Privacy notice

The short version

Kit is built local-first. The free-tier apps run entirely in your browser: your files, text and images are never uploaded, stored or seen by us. We run no ads and no third-party trackers.

What we store when you create an account

• Account data: your email address and a salted scrypt hash of your password (never the password itself).
• Session data: a random session token hash and expiry, so you stay signed in.
• Billing data: your plan, its expiry, and a Stripe customer reference. Card details are handled entirely by Stripe Checkout and never touch our servers.
• Usage metering: per-app AI usage counters (numbers only, never content).
• Security audit trail: sign-ins, plan changes and admin actions — no app content.

Vault, notes and chat (Plus/Pro, arriving in Waves 2–3)

Encrypted on your device before anything is synced. The server stores ciphertext only; we cannot read it. Losing your password means losing access — by design. Secure Chat will retain no message content: messages are deleted after delivery and vanish from devices 60 seconds after reading.

AI apps (Pro, Wave 3)

AI processing will use either on-device models or zero-retention API calls, clearly labelled per app. Your content is never used to train models. Each app has a published usage cap per 30-day period.

Your rights (PDPA / GDPR)

You may request access to, correction of, or deletion of your account data at any time by emailing hello@digitalfutures.asia. Deleting your account removes your profile, sessions and billing references; encrypted vault ciphertext is destroyed with it. We are Singapore-based and process data in accordance with the PDPA; for EU users we apply GDPR-equivalent handling.

Sub-processors

• Stripe — payment processing (card data, checkout).
• Hosting: AWS (application server) with Caddy + Coraza WAF at the edge.

No analytics, advertising or social-media pixels are used on Kit.