KalvyrPrivacy policy
Last updated: November 8, 2026
In short
- The Kalvyr desktop app works on your computer. Your code, maps, history and chats stay there. Kalvyr has no analytics or tracking.
- Kalvyr Free needs no account and never contacts us.
- For Pro, we keep your email, your subscription status and the computers you sign in. Stripe handles payment; we never see your card number.
- AI features run through your own Claude Code or Codex account, so what they read is sent to Anthropic or OpenAI under their terms, not to us.
- We don't sell your data or show ads. You can ask us to see, correct or delete it at any time.
- Who we are
- The desktop app
- Your account
- Payments
- Signed-in computers
- The website
- Why we use it
- Who processes it
- How long we keep it
- Your rights
- Children
- Changes
1. Who we are
Kalvyr is published by [your full name or company name], [postal address], France (“Kalvyr”, “we”). We are the controller of the personal data described here. For anything about your data, write to [privacy email address].
2. The desktop app
Kalvyr runs on your computer. It scans the project folders you connect, and it reads the session logs that Claude Code and Codex already write on your computer to show what they're doing. Project maps, history, settings and Pro conversations are saved in Kalvyr's folder on your computer. None of this is sent to us.
The app contains no analytics, telemetry or crash reporting. Kalvyr Free never contacts our servers.
AI features use your own accounts
AI descriptions of your components, agent chat and other AI features run through the Claude Code or Codex program installed on your computer, signed in with your own Anthropic or OpenAI account. When you use them, those programs may send parts of your project and your messages to Anthropic or OpenAI. That happens under your agreement with them and their privacy policies. Kalvyr doesn't receive or store a copy, and doesn't see your Anthropic or OpenAI credentials.
Kalvyr Pro
When you sign in to Pro, the app talks to our account service to check your subscription. It sends a one-time sign-in code, a token for this computer, a random ID created for this installation, and your computer's name. Afterwards it renews a signed “Pro pass” about every 12 hours. No project data, file names or code are sent.
3. Your account
To subscribe to Pro you create a Kalvyr account on this website. We keep:
- Your email address, to identify your account, and to send sign-in, password-reset and important service emails.
- Your password, stored only as a secure hash by our authentication provider. We can't read it.
- If you sign in with Google or GitHub: the email address and basic profile details (such as your name and picture) they share with us. We don't get access to your Google or GitHub data beyond that.
- Sign-in records: dates, IP address and browser of sign-ins, kept by our authentication provider to protect your account.
4. Payments
Subscriptions are paid through Stripe. You enter your payment details on Stripe's checkout and billing pages, and Stripe processes them under its own privacy policy. Stripe may act as the reseller (merchant of record) of your subscription, in which case it also handles your billing address and sales tax or VAT.
We never see or store your full card number. From Stripe we keep: your Stripe customer ID, your subscription's status and renewal date, and records of each invoice (amount, currency, date and whether it was paid).
5. Signed-in computers
For each computer you sign in to Pro, we keep its name, its random installation ID, when it was signed in and when it last checked your subscription. We keep only a hash of its token. You can see these computers and sign them out on your account page.
6. The website
- No tracking cookies: this website uses no advertising or tracking cookies, and doesn't follow you across other sites.
- Visit statistics: we count page visits with Vercel Web Analytics, to see which pages are used and where visitors come from. It sets no cookies and stores no IP address: it records the page, the referring site, and your country, browser, operating system and device type, and identifies visits only with a hash that changes every day. We do this on the basis of our legitimate interest in improving the website.
- Sign-in: when you sign in, your browser stores your session in its local storage so you stay signed in. This is needed for the account pages to work, and it's removed when you sign out.
- Fonts and code: pages load fonts from Google Fonts, the account pages load our authentication library from jsDelivr, and the download section asks GitHub for the latest release. Downloads themselves come from GitHub. Your browser connects to those services, which receive your IP address.
- Hosting: our hosting provider keeps standard server logs (IP address, pages requested, time) for security and operations.
7. Why we use it (legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account, signing you in, providing Pro, signing in your computers, billing | Performing our contract with you (Art. 6(1)(b)) |
| Keeping invoices and accounting records | Legal obligation (Art. 6(1)(c)) |
| Protecting accounts, preventing fraud and abuse, keeping server logs | Our legitimate interest in a secure service (Art. 6(1)(f)) |
| Important emails about your account or subscription | Performing our contract with you |
We don't send marketing emails without your consent, we don't sell your data and we don't use it for advertising.
8. Who processes it
We use these providers to run Kalvyr. They process data on our behalf, under contracts that protect it:
- Supabase: account sign-in and our database.
- Stripe: payments, invoices and the billing portal.
- Vercel: hosting of this website and our account service, and the website's visit statistics.
- Google Fonts and jsDelivr: fonts and code loaded by this website.
- GitHub: hosts the app downloads and tells this website which version is the latest.
- Google and GitHub, only if you choose to sign in with them.
Some of these providers are based in, or use servers in, the United States or other countries outside the European Economic Area. Where that happens, transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.
9. How long we keep it
- Account, subscription and computer records: as long as you have an account. When you delete your account, they're deleted within 30 days.
- Invoices and payment records: 10 years, as French accounting law requires (Code de commerce, article L123-22).
- One-time sign-in codes: valid for 5 minutes, then deleted.
- Sign-in and server logs: kept by our providers for a limited time, generally no more than 90 days.
10. Your rights
You can ask us to access, correct or delete your personal data, to receive a copy of it in a common format, to restrict how we use it, or object to uses based on our legitimate interest. Write to [privacy email address] from your account's email address. We reply within one month.
To delete your account, cancel your subscription first, then email us. We'll delete your account and its data, except the payment records we must keep by law.
If you think we haven't handled your data properly, you can complain to the CNIL (cnil.fr), the French data protection authority, or to the authority in your own country.
11. Children
Kalvyr isn't intended for children. You must be at least 15 years old to create an account.
12. Changes
If we change this policy, we'll update the date at the top. If a change matters for how we use your data, we'll tell you by email or in the app before it applies.