Privacy Policy

1. Data Controller

Karea is operated by KPilot Labs. For questions about data processing, contact us at info@kpilotlabs.com.

2. Data We Collect

• Account data: name, email address, hashed password, profile picture URL, email verification status, and account role
• User preferences: UI settings stored as JSON, including display options, sort order, view mode, notification channel preferences, granular notification-type preferences, and productivity widget settings
• Subscription & trial data: plan tier (free or pro), Stripe customer ID and subscription ID (if you upgrade), trial expiry and grant dates, the reason a trial was granted (signup promo, admin-granted, or student self-claimed), and self-claimed student status
• Task data: tasks, categories, projects, notes, tags (with colors), deadlines, closing requisites (checklists), task markdown documents, public sharing tokens, task sequence numbers, and associated metadata you create
• Task history: a detailed audit trail of all field changes on tasks, recording the field name, old value, new value, who made the change, and when
• Productivity data: if you opt in to hourly check-ins, self-reported focus ratings (focused, okay, or distracted) are stored with timestamps
• Chat data: AI chat messages, command inputs, AI responses, and a record of actions the AI took on your behalf
• Team data: team memberships, roles, and invitation records - including the email addresses of people invited to a team who may not yet have a Karea account
• Notification records: in-app notification history including type, task reference, and read status
• API keys: key name, permissions (read/write), project scope restrictions, last-used timestamp, and expiry date
• Bug reports & feedback: title, description, the page URL where the report was submitted, browser user-agent string, report type (bug, feature, or feedback), and admin notes
• Announcement dismissals: which system announcements you have dismissed and when
• Resources: files and text documents you upload or create. Text-based resources (code files, markdown, config files) are stored in the database. Binary files (images, PDFs, archives) are encrypted with AES-256-GCM before upload to Cloudflare R2 object storage - the stored content is unreadable without the server-side encryption key
• Reminders & schedules: reminder times, snooze state, and recurring-task schedules you configure
• Open questions: questions you raise against a project, their answers, and the tasks they are linked to
• AI session data: coding-session records linked to a task, task context entries, and per-request AI usage records (provider, model, token counts and cost) used for quota enforcement and billing
• Meetings: meeting titles, descriptions, start and end times, locations, attendee names and email addresses, prep notes, and any transcript you paste in. Attendee details may include personal data about people who do not have a Karea account
• Integration data: access and refresh tokens for the third-party accounts you connect (JIRA, GitHub, Notion, Salesforce, Google Calendar), the site or workspace identifiers they belong to, per-integration sync settings, and sync, webhook and audit logs recording what was synchronised and when
• Linked third-party records: for each linked item, a copy of the identifying fields we need to keep the link working - for example a JIRA issue key, summary and status, a GitHub branch, issue or pull-request reference, or a Notion page id
• Codemap data: source code you upload, paste, or import for analysis, stored as file contents plus the symbols and relationships extracted from them. Codemap projects can be created without an account, in which case they are tied to an anonymous session identifier and expire automatically
• Loom recordings: if you attach a Loom video to a task, we store its share URL, video id, title, thumbnail URL and duration. The recording itself stays on Loom
• Onboarding & promotions: onboarding progress, promo codes you redeem, and redemption records
• Technical data: browser type and IP address, collected for security purposes during requests

3. Legal Basis for Processing

We process your data based on:

• Contract performance: to provide the task management service you signed up for
• Legitimate interest: to improve the service, prevent abuse, and maintain security
• Consent: for optional features like email notifications, browser push notifications, and productivity check-ins

4. Third-Party Services

• Stripe: payment processor for Pro and Max subscriptions. If you upgrade, your email address and payment information are shared with Stripe to manage billing. See stripe.com/privacy.
• Cloudflare R2: encrypted object storage for uploaded binary files (images, PDFs, etc.). Files are encrypted with AES-256-GCM on our server before upload - Cloudflare stores only encrypted blobs and cannot read file contents. Text-based files are stored in our database, not on Cloudflare.
• DeepSeek AI: AI-powered features send your task data to DeepSeek for processing. This includes task titles, descriptions, statuses, notes, category names, assigned user names, closing requisites, tag names, markdown content, and activity history relevant to the request. Passwords and account credentials are never sent.
• OpenAI: Users on the Max plan may have their AI requests routed to OpenAI (GPT-4.1) for faster, higher-quality responses. The same categories of task data described above for DeepSeek are sent to OpenAI when this applies. OpenAI's API data usage policy applies - see openai.com/policies/api-data-usage-policies. API inputs and outputs are not used to train OpenAI models.
• Resend: email delivery service for verification codes, notifications, and recap emails you choose to send.
• Atlassian (JIRA): if you connect a Karea project to JIRA, we exchange data with your Atlassian site: we read issue keys, summaries, statuses, issue types and comments, and - depending on the per-project settings you choose - push task notes as comments and status changes back to the issue. Connections are made per Karea project via OAuth; access and refresh tokens are encrypted before storage. Self-hosted and Cloud sites are both supported. Disconnecting stops all further exchange.
• GitHub: optional. Links tasks to branches, issues and pull requests, and can push task notes as comments and close a task when a pull request merges. Tokens are encrypted before storage.
• Notion: optional. Two-way synchronisation between tasks and Notion pages, with per-field toggles for title, status, deadline and body.
• Salesforce: optional. Connects one or more Salesforce orgs so you can run queries and take actions from Karea. Query text, row counts and saved results are stored; credentials are envelope-encrypted. Data-modifying actions require explicit confirmation.
• Google Calendar: optional. Imports your calendar events to create meetings in Karea, including event titles, times, locations and attendee names and email addresses. Tokens are encrypted before storage. Revoking access in your Google account or disconnecting in Karea stops the import.
• Loom: if you attach a Loom recording, the video is hosted by Loom and is subject to Loom's own privacy policy and to the sharing settings you chose there. Karea stores only the link and its metadata.
• Umami Analytics: self-hosted, cookie-less web analytics at umami.kpilotlabs.com. Collects page views, which screens are used and how long is spent on each, referrer URLs, browser type, operating system, device type, and country (derived from IP address). No cookies are set, and IP addresses are not stored. Analytics data is aggregated and not linked to individual user accounts.

We do not sell, share, or transfer your data to third parties for advertising or marketing purposes.

5. Public Task Sharing

You can generate a public link to share a specific task. When you do, the task's title, description, status, priority, deadline, assignee, closing requisites, and optionally notes become accessible via that link without authentication. You can revoke a public link at any time from the task detail panel. Revoking the link immediately removes public access.

If you enable anonymous note-posting on a shared task, visitors who leave notes provide a display name and are assigned a random guest token for attribution. This guest identity is also persisted in the visitor's browser localStorage.

6. Connected Integrations

Integrations are opt-in and connected by you, one at a time. Connecting one grants Karea an access token scoped to what that integration needs; we store it encrypted and use it only to perform the synchronisation you configured.

• Direction of flow: each integration has its own settings controlling what is read from the third party and what, if anything, Karea writes back. Nothing is pushed to a third-party service unless the corresponding setting is on.
• Webhooks: JIRA and GitHub can notify Karea of changes on their side. Those notifications are verified and logged.
• Logs: sync and audit logs record which records were exchanged and when, so you can see what an integration did. They are deleted with the integration.
• Disconnecting: disconnecting removes the stored tokens and stops all exchange. Data already copied into Karea (for example a linked issue key) remains on your tasks until you delete it, and data already written to the third party remains there under that service's own terms.

7. Google User Data

When you connect Google Calendar, Karea requests read-only access to your calendars (calendar.readonly) and your Google account email address (userinfo.email). We use them for one purpose: to import your events into Karea as meetings, and to show you which Google account the connection belongs to. Karea never writes to your calendar.

Karea's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Google user data is used only to provide the calendar features described above; it is not transferred to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition; it is not used for advertising; and no human reads it except with your explicit permission, for security purposes, to comply with the law, or where the data is aggregated and anonymised.

Google user data is not sent to any AI provider. You can disconnect at any time in Settings → Integrations, which deletes the stored tokens, and you can revoke Karea's access directly from your Google account permissions page.

8. Browser Extension

The Karea browser extension is optional. It stores the API key you paste into it, and a cached copy of your projects and recent tasks, in your browser's extension storage so the popup can open without waiting on the network. The cache is tied to the API key it came from and is cleared when you log out of the extension or change keys.

The extension reads page content only when you click its capture button on a supported page (a JIRA issue or a Google Classroom item) or capture the page you are on. It sends that content to Karea to pre-fill a task, and it is stored only if you then create the task. The extension does not track your browsing, and it sends nothing anywhere other than to the Karea server you configured.

An unfinished capture is kept in extension storage so closing the popup does not lose your work; it is discarded when you create the task or cancel.

9. Meetings & Attendee Data

Meetings you create or import hold attendee names and email addresses, prep notes, and any transcript you paste. Where those attendees are other people, you are responsible for having a lawful basis to store their details in Karea, and for not pasting in material you are not permitted to share. Deleting a meeting deletes its questions, linked-task records, attendee list and transcript.

10. Codemap & Uploaded Source Code

Codemap stores the source code you give it, along with the symbols and relationships extracted from it, so the map can be rebuilt and browsed. If you enable AI features on a codemap, relevant code is sent to the AI provider described above. A codemap created without an account is tied to an anonymous session identifier and expires automatically; a codemap owned by an account is kept until you delete it. Do not upload code you are not permitted to share.

11. Karea MCP Server

Karea publishes an MCP server that lets an AI coding assistant on your own machine work with your tasks. It authenticates with an API key you create and runs locally under your control; it talks only to the Karea API. What your assistant sends to its own model provider is governed by that provider, not by Karea.

12. Resources & File Storage

Resources you create or upload are accessible only to you and to members of the project the resource is linked to (if any). Resources are never shared with third parties or made publicly accessible.

• Binary files (images, PDFs, archives) are encrypted with AES-256-GCM before being stored on Cloudflare R2. The encryption key is held exclusively on our server. Neither Cloudflare nor anyone with direct bucket access can read file contents.
• Text-based files (source code, markdown, configuration files) are stored in the database with the same access controls as your task data.
• Deletion: when you delete a resource, both the database record and the encrypted R2 object (if applicable) are permanently removed.

13. Data Retention

Your data is retained for as long as your account is active. Codemap projects created without an account expire automatically; integration tokens and their sync logs are deleted when you disconnect the integration. Chat history display is limited to the most recent 25 messages per project in the UI; older messages are retained in the database. API interaction logs, task history records, and productivity check-in data are retained indefinitely while your account is active. You can delete your account and all associated data at any time.

14. Your Rights (GDPR / LOPDGDD)

Under EU and Spanish data protection law, you have the right to:

• Access: request a copy of all your data
• Rectification: correct inaccurate data
• Erasure: delete your account and all data ("right to be forgotten")
• Portability: export your data in JSON or CSV format
• Restriction: request limitation of processing
• Objection: object to certain processing activities

To exercise these rights, use the data export feature in Settings or contact info@kpilotlabs.com. We will respond within 30 days.

15. Cookies & Client-Side Storage

Karea uses essential cookies for authentication (session tokens). We do not use advertising or tracking cookies. Umami, our analytics tool, is cookie-less and does not set any cookies or store personal identifiers.

Karea also uses your browser's localStorage to persist UI preferences (display settings, collapsed sections, hidden stats), guest identity tokens for public task commenting, and other client-side state. localStorage data never leaves your browser unless explicitly submitted.

16. Data Security

We protect your data with: HTTPS encryption in transit, bcrypt password hashing, JWT-based sessions with a 30-day maximum age, role-based access control, AES-256-GCM encryption of uploaded files at rest, encryption of stored third-party integration tokens, and API key authentication for external integrations.

17. Supervisory Authority

You have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es or your local EU data protection authority.

18. Changes

We may update this policy. Material changes will be communicated via email or in-app notification.