Privacy Policy
This policy explains what Krish Agent collects, why, and the choices you have. The service is a developer preview: it currently manages identity, devices, and model-provider configuration, and it does not yet run agent tasks or store conversation content.
Information we collect
- Google account data. When you sign in, Google returns a stable account identifier, your email address, your display name, and whether the email is verified. We never receive your Google password or Google API data beyond those OpenID Connect claims.
- Device data. The device name and platform you provide, creation time, last-seen time, status, and revocation time. Device tokens are stored only as SHA-256 hashes.
- Provider configuration. Provider display names, base URLs, adapters, auth types, custom header names, model IDs, capability flags, and credentials you enter. Credentials are encrypted with AES-256-GCM and are never returned by the API.
- Operational data. Audit events, connection-test results and diagnostics, usage counts, rate-limit counters, and request logs containing method, path, status, duration, request ID, account ID, and device ID. Request bodies, tokens, API keys, and provider request or response payloads are not logged.
- Network data. Client IP addresses are converted to a SHA-256 hash for rate limiting and audit records; the raw address is not stored.
How we use it
- Authenticate you and issue, verify, and revoke device credentials.
- Store and display the provider configuration and models you create.
- Test provider connections and discover models when you ask us to.
- Protect the service with rate limits, audit records, and abuse detection.
- Diagnose failures and maintain service reliability.
We do not use your data for advertising, profiling, or sale.
Sharing
- Cloudflare hosts the Worker and the D1 database that store this service's data.
- Google provides sign-in and returns the profile claims described above.
- AI providers you configure receive requests only when you test a connection, discover models, or later run a task that uses that provider. You supply their credentials and are responsible for their terms and costs.
- We may disclose data if required by law or to protect the service and its users from abuse.
Cookies and tracking
This API does not set cookies, use analytics scripts, or embed third-party trackers. Google may set cookies on its own domain during sign-in under Google's policies.
Retention
Account, device, provider, credential, model, test, usage, and audit records are retained until the account is deleted or you ask us to delete them. Expired or consumed sign-in handshakes and expired pairing codes are retained until cleanup runs. Rate-limit counters are retained for a short operational period.
Security
Device tokens and pairing codes are stored as hashes, provider credentials are encrypted at rest, transport uses HTTPS, responses are not cached, and every request is rate limited. No system is perfectly secure; protect your device token and revoke a device immediately if it is lost.
Your choices
- Revoke a device with
DELETE /v1/devices/:id; the token stops working immediately. - Delete or rotate provider credentials through the provider endpoints.
- Request an export or deletion of your account data by emailing support@mtandaolabs.com. Self-service export and deletion endpoints do not exist yet.
Children
The service is not intended for children under 13, or under the minimum age required in your jurisdiction, and we do not knowingly collect their data.
Changes
We may update this policy as the service changes. Material changes will be reflected by a new effective date on this page. Continued use after an update means you accept the revised policy.
Contact
Questions or requests: support@mtandaolabs.com.