Home / Privacy Policy

Privacy Policy

Last updated: 2026-09-22

1. Who we are

kryyt ("kryyt", "we", "us"), a FourOne.ai company headquartered in Chicago, Illinois, United States, with offices in Chandigarh (India), Vancouver (Canada), Milton Keynes (United Kingdom), Melbourne (Australia), and Amsterdam (Netherlands), operates a unified, OpenAI-compatible AI API and chat platform. Our application and account login are provided at app.kryyt.com and our API endpoints at api.kryyt.com. This Privacy Policy explains how we handle personal data across our website, application, and API. For payments, Paddle acts as our Merchant of Record and processes your payment data under its own privacy policy.

2. Information we collect

We collect the following categories of information:

  • Account data — name, email address, and a securely hashed password when you register at app.kryyt.com.
  • API credentials — the API keys we issue to you (stored as hashes) and their usage metadata.
  • Content you submit and generate — your prompts and chat messages, files you upload, code context sent from the kryyt VS Code extension when you request completions or chat, the model responses returned to you, and any files generated for you.
  • Usage & billing data — token counts, model, timestamps, request metadata, credit balances, subscription quota, credit-sharing settings and recipients, and transaction records (payment details are handled by Paddle, not stored by us).
  • Technical data — IP address, browser and device information, and cookies or similar technologies.
  • Analytics data — aggregated interaction data collected via Google Analytics (see cookies below).

3. How we use your information

We use this information to: provide and operate the API and chat platform; authenticate requests and meter usage; process billing and free credits; maintain your account, chat history, and files across sessions and devices; secure the service and prevent fraud or abuse; provide support; comply with legal obligations; and improve reliability and performance.

We do not sell your personal data.

4. Data retention — account & chat continuity

We retain the chats and files you upload, together with the responses and files generated for you, on our servers on an ongoing basis for as long as your account remains active. We do this deliberately to provide account continuity and chat continuity — so your conversation history, uploaded documents, and generated outputs remain available to you across sessions, devices, and future visits, and so that assistants and agents built on kryyt can maintain context over time.

You remain in control of this content:

  • You can delete individual chats or files from within the application at any time.
  • You can request deletion of your account, which removes your retained content from our active production systems. Residual copies in encrypted backups are purged on a rolling backup-retention cycle, and we may retain limited records where required for legal, tax, accounting, or fraud-prevention purposes.

Where you have built an application on kryyt that stores your end-users' content, you are the controller of that content and are responsible for honoring their rights and deletion requests.

Where the GDPR or UK GDPR applies, we process personal data on the bases of: performance of a contract (providing the service you sign up for); our legitimate interests (securing and improving the service, preventing abuse); compliance with legal obligations; and your consent (for example, non-essential analytics cookies), which you may withdraw at any time.

6. Sharing & subprocessors

We share data with a limited set of service providers who process it on our behalf:

  • AI model providers — to generate responses, your prompts and inputs are transmitted to the provider of the model you select (for example, DeepSeek, and, as they launch, Z.ai/GLM, Moonshot/Kimi, Alibaba/Qwen, and MiniMax). Each provider processes data under its own terms.
  • Paddle — our Merchant of Record for payments, subscriptions, taxes, and refunds.
  • Google Analytics — website usage analytics.
  • Infrastructure & email providers — hosting, storage, logging, and transactional email.

We may also disclose data where required by law or to protect our rights, users, or the public.

7. International transfers

We and our subprocessors may process data in countries other than your own. Where personal data is transferred across borders, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms recognized in your jurisdiction.

8. Cookies & analytics

We use two categories of cookies and similar storage:

  • Essential — needed to sign you in at app.kryyt.com, keep the service secure, and remember your theme and your cookie choice. These do not require consent.
  • Analytics (optional) — Google Analytics (gtag.js), used to understand aggregate website usage. Google Analytics is not loaded and sets no cookies unless you choose "Accept all" or enable Analytics in the cookie banner. We use Google Consent Mode with all advertising and analytics storage denied by default, and we do not use advertising or remarketing cookies.

On your first visit a banner lets you Accept all, Reject all, or Customize — rejecting is as easy as accepting. Your choice is stored in your browser for up to 12 months, after which we ask again. You can change or withdraw consent at any time via Cookie settings in the site footer; withdrawing consent stops analytics and deletes Google Analytics cookies from your browser. The legal basis for analytics is your consent (GDPR Art. 6(1)(a) and the ePrivacy Directive).

Optional app analytics has a separate opt-in under Privacy & analytics in the account menu. The Google tag runs in an isolated frame and receives only general screen categories and a random per-tab identifier, not chat text, titles, filenames, email addresses, account IDs, or private URLs. Ghost chats and admin views stop the analytics frame. Google still receives ordinary network and device information when analytics is allowed. Withdrawing app consent removes the frame and its per-tab identifier. Website and app choices are stored separately.

9. Security

We use administrative, technical, and physical safeguards including TLS encryption in transit and hashed credentials. See our security page for more. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

Subject to your jurisdiction, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact privacy@kryyt.com. You also have the right to lodge a complaint with your local data-protection authority.

11. Children

kryyt is not directed to children and is intended for users aged 18 or older (or the age of digital consent in your jurisdiction). We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a revised "last updated" date and, where appropriate, notified to you.

13. Contact

Questions or requests: privacy@kryyt.com. For payment-related data handled by our Merchant of Record, see Paddle's privacy policy at paddle.com/privacy.

This document is provided for transparency and general information and is not legal advice. It should be reviewed by qualified counsel for your jurisdiction (including GDPR, UK GDPR, CCPA/CPRA, India DPDP, and Brazil LGPD where applicable) before it is relied upon.

Website contact and update requests

Contact and update-list submissions are processed by the Kryyt application, stored for the team to respond, and emailed to hello@kryyt.com using our SMTP service. We store the submitted name, email, message, submission source, time, and delivery status. A keyed hash of the submitting network address helps prevent abuse. We do not automatically create an account or send marketing email solely because a form was submitted. Contact hello@kryyt.com to request access or deletion.