Privacy

When you ask KINDr to look at a message (analyse a draft, open a perspective lens, or Reframe something you received), the text, plus any context and the option you picked, is sent to our server and on to Anthropic's Claude model to produce the reflection. Nothing is sent until you ask (the one exception is the extension's opt-in Send-intercept, below).

The public demo sends text to Anthropic the same way but stores nothing about it.

Stored with your anonymous session, whether or not you change any settings:

• A random session ID, which surface you used (web or extension), whether “Store my message text” is on, and when the session was created and last used.
• For each message analysed: its length; a keyed hash of the text (an HMAC using a server-side secret, so the text can't be recovered or confirmed from it without that secret); the tone KINDr read (label, descriptors, confidence, flags); which response it chose; how long it took; the type and size of any suggested rewrite and whether it passed KINDr's guidelines; and feedback on a suggestion (helpful, not helpful, copied, or closed without using it).
• For each Reframe: the length and keyed hash of the text.

Only if you turn on Store my message text (off by default): the message text itself, the text you asked KINDr to Reframe, and what KINDr wrote about them: the wording and reasoning of a suggested rewrite, a perspective reading you opened, and Reframe's alternative readings. A rewrite that KINDr held back for not meeting its guidelines is never stored, whatever the setting.

We don't sell any of this, and we don't use it to train models.

• One cookie, kindr_session: a signed session ID, not readable by page scripts, expiring 30 days after you last used KINDr.
• Rate limiting: to stop abuse and runaway costs, we count requests per minute, and requests that use the AI per day, against a keyed hash of your IP address (never the address itself). Per-minute counts expire after one minute, daily counts after two days.
• Our own logs record shapes and decisions (lengths, tone labels, timings), not your text. Our hosting provider keeps standard request logs, including IP addresses, under its own retention.

On Gmail and Slack the extension reads the text in a compose box only when you click its K button or press ⌘⇧K (Ctrl+Shift+K), and reads text you've selected only when you click its Reframe button. If you turn on Send-intercept (off by default), it also reads a draft of 12 or more characters when you click Send, to check whether to pause before it goes.

In your browser it stores its settings (API address, Send-intercept on or off) and its session token. The extension's session is separate from the website's, so delete each from where you used it.

• Anthropic: runs the Claude model that reads the text you send.
• Neon: hosts the Postgres database that holds what's listed under “What we store”.
• Upstash: holds the rate-limit counts and the daily usage total.
• Vercel: hosts the website and API.

These providers may store or process data outside Australia, including in the United States.

A session that isn't used for 90 days is deleted automatically, together with everything recorded under it. Our database provider keeps a short restore history, so deleted data can remain there until that history rolls over.

• Website: Settings → Delete my data.
• Extension: open the toolbar popup → Delete my data.

Deletion is immediate and removes the session and everything recorded under it. Turning off “Store my message text” stops new text being kept but doesn't remove what's already stored; deleting does.

Questions about your data, or a deletion you can't do yourself: crosstalkstudios.hq@gmail.com.