Privacy Policy

krei is operated by Irfan Erol, a sole proprietor established in Turkey (tax number 3670493504, Karşıyaka Vergi Dairesi), who is the data controller for the personal data described here — under Turkey's Personal Data Protection Law No. 6698 ("KVKK") and, for people in the EU, EEA or UK, the GDPR. Contact: [email protected], or by post at Bahriye Üçok Mah. 1762 Sk. No: 9 İç Kapı No: 1, 35580 Karşıyaka/İzmir, Turkey. We have not appointed a representative in the EU.

Payments are different: Paddle sells the subscription as merchant of record and is responsible for the payment data it collects at checkout, under Paddle's privacy notice.

In the terminal client, your conversations, tool calls and files stay on your machine (~/.krei/sessions.db). With a krei plan, each request's content passes through our gateway to the model provider and back; the gateway does not store it and logs metadata only.

In the web chat, the agent runs on our server, so your conversations are stored there: every message, the agent's tool calls and their results, your input history, the files in your workspace including uploads, and snapshots used to undo a turn. They stay until you delete them (see section 07).

With your own key (krei login --byok), requests go straight from your machine to the provider you named; your key stays in ~/.krei/config.json (mode 0600). We receive neither.

• Account — your verified email address, an internal user id and customer id, and when the account was created. We ask Google, GitHub or Microsoft only for sign-in scopes, and keep only the verified email from the answer.
• Sign-in session — a random token in one cookie; we store only its hash, with your user id, email and customer id, and when it was created, last used and expires.
• API keys — a hash of your key (never the key itself), its plan, and the email it was issued for. During krei login, the new key is held for at most 10 minutes until your terminal collects it.
• Billing — from Paddle: your Paddle customer id and email, subscription id and status, plan and price ids, any scheduled cancellation or pause, and the krei user id checkout links it to. Card details never reach us.
• Usage — per model request: the model, token counts, cost, credits charged and a timestamp, keyed by a hash of the key — never the prompt or the reply. This powers your usage page and the spend cap.
• Web chat content — as described in section 02, only if you use the web chat.
• Logs — technical records of requests: IP address, path, status and time, plus metadata such as a key fingerprint, model, plan and outcome. Never the content of prompts, replies or files. Client IP addresses are also held for about a minute for rate limiting.
• Update check — when the terminal client starts interactively — with a krei plan or your own key — it asks a krei.ai address whether a newer version exists. The request carries no account, key or version; like any request, it reveals your IP address. Turn it off with KREI_SKIP_UPDATE_CHECK=1 or --skip-update-check.

We process account, session, key, billing, usage and web chat data to provide the service you signed up for — performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). We keep logs, rate-limit data and the update check to run, secure and fix the service — our legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)). Where a law requires us to keep a record, that legal obligation is the basis (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)). We do not sell personal data, use it for advertising, or train models on it.

One first-party cookie, krei_web_sess, keeps you signed in. It is HttpOnly, SameSite=Lax and sent only over HTTPS, and expires 30 days after you sign in (signing out ends it sooner). No analytics or advertising cookies. On the pricing and billing pages, Paddle's checkout script loads from Paddle; what it collects is covered by Paddle's privacy notice.

• Paddle — merchant of record: checkout, payment, tax, invoices and refunds. When you start a checkout signed in, we pass it your email and krei user id.
• OpenRouter, Inc. (USA) — routes each model request made with a krei plan to the company that hosts the model. It receives the content of the request (your prompt, code context and tool results) to produce the reply. We send no account identifier with the request; it does see whatever the content itself contains. We set its data_collection: "deny"preference on every request, so OpenRouter routes only to model hosts that, by its classification, do not train on user data. Some hosts may still keep prompts for a limited time (for example up to 30 days for abuse monitoring) under their own terms. OpenRouter states it does not use inputs or outputs for model training (its privacy policy).
• DeepInfra — we hold an account for a direct fallback route, but no request goes to it directly today; OpenRouter may still choose DeepInfra as the host for some open models (see above). We will update this page before any direct route is switched on.
• Google, GitHub, Microsoft — only the one you choose to sign in with, to confirm your email address.
• Hostinger — the virtual server that runs krei's gateway, website, web chat and database.

Some of these providers are outside Turkey and the EU — OpenRouter is in the United States, and the model host it picks may process your request in the US, the EU, Singapore or China — so using krei involves transferring personal data abroad. Before the paid service launches we will put in place, and name here, the safeguard each transfer relies on (KVKK Article 9; for EU, EEA and UK users, GDPR Chapter V).

Web chat content stays until you delete it. Deleting a chat removes its messages at once (files in your workspace, including uploads, stay until you use "Delete my data" or delete your last chat); "Delete my data" in the chat's account menu removes every chat, message and tool call, your input history, approval grants, and all workspace files, uploads and undo snapshots, immediately.

Account, billing and usage data is kept while your account exists; nothing deletes it automatically. Ask us to delete your account at [email protected] and we remove it — with any web chat data left — from our live systems within 30 days, except records the law requires us to keep.

Backups. Our backup policy is a nightly copy of the database and web-chat files, keeping 14 daily and 8 weekly copies. Deleted data therefore leaves the backups as they rotate — at the latest 8 weeks after it was deleted. Backups are used only to restore the service.

Sign-in sessions end 30 days after last use; login codes after 10 minutes; rate-limit entries after about a minute. Logs are kept only as long as needed to run and secure the service.

You can ask us to confirm what we hold about you, give you a copy, correct it, delete it, restrict or object to its processing, or move it to another service — the rights in GDPR Articles 15–22 and KVKK Article 11. Write to [email protected]; we answer within 30 days and may need to confirm the request comes from the account's email address.

In the web chat you can do much of this yourself: export any chat as a file from its menu, and delete one chat or all your chat data from the account menu. The web chat deletion does not touch your account, subscription or usage records — ask us for those.

krei is for adults: you must be 18 or older to use it. We do not knowingly collect data from children; if you think a child has given us data, write to us and we will delete it.

Please contact us first at [email protected]. You can also complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) — under KVKK Article 14, after applying to us, within 30 days of our answer or 60 days of your request if we do not answer — or, if you live in the EU, EEA or UK, to your local data protection authority.

We will post changes here with a new date, and tell account holders of material changes before they apply.