Privacy Policy
What we store about you, who else sees it, and how to get rid of it. Last updated 29 September 2026. The data controller is Kinetic Seas Inc., 1501 E. Woodfield Rd, Schaumburg, IL 60173; contact support@maludb.org.
Two different kinds of data
Your account data is what we hold to run the platform for you. Your project data is whatever you and your users put in your database and storage: we process it on your instructions to run the service, and for nothing else. We do not sell data, and we do not use project data to train models.
What we store about you
- Account: your email address, your display name if you give one, and a hash of your password — never the password itself.
- Organizations and projects: names, plan, and which node a project runs on.
- API keys and access tokens: secret keys are stored hashed and shown once; publishable keys are stored so the dashboard can show them again.
- Sessions and security events: the IP address and browser user-agent of a sign-in, so an account can be protected and abuse investigated.
- Usage: database and file sizes, request and egress counts, and the limits they are measured against.
- Email we send you: confirmations, password resets, and whether an address bounced or complained, so we stop sending to it.
- Logs: ordinary server logs, including IP addresses, kept for 30 days.
Your project's own end users (the people who sign in to your app) are stored in your project's database. You are their controller; we process them for you.
Why we are allowed to hold it
To provide a service you asked for (a contract), to keep the platform secure and working (a legitimate interest), and where the law requires it. Where consent is the basis — optional product email, if we ever send any — you can withdraw it at any time.
Who else processes it
| Who | What for | What they see |
|---|---|---|
| MaluMail | Sending platform and project email | Recipient address and message content |
| Cloudflare (Turnstile) | The signup challenge | IP address and a challenge token |
| InterServer | The machines the platform runs on | Everything stored, as infrastructure |
Model providers are yours, not ours. Memory spaces call Anthropic, OpenAI or Voyage with your own API key, so the text you send is processed by the provider you chose under your agreement with them. If you do not enable memory spaces, nothing is sent.
Where it is kept, and for how long
Data is stored in New York, USA. Account data is kept while your account exists. Delete a project and its database and files are removed; close your account and the rest goes with it. Backups already taken are removed in the ordinary rotation, within 30 days. During the beta, backups are kept on the same machine as the data, which we say here because it affects how well your data is protected, not only how long we keep it.
Your rights
You can ask for a copy of your account data, correct it, have it deleted, or object to a particular use. A project and everything in it you can delete yourself from the dashboard; for closing an account, or anything else, write to support@maludb.org and we will answer within 30 days. If you are in the UK or EU and think we have handled your data badly, you can complain to your data protection authority.
Security, stated honestly
Secrets we hold for you — database passwords, provider keys, signing keys — are encrypted with a key kept outside the database. Secret API keys and passwords are stored hashed. Traffic to the platform uses TLS. What that does not mean: the beta runs on one machine, and the section above says what that costs.
If a breach affects your data, we will tell affected customers and any regulator we must, without undue delay, and say what we know and what we are doing about it.
Cookies
The dashboard sets one cookie, to keep you signed in. There is no advertising or analytics tracking on this site.
Children
The service is not for people under 16. We do not knowingly collect their data.
Changes
We will update this page when what we do changes, and say at the top when it last changed.