Karui Privacy Policy

The controller of your personal data is:

Karui - Antoni Krzykowski
ul. Czechosłowacka 96/4, 61-476 Poznań, Poland
NIP (Polish tax ID): 7831962515
REGON (Polish statistical ID): 545679099
E-mail: admin@karui.eu

For anything concerning personal data, write to the address above.

We have not appointed a Data Protection Officer — we are not required to.

2.1. Account data

Before you confirm your e-mail address, we keep your registration attempt — your e-mail address, the hash of your sign-in key and your wrapped encryption key — only until you click the link we sent. The link is valid for an hour, and unconfirmed attempts are deleted within the following six hours. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract).

2.2. Your content

We store the following in encrypted form only — details in section 4:

• your conversations: messages (including the images and files you attach), chat titles, the short descriptions we keep for chats in projects, and summaries of long conversations;
• projects: name, goal, settings and the files in a project's Library (for a PDF we keep only the text your browser extracted from it);
• memory: your memory files and those of your projects;
• your custom instructions;
• your skills: name, description and instructions.

Incognito chats are not stored at all: no history, no title, no memory. They reach the model in the same encrypted way as any other chat (section 4.3) and disappear when you leave them.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

2.3. Technical usage data (telemetry)

With every message we store, next to its encrypted content and in readable form:

• who wrote it — you or the model,
• which model and inference provider answered,
• the number of tokens,
• the date and time.

To enforce plan limits we also keep counters per account: tokens used in the current window (24 hours on Free; 5 hours and 7 days on Pro), the condensing allowance on Free, and the number of web searches in the last 24 hours. A counter holds only the current window — the next window overwrites it.

None of this contains the content of your messages.

This data is linked to your account, so it is personal data. We need it to enforce plan limits, account for costs, and diagnose problems.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(f) GDPR (our legitimate interest in maintaining and securing the service).

Aggregate statistics. Separately from the above, we keep counters that are fully detached from accounts: the total number of tokens used by all users together, broken down by month and model; the number of web searches per month; and monthly totals of accounts, Pro accounts, new accounts, tokens and costs. They contain no account identifier, and token counts are rounded to whole thousands at the moment they are written, so no individual request can be reconstructed from them. We use them to keep an eye on cost and on the scale of the service.

Because this is not personal data, these counters are not deleted along with your account — deleting an account gives them nothing to subtract. No legal basis is required here: the GDPR does not apply to data that identifies nobody.

2.4. What we do not collect

• No web analytics (no Google Analytics, none of the others).
• No tracking pixels, no marketing cookies.
• We do not profile you and we do not make automated decisions about you that produce legal effects.
• We do not buy data about you from anyone.
• We do not save your IP address — neither in our application logs nor in our web server's access logs. We use it only briefly, in memory, to limit repeated sign-in attempts, e-mails and requests for enclave verification data (attestation) from one address. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in securing the service). psHost, the provider of our server, also sees your IP address: as a separate controller, it analyses traffic to its addresses to protect against DDoS attacks (section 5).
• The forms for signing up and signing in ask your browser to solve a small computational puzzle that keeps bots out (Cap). It runs on our own server, so no outside company sees you, and it sets no cookies.

We use three cookies, all of them necessary for your account to work:

Besides the cookie, the application keeps some data in your browser's own storage (IndexedDB and localStorage). It stays on your device; none of it is sent to us or to anyone else.

All of this is necessary for features you use yourself, so it does not require your consent and we do not show you a banner. You can delete it in your browser settings — that signs you out and resets your settings on that device.

We have no other cookies.

This is the most important section of this document. We mean it literally, and we would like you to read it that way.

4.1. What is encrypted at rest

Your content (section 2.2) is encrypted with AES-256-GCM. The encryption key is generated in your browser and wrapped with a key derived from your password using PBKDF2-SHA256 with 600,000 iterations, in line with current OWASP guidance.

This means:

• The key never leaves your device in readable form. It is held by your browser in a form that cannot be exported, not even by our own code.
• On our servers your content sits as ciphertext that we are not able to read.
• Each piece is also bound to its place: a message encrypted for one chat will not open anywhere else, so not even someone in control of our server could quietly move or swap your data.
• Your password never leaves your browser. From your password and e-mail address the browser derives a separate sign-in key, and we store only an Argon2id hash of that key. The sign-in key cannot decrypt your data, and the encryption key cannot sign you in.
• If you create a recovery phrase (12 words, offered after your first sign-in and available in Settings), your browser also wraps your key with it. We store that wrapped copy and a value that lets us check the phrase when you use it. We never see the words.

4.2. What stays readable on our server

Encryption hides your content, not the shape of your account. Our server can see:

• your e-mail address, name (if you gave one), plan and account creation date;
• when each chat, message, project, file, memory file and skill was created or changed, how many there are, and roughly how large they are (the size of the ciphertext);
• for each message: whether you or the model wrote it, which model and provider answered, and the token count;
• which chats are starred, which chats belong to which project, whether memory is turned on for a chat, and which skills are switched on;
• whether you use two-step verification, and your usage counters for plan limits.

We list this so that nobody reads more into the word "encrypted" than it delivers.

4.3. What happens when a model answers you

For a language model to answer your question, something has to be able to read it.

In Karui, that something is a hardware enclave belonging to the inference provider — not our server. Both of our providers work the same way: the model runs inside a TEE (Trusted Execution Environment), isolated in hardware, and your browser encrypts the request to that enclave before it leaves your device. Our backend only carries the encrypted bytes, adds our API key and enforces your plan limits. The request reaches the provider from our server, so the provider does not see your IP address.

The practical consequence: our servers do not see your conversations at any point, not even in transit for inference. That is a property of how the request is built, not a promise on our part.

Which provider handles a message depends on the model you choose and the application settings. We use models on NEAR AI's and Phala's hardware. Some model requests may be processed inside Tinfoil's enclaves through Phala's gateway, which verifies them as described below. We use no other company behind our providers. With both, the message content (text and images) is encrypted, while the surrounding envelope (message roles, the model name, token counts) reaches our backend in readable form. Before sending anything, your browser checks the enclave's attestation: that it is genuine Intel TDX hardware, answering a fresh challenge. What it does not yet check is which release of the provider's code is running.

The same applies to the work the application does around a conversation — choosing what to remember, deciding what to search for, picking files from a project, condensing a long conversation and writing chat titles. All of it runs on a model inside an enclave, encrypted in the same way.

They differ in where your message is decrypted, and we do not pretend otherwise.

NEAR AI. Your browser encrypts the message to the key of the enclave running the model itself, after checking both NEAR AI's gateway and that enclave.

Phala. Your browser encrypts the message to the key of Phala's gateway enclave, after checking it. The gateway passes the message to a verified model host enclave on Phala's hardware or to Tinfoil's enclaves. Before passing a message to Tinfoil, it checks the enclave of Tinfoil's router and that it runs Tinfoil's published code, and the router checks the model's enclave before passing the message on. The message is then decrypted in Phala's gateway and in Tinfoil's enclaves. Phala's gateway checks this step, not your browser.

So with both providers we cannot read what you write.

An honest asterisk, and it applies to both: this kind of guarantee rests on trusting the hardware vendor, the correctness of the attestation chain, and the absence of unknown side-channel vulnerabilities. It is a very strong guarantee — but it is not a mathematical impossibility.

4.4. Web search and web pages: the exceptions on our server

If you turn on web search, the finished search query is sent in readable form to our server, which forwards it to the search provider.

This is unavoidable: a search engine cannot operate on ciphertext, and the search provider's API key is ours. The query exists in our server's memory for the duration of a single request. We do not log it. The search provider receives it from our server, so it does not see your IP address. Brave keeps API queries for up to 90 days for billing and troubleshooting, without your IP address and without your account details.

With web search on, the model can also read a web page, such as a link you sent or a search result. The page's address reaches our server in readable form; our server downloads the page and sends its text back to your browser, which encrypts it to the model like the rest of the conversation. The address and the page exist in our server's memory for the duration of a single request. We do not log them. The website receives the request from our server, so it does not see your IP address, but like any website it sees which page was requested and may log it. The model writes the address itself, so it can contain words from your conversation.

If you do not want either of these, leave web search off.

4.5. Connectors — a recipient you choose

On the Pro plan you can add connectors: services of your choice (MCP servers) whose tools the model can use. You pick them from the list in the application and sign in to the service, or you enter a server's address yourself. Each connector reaches its service in one of two ways, shown on the connector:

• Straight from your browser. Your browser sends the calls directly to the service, by way of a small page on mcp.karui.eu that we serve and that only passes messages along inside your browser, keeping nothing. We do not see this traffic.
• Through our server. Some services do not accept calls from a browser, and you can choose this way for any connector. Your browser then sends each call to our server, which forwards it to the service and passes the answer back. The call, the answer and your access token exist in our server's memory for the duration of a single request. We do not log them and do not store them. The service sees our server's IP address instead of yours.

Signing in. When you sign in to a service from the list, the service gives your browser a token, which stays on your device, sealed with your key (section 3). A few services (GitHub, Google, Asana, HubSpot) let you sign in only through an application we registered with them, whose secret stays on our server. For those, the sign-in code and the tokens the service returns pass through our server in the same way, without being logged or stored.

The service receives the calls in readable form: what the model asked it for, which can include parts of your conversation, together with your access token. When the calls go straight from your browser, it also sees your IP address.

That service is not our processor: you choose it, and its own privacy policy applies. Do not connect services you do not trust with what you discuss.

4.6. A forgotten password and your history

We cannot reset your password in a way that recovers your history on our own.

The key that protects your content is wrapped with your password. We do not have your password, we do not have the key, and we hold no readable copy. If you forget your password, we send you a link to reset it, and then:

• with your recovery phrase, you set a new password and keep all your data;
• without it, you can regain access to your account and start over — your existing content is deleted for good, because nobody, including us, can decrypt it anymore.

This is not a fault or an oversight. It is the direct consequence of us not having access to your data. You cannot have both.

A note about Polar: when you buy a subscription, the seller is Polar, not us. Polar is a separate controller of your billing data and processes it under its own privacy policy. We do not receive and do not store your card details. When you delete your account, we ask Polar to delete you as a customer, which ends your subscription; Polar keeps what it is required to keep under its own policy.

We do not pass your data to anyone else unless the law requires us to.

Your stored content does not leave our server in Poland. The application, the database, your encrypted content and its backups all sit on one VPS hosted by psHost in Poland.

Some of the other providers operate outside the European Economic Area. What leaves the EEA in each case is described in section 5: for the inference providers it is a request encrypted to their enclave (so a transfer of conversation content is not a transfer of readable content — see 4.3), for Brave Search a search query, for Resend your e-mail address and the messages we send you, for Polar your e-mail address, account identifier and billing data. Each provider describes its own jurisdiction and safeguards in its privacy policy, linked in the table above. Connectors are wherever the service you chose is; that transfer is made at your request, by your browser or, for a connector that goes through our server, by our server forwarding your browser's call. A website the model reads is wherever that site is hosted; our server only requests the page.

The safeguards for these transfers:

After you delete your account, the data is deleted immediately. Backups — copies of the same encrypted database, kept on our server in Poland with access limited to its administrator — may still contain your data for up to 14 days before they are deleted.

Under the GDPR you have the right to:

• access your data (Art. 15),
• rectify your data (Art. 16),
• erase your data — the "right to be forgotten" (Art. 17),
• restrict processing (Art. 18),
• port your data (Art. 20),
• object to processing based on our legitimate interest (Art. 21).

Much of this you can do yourself in Settings: change your name, delete all your content at once ("Delete all data" — your account and plan stay), or delete your account (we e-mail you a link to confirm it).

For anything else, write to admin@karui.eu. We respond within 30 days.

An important limitation: where your content is concerned, we can only hand you the ciphertext. We do not have the key, so we cannot provide it in readable form — only you can decrypt it, with your password, in the application.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

Karui is intended for people aged 16 and over.

This is the threshold under Art. 8 GDPR as it applies in Poland. We do not knowingly collect data from anyone under 16. If we learn that an account belongs to someone below that age, we will delete it.

• All communication runs over HTTPS/TLS.
• Your password never reaches us; we store only an Argon2id hash of a sign-in key derived from it in your browser (section 4.1).
• Your content is encrypted with a key we do not hold (section 4).
• You can turn on two-step verification (an authenticator app, with backup codes) and create a recovery phrase.
• Sign-up and sign-in are protected against bots by a check that runs on our own server.
• Our application logs contain no message content, no e-mail addresses and no IP addresses.

We do not claim to be impossible to hack. We claim that even if someone breaks into our server, what they get is ciphertext, not your conversations.

Karui is an AI system. You are talking to a language model, not a human. The model can be wrong and can generate false information.

We do not use your conversations to train models — neither ours nor anyone else's. We could not, even if we wanted to: we have no access to them.

We will tell you about material changes by e-mail or with a message in the application, at least 14 days in advance.