Privacy policy · Kitnevo

Last updated: 2026-11-09.

1. Controller and contact

Ricardo Carvalho, trading as Kitnevo ("we"), operates kitnevo.com and is the controller of the personal data described here. Contact, including for privacy requests: support@kitnevo.com.

2. Summary

No advertising, no third-party analytics, no tracking cookies, no cross-site identifiers, no data sales on this site and its account pages. The payment provider's checkout runs the provider's own scripts under its own policy (§3.2).
Analytics are first-party, count events rather than people, store no IP address or browser details, and stop completely when your browser sends Do Not Track or Global Privacy Control.
We keep what an account, a purchase and a download need, and the security records that protect them.
During an invited private beta, testers may send structured feedback with explicit consent; it is stored apart from analytics, without anything that identifies the tester, and deleted after 90 days.
You can export your data and delete your account from the account page.

3. What we collect

Data	Why	Kept
E-mail address (stored lower-cased), account id, creation time, deletion time	your account; sign-in links; service messages we write to you ourselves about your account or a purchase: an answer to your request, the confirmation of a refund, notice of a material change to this policy, a notice about the security of your account (§3.6)	the e-mail address until you delete the account, then removed; the account id and its creation and deletion times stay, as a record without an e-mail address that the purchase records (§3.2) and the API token records below stay attached to
Sign-in links: a SHA-256 hash of the one-time token, the e-mail address it was sent to, expiry, time used	single-use sign-in	deleted one day after expiry or use
Sessions: a SHA-256 hash of the session id, account id, created / expires / revoked times	keeping you signed in	until expiry or sign-out, then deleted 30 days later
API tokens: a SHA-256 hash of each token (the token itself is shown to you once and never stored), the first 4 characters of its random part (shown on the account page so that you can tell your tokens apart), your label, created / last used / revoked times	CLI and MCP downloads	while the account exists, also after you revoke a token (it stays listed as revoked); when you delete the account every token is revoked and your label is replaced by a fixed text; the hash, the 4 characters and the times stay after the account is deleted, attached to the account id, which then has no e-mail address

3.2 Purchases and payments

Data	Why	Kept
Orders: id, product, status, amount, currency, payment provider, the provider's reference, timestamps	the contract; support; accounting	for as long as tax and accounting law requires; anonymised (no link to your e-mail) when you delete the account
Payments: the provider's transaction id, status, amount	reconciliation	same
Payment webhooks: provider event id, receipt time, signature check result, outcome and a SHA-256 hash of the payload (not the payload)	exactly-once processing, replay protection	with the order records; the payload itself is never stored, only its SHA-256
Card and billing details	—	not received by us: you enter them in Paddle's own checkout frame, and Paddle processes them as merchant of record under its own privacy policy

What Paddle receives from us. When you start a checkout we send Paddle the order id, our internal account id and the kit reference. You enter your e-mail address, country and payment details in Paddle's checkout, not on our pages.

The checkout page and Paddle's scripts. To pay, you open a checkout page that loads Paddle.js from Paddle's servers; the card is entered in Paddle's frame, never on our pages. For live Paddle accounts, Paddle.js also loads Paddle Retain (ProfitWell) from public.profitwell.com — a third-party script on the checkout page; Paddle documents no way to switch it off. In test mode (Paddle's sandbox) Retain is not loaded. The checkout page is the only page of ours that loads a third-party script: the rest of the site and the account pages load none. What Paddle.js and Retain collect from your browser, and the cookies they set, are governed by Paddle's privacy policy.

3.3 Licences and downloads

Data	Why	Kept
Entitlements: account, product, order, kit, version range, licence id, status, granted / revoked times and reason	download access and licence status	as long as the purchase record
Download links: a SHA-256 hash of the link id, account, package path and hash, expiry, allowed and used count	signed, expiring, use-limited downloads	until expiry or revocation, then deleted 30 days later

3.4 Support and refunds

Refund requests (order, account, the reason you choose from a fixed list, status, time) and the optional explanation you type (at most 2,000 characters; removed when you delete the account); e-mails you send to support@kitnevo.com, kept in our support mailbox only as long as the case and our legal obligations need them, and deleted earlier on request. The site has no general feedback form; the feedback form of a private beta is described in §3.9.

3.5 Security records

Data	Why	Kept
Audit log: time, actor, action, subject, details of state changes (grants, revocations, refunds, token changes)	accountability, fraud and dispute handling	with the purchase records; not deleted automatically
Rate-limit counters keyed by e-mail address, a hash of the IP address or the account, per time window	protecting sign-in, downloads and the rest of the API (including event collection) from abuse	until the window ends; windows older than one day are deleted
Application logs: request id, method, path, status, timing and a truncated keyed hash of the IP address, never the address; tokens, cookies, download links, the local part of e-mail addresses and provider secrets are redacted	operations and incident response	for the log-retention period of our hosting plan at Vercel
Hosting request logs: Vercel delivers every request, processes your IP address to do so and keeps its own request logs, which include the request path (for a download, a short-lived, use-limited link id)	delivering the Service; operations and incident response	for the log-retention period of our hosting plan at Vercel
Database backups, where our Supabase plan includes them: copies of the service database made by Supabase (so they contain e-mail addresses and the hashed credentials above)	restoring the service after a failure	for the backup-retention period of our Supabase plan; a deleted account disappears from backups when they expire

3.6 E-mail

Sign-in links are sent through Resend.

Resend receives the recipient's e-mail address and the message (a sign-in link).
Where the e-mail leaves from: our sending domain uses Resend's own mail servers, which run in the United States (N. Virginia). A message that Resend routes through its older sending service leaves from the region the domain was created in, sa-east-1 (São Paulo, Brazil).
Resend's account data — e-mail metadata, logs and API records — is stored in the United States, whatever the region the e-mail is sent from; a data processing agreement pre-signed by Resend applies.
It keeps 30 days of activity: the e-mails and the API logs, which hold the full request — so the message and its link. Sign-in links expire after 15 minutes and work once, so a stored link cannot sign anyone in later.
Sign-in e-mails are sent as plain text, without any tracking option; open and click tracking are settings of the sending domain at Resend, off by default and kept off; our logs record only the recipient's domain, the message id and error codes.

The service sends no other e-mail. The other messages you may get from us — an answer to your request, the confirmation of a refund, notice of a material change to this policy, a notice about the security of your account — are written by us and sent from our support mailbox (§3.4), not through Resend. We send no marketing e-mail.

3.7 Website analytics (first-party)

What is stored per event: the event name from a fixed list, its properties (fixed lists of values or bounded numbers only — e.g. which demo opened, whether a viewer loaded, which palette was chosen), the hour it arrived (UTC, truncated to the hour), where it came from (website, CLI receipt or our server), and for website events a hash of a random id that lives in your browser tab, computed with a secret salt that changes every UTC day.

What is never stored: your IP address, browser or device details (User-Agent), cookies, the page URL or referrer, search terms or any text you type, your account id or e-mail address. The service receives some of these as part of every web request, but the analytics code does not read them into storage.

Do Not Track / Global Privacy Control: if your browser sends either, the website sends no analytics at all and stores nothing in your browser for analytics; the service also drops any analytics request that carries either signal.

Events of the purchase flow (checkout started, purchase completed, refund) are counted by our server with only the product and the payment mode (test or live) — no account, order or session link; a checkout request that carries Do Not Track or Global Privacy Control is not counted. Purchase and refund events come from the payment provider's webhooks, which carry no browser signal, and are counted without any account or order link.

Kept 180 days, then deleted automatically. Each day's salt is deleted when the next day starts; after that nobody, including us, can link a stored hash to a browser tab.

3.8 The CLI and the MCP server

The CLI contacts our registry only to search and download (search, add, kit add), sending your API token for paid packages; our application logs record method, path (download tickets redacted), status and timing, without credentials or IP addresses (the hosting provider's own request logs are described in §3.5). The CLI sends nothing else unless you run verify-project --share-result, which sends one anonymous receipt: the verification result (LOCALLY_VALIDATED or STATICALLY_VALID), the kit's major version and the SDK's minor version — no project name, path, file hash, machine data or token, and no cookie or Origin header; nothing is sent without the option, after a failed verification or with DO_NOT_TRACK set. The MCP server is read-only and stores nothing about your project.

3.9 Private-beta feedback (only while an invited private beta runs)

If we run a private beta, invited testers can answer a short feedback form (/beta/feedback). The form is switched off otherwise: it then accepts nothing and sends nothing.

Data	Why	Kept
Your answers, chosen from fixed lists (e.g. whether your project rendered, how long it took, which customizations you tried, a 1–5 rating of the look of the assets, whether you would pay the price shown), the price the question showed, the version of the form and of the consent text, the day (UTC) you sent them	evaluating the beta: what to fix, whether the kit saved work	90 days after submission, then deleted automatically
Your optional comment (at most 1,000 characters; the form refuses e-mail addresses and links and asks you not to include names)	the same	the same 90 days

Sent only when you tick the consent box; nothing is stored without it. Never stored with the answers: the time of day, your name, e-mail address, account, any cookie, the session id of the analytics, your IP address, browser or device details, the page you came from. The answers are stored apart from the website analytics (§3.7), and the form sends no analytics event, so they cannot be linked to your visits. The form's endpoint is rate-limited per pseudonymised IP address (§3.5). Because nothing links the answers to you, we cannot find, export or delete one person's answers; they are all deleted after 90 days. Comments are read by the owner only and are not copied into reports, tickets or AI prompts.

4. Cookies and browser storage

Name	Type	Set when	Purpose	Lifetime
`__Host-ara_session`	cookie, `HttpOnly`, `SameSite=Lax`, `Secure`	you sign in	keeps you signed in (strictly necessary)	until sign-out or expiry (7 days idle, 30 days at most)
`ara.analytics`	`sessionStorage` (not a cookie)	the first analytics event of a tab, unless DNT/GPC	a random per-tab id and, after a failed send, a "pause until" time	deleted when the tab closes

On the checkout page, Paddle's frame and scripts may set cookies or browser storage of their own, under Paddle's privacy policy (§3.2).

5. Purposes and legal bases

We process personal data for the performance of a contract (account, purchase, downloads, licence status, support), to meet legal obligations (tax and accounting records), for our legitimate interests (security records, rate limits, abuse prevention, first-party aggregate analytics without identifiers) and, for private-beta feedback (§3.9), with your consent, which you give with the consent box and withhold by not submitting the form.

6. Processors and transfers

Role	Provider	Where
Hosting and functions: the website, the account and checkout service, the catalog API and MCP server, request logs	Vercel	region iad1 (Washington, D.C., USA)
Database: accounts, orders, entitlements, security records, analytics, beta feedback; database backups	Supabase	region us-east-1 (N. Virginia, USA)
Sign-in e-mail	Resend	sent from the United States (Resend's own mail servers, N. Virginia); a message Resend routes through its older sending service leaves from São Paulo, Brazil (sa-east-1, the region the sending domain was created in); account data stored in the US; 30 days of activity kept — §3.6
Checkout, payment processing, merchant of record	Paddle	under Paddle's own terms and privacy policy; in live mode its checkout script also loads Paddle Retain (ProfitWell), §3.2
DNS and, where enabled, e-mail forwarding	Cloudflare	answers DNS queries for kitnevo.com; where forwarding is enabled, e-mail sent to support@kitnevo.com passes through it

Not processors of customer data: the hosted CI service runs the code's tests only and receives no customer data; the coding agents used to build the product never receive customer data, support e-mails or feedback comments.

E-mail you send to support@kitnevo.com, and the service messages we write to you (§3.6), pass through our mailbox at our e-mail provider (§3.4). No other recipients.

International transfers: the hosting and the database are in the United States; sign-in e-mail is sent through Resend from the United States (or, on Resend's older route, from Brazil — §3.6), with Resend's account data in the United States; Paddle and Cloudflare operate internationally under their own terms. Your data may therefore be processed outside the country where you live.

7. Your rights

Export: account page → export (your account, orders, entitlements and tokens as JSON).
Deletion: account page → delete (re-authentication required): personal data removed, sessions and tokens revoked, financial records kept only in anonymised form for the legal retention period.
Correction, objection, restriction, complaint: write to support@kitnevo.com; you may also complain to your data protection authority. We answer within one month.
Analytics: analytics rows are not linked to accounts, so they cannot be looked up, exported or deleted per person; they are deleted after 180 days. To opt out, enable Do Not Track or Global Privacy Control.
Private-beta feedback: not linked to you either (§3.9); deleted after 90 days.

8. Children

The Service is for developers and is not directed at children under 16.

9. Changes

We will publish changes here with their date; material changes are announced by e-mail to account holders.