and whether it is currently connected.
Technical logs: IP address, browser type and times of requests, kept for security and troubleshooting.

What we do not process

The contents of your chats, prompts, replies, files, voice, API keys and logins for AI services never leave your devices in readable form. When you use KumbayAI from a browser, that traffic passes through our relay end-to-end encrypted with keys that exist only on your devices, so we cannot read it.

Why, and on what legal basis

To provide the service you signed up for: your account, sign-in and connecting your devices (contract).
To keep the service secure and working: logs, abuse prevention (legitimate interest).
To meet legal obligations, for example invoicing once paid plans exist (legal obligation).

We do not sell your data, show ads, or use your data to train AI models.

Service providers

Google Cloud / Firebase (Google Ireland Ltd.) — hosting, sign-in and database, in the EU (Belgium).
Cloudflare — domain name service.
If you choose to sign in with Google or Apple, they process that sign-in under their own policies.

Where a provider may process data outside the EU, this is covered by the European Commission's standard contractual clauses or an adequacy decision.

How long we keep it

Account and device data are kept while your account exists and deleted when you delete it. Security logs are kept for up to 30 days.

Your rights

You can ask to access, correct, delete or export your data, or object to or restrict its processing, by writing to privacy@kumbayai.com. You can also complain to the Portuguese data protection authority (CNPD, cnpd.pt) or the authority where you live.

Cookies and storage

We only use what is needed to keep you signed in (stored in your browser). No advertising or tracking cookies.

Children

KumbayAI is not intended for people under 16.

Changes

We will post changes here and, for important ones, tell you by email.