Privacy policy

KukCode is a coding workspace operated by Kuklabs Inc. at kukcode.vercel.app. This page describes the hosted product and the iOS/Android companion. A copy you run yourself is yours: its operator, not Kuklabs, is the controller for that instance.

Accounts

When accounts are enabled, sign-up stores your name, email, and a password hash. We do not store the password in plain text. Sign-in sets an HttpOnly session cookie in the browser. The companion app asks for a bearer session instead, because it cannot read that cookie, and keeps the session on the device (OS secure storage when available).

Without a database, the hosted login is only the operator’s admin credentials from the server environment. Anonymous use is possible until the free-answer gate or rate limit applies.

Chat, prompts, and tokens

A chat turn is sent to the provider you picked or that KukRouter selected (Anthropic, OpenAI, and/or Google) so a reply can be streamed. Repository context, rules, and files the tools read ride in that request. Kuklabs does not sell prompts, answers, diffs, or token usage to anyone.

If you bring your own provider key, the browser sends it on that request. It lives in this browser’s local storage, not in KukCode’s database. Server-side keys (operator env or the admin panel) stay on the instance; when a database is configured they are stored encrypted.

Token counts (input/output, by provider) may be recorded for a signed-in account so monthly usage and any ceiling can be shown. The prompt text is not written into that ledger.

GitHub and KukGit tokens

A GitHub token you paste (BYOK) stays in this browser and is sent as x-byok-github so RepoGraph, file reads, blame, and editor saves can call GitHub as you. KukCode does not copy that token into a shared user table. An instance-wide GitHub token, if the operator set one, is a server secret for that instance.

A KukGit URL and token you enter are stored in this browser, or on the phone for the companion, and sent as request headers. The instance-wide KukGit token is admin-only. Mission prompts go to the KukGit instance you connected.

What else we store

• Team Memory entries you save for a repository, when that database is configured.
• A signed cookie counting free anonymous answers, when accounts exist.
• Optional diagnostics: error kind, provider name, duration, a short machine code. Not the message, not the prompt, not the repository name, not a file path. You can opt out in the terminal drawer.
• Chat sessions in this browser’s local storage, not on KukCode’s servers.

We do not sell data

Kuklabs does not sell personal information, prompts, or usage records. We do not run ads. Model providers process a turn under their own terms because that is how an answer is produced — that is processing, not a sale by Kuklabs.

Retention and deletion

Local storage and the phone’s secure store clear when you sign out or clear site data. Server accounts can be deleted by the instance operator (admin). There is no self-serve export button yet. Ask the operator of the instance you use if you need an account removed.

Children

KukCode is a developer tool. It is not directed at children under 13.

Contact

Kuklabs Inc. Questions about this policy: use the operator of the instance you signed into, or the contact on kukcode.vercel.app. Store listings should keep this page as the privacy URL.