Privacy Policy

Last updated: 2026-11-06

This Privacy Policy explains how Keragi (“we”, “us”) handles personal data in connection with the Keragi website, documentation, help center, downloads, support and paid services (the “Services”).

Keragi is currently operated by an individual developer. For privacy questions, contact us through https://www.keragi.com.

1. Scope

1.1 This Policy applies to personal data we process as the controller of the Services.

1.2 Self-hosted deployments are not operated by us. If you use a Keragi instance deployed by an organization or another operator, that operator is normally the data controller for the deployment, and its privacy policy applies. We do not receive the data in that deployment unless you separately provide it to us for support.

1.3 This Policy does not apply to third-party services you choose to use, including third-party AI models, connectors, hosting providers and payment providers. Their own policies apply.

2. Data we collect

Depending on how you use the Services, we may collect:

• Technical and usage data: IP address, user agent, requested URL, referrer, timestamps and basic security logs generated by our hosting provider.
• Contact and support data: your name, email address and the content of messages you send us for support or inquiries.
• Purchase data: if paid features are offered, order details, billing country, tax information and payment status. Card or bank details are normally processed by our payment provider or Merchant of Record, not stored by us.
• Preference data: language and theme preferences stored locally in your browser or client.
• Account data: if an online account is offered, account identifiers and authentication data.

We do not intentionally collect special-category data, and we ask that you do not send it to us unless necessary for a support request.

3. Cookies and local storage

3.1 The website may use strictly necessary cookies or local storage to remember language and theme preferences and to maintain security. These are used to provide the Service you requested.

3.2 We do not currently use advertising cookies or third-party behavioral tracking on the website. If we introduce analytics or marketing cookies, we will update this Policy and, where required, request consent before setting non-essential cookies.

3.3 You can clear cookies and local storage through your browser, but some preferences or sessions may be lost. Clearing client data may also delete locally stored messages and keys; see the Keragi documentation on data storage.

4. Purposes and legal bases

We process personal data to:

• provide, operate and secure the Services (performance of a contract or our legitimate interests in operating the Services);
• respond to inquiries and provide support (performance of a contract or legitimate interests);
• process purchases, subscriptions and related tax/accounting obligations (performance of a contract and legal obligations);
• detect, prevent and address fraud, abuse and security incidents (legitimate interests and legal obligations);
• comply with legal requests and applicable law (legal obligations);
• send service-related notices (performance of a contract or legitimate interests).

Where consent is required, we will ask for it separately and you may withdraw it at any time.

5. End-to-end encryption and message data

5.1 Keragi messages, group chats and channels are end-to-end encrypted by default. We do not hold the keys and cannot read message plaintext. The server only relays or blind-stores ciphertext.

5.2 We may process metadata necessary to route messages, authenticate accounts and operate the service, such as account identifiers, device/public keys, conversation indexes and connection metadata.

5.3 If you enable a third-party AI service or connector, the content you send to it is processed by that provider under its own terms and privacy policy. It is outside the end-to-end encryption boundary.

5.4 Deleting client data, losing a device or resetting it may make messages and keys unrecoverable. The server cannot recover plaintext for you.

6. Sharing

We do not sell personal data. We may share data with:

• hosting, infrastructure and security providers that help us operate the Services;
• payment processors or Merchant of Record providers for purchases and tax compliance;
• email or support providers when you contact us;
• professional advisers, auditors or authorities where required by law;
• a successor entity in connection with a merger, acquisition or transfer of the Services, subject to this Policy.

Service providers are expected to process data only for the purposes we specify and to apply appropriate safeguards.

7. International transfers

The Services may be operated from, and service providers may be located in, countries other than yours. Where required, we will use appropriate safeguards for international transfers, such as standard contractual clauses or an equivalent mechanism.

8. Retention

We retain personal data only as long as necessary for the purposes described above, including:

• support and contact data: for as long as needed to resolve the request and a reasonable follow-up period;
• purchase and tax records: for the period required by applicable tax and accounting law;
• security logs: for a limited period appropriate for security and abuse prevention;
• account data: while the account is active, and for a reasonable period after closure where needed for legal or security reasons.

9. Security

We use reasonable technical and organizational measures to protect personal data, including HTTPS, access controls and minimization. No system is completely secure. You are responsible for protecting your devices, credentials, keys and backups.

10. Your rights

Depending on your location, you may have the right to:

• access, correct or delete your personal data;
• restrict or object to certain processing;
• receive a portable copy of data you provided;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

To exercise these rights, contact us through the website. We may need to verify your identity. We will respond within the period required by applicable law. These rights may be limited where we have a legal obligation or legitimate interest that overrides them.

11. Children

The Services are not directed to children below the age required to consent to data processing in their jurisdiction. If you believe a child has provided personal data to us, contact us and we will take appropriate steps to delete it.

12. Changes

We may update this Policy from time to time. The updated version will be posted on this page with a new date. Material changes will be communicated by reasonable means.

13. Contact

Website: https://www.keragi.com

For privacy requests, use the contact details published on the website.