Privacy policy

Your email address and account identity — created through email/password sign-up or Google sign-in, both handled by our authentication provider, Supabase. We never see or store your password directly.

Company, title, and how you plan to use Katafacts — asked at signup so we understand who's using the product.

The artifacts you generate and their metadata — the content of what you build (A3s, value stream maps, and every other kata) and a lightweight record of it (type, date, tags, scores, committed actions).

Usage and cost telemetry for every artificial intelligence (AI) call you make — which tool, token counts, latency, and computed cost, used for quota enforcement and account history.

Any file you upload to the coach — parsed for its text content and discarded immediately. The original file is never stored.

When you generate or edit an artifact, or chat with the coach, the relevant content is sent to Anthropic's application programming interface (API) to produce the result. This is the same processing every AI feature in the product runs through — there's no separate, undisclosed use of your content for anything else.

We do not sell your data.

We use session cookies to keep you signed in — set by Supabase Auth, essential to the product working at all.

We use Google Analytics, via Google Tag Manager, for anonymized website analytics only — which pages get visited, how people find us. We don't run any advertising, retargeting, or other tracking tags.

Artifact content expires automatically 30 days after it's created — this is a deliberate default, not a bug, and it's the same limit for everyone.

Artifact metadata and usage history are kept indefinitely, since they power your account's history and our own cost accounting. Metadata never includes the full content of an expired artifact.

Katafacts is currently free during a beta period with no fixed end date. We may email you occasionally during beta for product feedback, a short survey, or updates about your account. This is separate from transactional email (password resets, account notices), which you can't opt out of while you have an account. If you'd rather not hear from us for feedback or surveys, email privacy@katafacts.com and we'll note it.

A small set of service providers process data on our behalf, each only for what their role requires: Anthropic (AI generation), Supabase (database, authentication, storage), Vercel (hosting), and Google (Google Analytics, via Google Tag Manager, for site usage analytics). Each is bound by its own data-processing terms; see Google's privacy policy for how Google Analytics itself handles data.

Every table holding your data is scoped by database-enforced row-level security — your account's rows are isolated from every other account's at the database level, not just filtered in application code.

You can ask us to access, correct, or delete your account and its data at any time — email us and we'll handle it directly. We don't yet have a self-service delete button in the product; until we do, this is the reliable way to get it done.

Katafacts isn't directed at children, and we don't knowingly collect data from anyone under 13.

If this policy changes in a way that matters, we'll update this page and change the effective date below. We won't quietly narrow your rights.

Questions or requests: privacy@katafacts.com.