Privacy policy

Schumacher Management AB (org. no. 559599-6777), Sweden, which runs Kintar, decides why and how your personal data is processed. Contact: [email protected] (mailbox still to be created before launch).

• Your account: an account id, the display name from your sign-in (for example your GitHub login), the sign-in methods you have linked, and email addresses that the provider has confirmed are yours. We never use an unconfirmed email to match you to an account.
• Your sessions: when you are signed in, a server-side record with a hash of your session id (the id itself is only in your browser's cookie), its expiry, which provider you used and a coarse device label such as “Chrome on macOS”. A session ends after 7 days without use, and at the latest 30 days after sign-in. If you signed in with GitHub, the GitHub access token is kept in that record encrypted, on the server only. It is never sent to your browser.
• Repositories you connect: the repository address or path and branch.
• Every change you ask for: your task text, the files touched, the diff, the build and test evidence, status, cost, and your decision. This is your history. It is kept until you delete it or your account.
• Units and money: a ledger of reservations, charges and releases, and, if you buy units, a reference to the Stripe customer and payment, the amount and the number of units. We never receive card numbers. Payments are not switched on for the public yet.
• Files you attach in chat: the file itself (images are cleaned of metadata) and the text we extract from it, until you delete it. There is a size and storage limit per account.
• Plain-chat cost log: for each chat message, the model used, the true cost and what part we absorbed. Not the message text.
• Cloud sessions: a session keeps a working copy of your repository on our runner for 30 minutes after the last message, and its log and patches for 7 days, so you can resume it. You can delete a session earlier on the Sessions page.
• Receipts: a sealed record of each change: the verdict, the checks, files and lines, models used, tokens and what you were charged. A receipt is private until you publish it; the public page shows only the parts you tick, plus the verdict, checks, file and line counts and the charge. You can turn the link off at any time.
• Computer control, only if you turn it on (off by default): while a session runs, the newest screenshot is shown to you and sent to the model provider so the model can see the screen. Screens the safety rules withhold (banking, passwords, settings) are not shown to the model. We keep a log of actions with a fingerprint of each screenshot, never the screenshots themselves and never the text you or the model typed, only its length. The log is deleted with your account.
• Request keys: so a double click or a retry does not run or charge a change twice, we keep a random key and the answer to that request for 24 hours.
• Research reports: your question, the report, its sources (address, title, fetch status) and the quoted passages. While a run is unfinished we also keep the text of the web pages it read, so it can be resumed; when a run finishes, only a short excerpt of each page is kept. Everything is deleted 30 days after its last change, or when you delete it or your account. Page text belongs to the sites it came from: we use it only to write your own report, never to train models, never for other accounts, and we do not present it as ours.
• Your chats and artifacts, only if you turn syncing on: by default your chats stay in your browser and nothing is sent. The first time you sign in we ask once. If you choose "Sync and search everywhere", your chat messages and artifacts are stored on our servers as readable text (search needs that; they are not end-to-end encrypted, so treat them like an email account) so you can search them and open them on other devices. Code changes (the task, the diff and the test output) are not synced unless you also turn on "Also sync code changes". The choice is stored on your account and applies on every device; you can switch it off, export everything, or erase it on the History page. A deleted conversation, and "Erase my server copy", remove the content from our active storage at once and turn syncing off; copies in database backups remain until the backups expire (see Backups below). Deleting your account removes it too.
• Technical logs: short-lived logs of requests and errors. Your IP address is used to limit abuse (rate limits) and can appear in these logs. We keep access tokens and keys out of them. They are rotated and kept for at most about two months on our server.
• Backups: every night an encrypted copy of the database is made. It is kept 14 days on our server and, where the second storage location is switched on, 60 days there. The database host also keeps a short point-in-time history (24 hours today). See Deletion below.

We use no advertising or analytics cookies and no trackers. The cookies we set are needed for the service to work:

• omni_session: keeps you signed in. Not readable by scripts, sent only to us. Lasts until you sign out, after 7 days without use, or at the latest 30 days after sign-in. The cookie name is from an earlier product name and is kept so that nobody is signed out.
• omni_oauth, omni_sso and omni_ml: short-lived (10 to 15 minutes) cookies used during sign-in with a provider, with single sign-on or with an email link.
• omni_known: only if you sign in by email: lets the same browser ask for its own sign-in message again. Lasts 180 days.
• omni_lang: remembers the language you pick. Lasts one year.

Your browser also stores things on your own device, such as chat history if you have not turned syncing on, and settings. These stay on your device until you clear them.

To provide the service you asked for (contract), to keep it secure and stop abuse such as repeated free-tier sign-ups (legitimate interest), and to meet legal duties such as bookkeeping once payments exist (legal obligation). [Legal bases to be confirmed by a lawyer.]

Facts as we have set them up and read them, checked 10 November 2026. We run the service on the providers below. Processing is not limited to the EU: your code and tasks go to AI model providers in the United States or in a global network, and the proxy in front of the site is global. Where we have not read a party's own contract terms for this text, the list says “not verified here”; we do not state contract terms that we have not read.

• Hetzner Online GmbH

  What it does: Hosting. The web app, the cloud runner that copies your repository, application logs and our encrypted nightly database backups run on a server we rent.

  Where: Falkenstein, Germany (EU).

  Retention and terms: Location is our own server setting. Hetzner's contract terms: not verified here.

• Neon

  What it does: Database. Accounts, sessions, your history of changes, the units ledger, synced chats if you turn that on, and the other records listed above.

  Where: Frankfurt, Germany (EU region of its cloud host).

  Retention and terms: Region is our own project setting. Neon's own terms and data processing agreement: not verified here.

• Cloudflare

  What it does: Domain name system, and a proxy and content network in front of the site. Every request to kintar.ai, including your IP address, passes through its servers.

  Where: Global. Requests are handled at a Cloudflare location near the visitor, anywhere in the world.

  Retention and terms: Cloudflare's own terms: not verified here.

• Resend

  What it does: Email. Sends the sign-in link and code to the address you give, and notices you have asked for. It receives your email address and the message text.

  Where: EU (Ireland), as set up by us.

  Retention and terms: Resend's own terms: not verified here.

• Stripe

  What it does: Payments, if you buy units. Stripe collects the card details on its own page; we never see or store card numbers. We keep a reference to the Stripe customer, the payment, the amount and the number of units.

  Where: As stated in Stripe's own terms (not verified here).

  Retention and terms: Stripe acts for its own purposes (for example fraud control and legal duties) as well as for us. Its terms: not verified here.

• Anthropic

  What it does: AI model provider (Claude). Receives the task text and the parts of your code a task needs, and any screenshot you let the model see.

  Where: Global or United States. The provider's default is that inference may run in any available geography; it offers a United States-only option and no EU option. We have not chosen the United States-only option.

  Retention and terms: Retention: zero data retention is not in place for our organisation, so inputs and outputs are kept under the provider's standard terms (reported as up to 30 days; the exact period is unverified). Read 2026-11-07 and 2026-11-05 from the provider's own pages.

• Together AI

  What it does: AI model provider. Hosts open-weight models, among them models first published by Chinese companies (for example Qwen, DeepSeek, Kimi and GLM). It receives the task text and the parts of your code a task needs.

  Where: United States (North America). Your data goes to Together in the United States. It is not sent to the companies that made the models, and not to China.

  Retention and terms: Retention: Together stores prompts and answers by default. We have switched that off in our organisation setting (zero data retention, "Prompt storage" off), so prompts and answers are not stored; Together always keeps usage metadata (token counts, model name, time). We do not use models that Together forwards to third parties. This is a setting in our own account that we control; Together's contract terms: not verified here.

• GitHub, Google, Microsoft, Apple

  What it does: Sign-in, under their own terms, for the method you pick. GitHub is also used to copy your repository and to open pull requests.

  Where: As stated in each provider's own terms (not verified here).

  Retention and terms: These are independent controllers of your account with them.

Your code and prompts are sent to a model provider. For each run, the task text and the parts of your code the task needs are sent to the model provider chosen for that run: Anthropic or Together AI. Which one depends on the task and on cost. For research, the text of the web pages that were read (cut to the parts a report needs) is sent as well. If you turn on computer control, so are screenshots.

Together AI hosts models first published by Chinese companies (for example Qwen, DeepSeek, Kimi and GLM). The model weights run on Together's servers in the United States. Your prompts are not sent to the company that made a model or to China. We do not use a Together model that Together forwards to a third party.

Other model providers exist in our code but are not used in production today. Before we add one, we update this page.

Voice input: dictation uses your browser's own speech recognition. In some browsers (for example Chrome) the audio is sent to the browser maker's speech service, such as Google's, and not through us. We never receive the audio, only the text you send. Reading answers aloud uses the voices on your device.

Connectors you turn on (for example Slack, Notion or Google): only if you connect them, with your own account; then the content you ask us to read or write goes to that service under its own terms.

Transfers outside the EU and EEA, where they happen (the United States, global networks), need a legal mechanism. [Mechanism for transfers outside the EU and EEA: to be confirmed by a lawyer.]

[Default region setting for new workspaces and how it is described: to be confirmed by a lawyer. Today there is no EU-only processing for model calls.]

If you sign in with GitHub we ask for access to read your profile and email address and to your repositories (the “repo” permission, which GitHub grants for all your repositories, public and private), so a private repository can be copied to the cloud runner. The token stays on our server, is handed to the runner only for the copy (and for opening a pull request if you ask), is not written to logs, and stops being used after 8 hours; sign in again to continue. You can revoke the access any time in your GitHub settings.

Sign-in data minimisation: Google and Microsoft sign-in ask only for your identity, email address and name (“openid email profile”), Apple for name and email. We key your account on the provider's stable user id, not on your name or email, and we keep only the display name and the confirmed email address.

We do not train models on your code, tasks or results unless you explicitly agree. We keep a record of each run for your history; it is marked as not for training unless you opt in, and records without consent are never exported for training. If we ever train a model of our own, it will not be trained on the output of other companies' models where their terms forbid it.

You may ask us for a copy of your data, to correct it, or to delete it, and you may object to how it is used. You can also complain to the Swedish Authority for Privacy Protection (IMY).

• Delete things yourself: delete a conversation or your whole stored chat copy on the History page, remove an attached file in chat, delete a cloud session, and remove a linked sign-in method on the Account page.
• Delete the whole account: use “Delete account” in Settings, Account (it is refused while a change is running). It signs you out everywhere and removes your account, sessions, connected repositories, attachments, memory, API keys, the content of your changes, your session logs and your computer-control logs. Records of units and cost stay without your name, because accounting records must be kept; Swedish law asks companies to keep them for seven years. Deleted data can remain in backups until they roll off: at most 14 days on our server and 60 days in the second storage location, and 24 hours in the database host's history. [Backup period to be confirmed by a lawyer.] You can also write to [email protected] (mailbox still to be created before launch) from the address on your account.
• At the model providers: a model provider keeps what it keeps under its own terms (see the list above). We cannot delete data at a provider on your behalf; with Together AI's zero data retention setting and no stored prompts there is nothing to delete beyond usage metadata.
• Free tier after deletion: to stop repeated free sign-ups we may keep a one-way record that a repository or account has used the free tier (10 attempts).

The service is for people who work with code professionally or as a hobby and are at least 16 years old.

We will update this page when something changes and show the date at the top. Read the terms of use too.