Effective 12 October 2026. Applies to the Kondai iOS app, the @kondai/mcp package, and the API at api.pinnal.net.
Kondai is built so that we cannot read your widget. This page lists exactly what we store, why, and how to remove it.
| Data | Why | Can we read it? |
|---|---|---|
| Email address | Sign in, verification, recovery-key delivery | Yes |
| Password salt | Lets your devices re-derive your keys | Yes, it is public and useless on its own |
| Two login verifiers (Argon2id hashes) | Checking a login or a recovery attempt | No. They are hashes of keys derived from your password or recovery key; neither the password nor the recovery key is ever sent to us |
| Two wrapped copies of your data key | So a new device can unlock your widget after you sign in | No. They are encrypted with keys derived on your devices |
| Your widget script | The thing your agent publishes | No. Stored only as XChaCha20‑Poly1305 ciphertext |
| Session tokens | Keeping you signed in on each device or agent | Stored as SHA‑256 hashes with a device label you choose |
| Push tokens | Telling your phone the widget changed | Yes, but they identify an app install, not a person |
| Request logs | Operating and debugging the service | Method, path, status, timing and IP address. Never request bodies, query strings, tokens or recovery keys |
The service runs on a single Amazon Lightsail instance in Oregon, USA. The database is continuously replicated to Amazon S3 in the same region for disaster recovery; the replica holds the same ciphertext as the live database. Email is sent through Amazon Simple Email Service. Push notifications go through Apple Push Notification service and contain no content, only a signal to refresh.
We do not sell, share, or otherwise disclose your data to anyone except the infrastructure providers above, and only to the extent needed to run the service. We use no analytics, advertising, or tracking SDKs in the app or on this website.
The MCP server runs on your own computer and keeps your data key in your operating system's keychain (macOS) or in a file readable only by you (Linux and Windows). The iOS app keeps it in the iOS Keychain, shared with the widget extension. Anything running on those devices with your privileges can read the widget; that is by design and outside what Kondai can protect.
DELETE /v1/account, removes your account, keys, widget, sessions and push tokens immediately. Backup replicas age out within 7 days.Kondai is not directed at children under 13 and we do not knowingly collect data from them.
If this policy changes materially we will update the effective date above and, for anything that affects how your data is handled, email the address on your account.