Your data, plainly.

What we collect

Account data: your email address and workspace name, used for sign-in (magic links), product notifications you can act on (a paused project, a question the PM needs answered), and billing receipts.

Connected credentials: the GitHub App installation you authorize and the AI coding-engine credentials you connect for Claude Code, Codex, GLM, Kimi, or Grok. These include supported subscription logins and API keys. They are encrypted at rest under independent, rotatable keys and are deleted when you revoke them. The OpenRouter coding-engine route remains limited to Keelen's own test and benchmark projects and is not enabled for customer repositories.

Operational data: project configuration, iteration logs (automatically scrubbed of secrets), pull-request metadata, and timeline metrics such as run duration and token counts. This is the data that powers your dashboard.

Billing data: payments are processed by Stripe. We store your Stripe customer and subscription identifiers — never card numbers.

Your code

Your repository content lives in your GitHub account. During a run it is cloned into an isolated single-use virtual machine that is destroyed when the run ends — no persistent volume. We keep iteration logs and diffs' metadata so you can audit what the loop did; we do not keep a copy of your repository.

We do not train machine-learning models on your code. Your coding-engine usage flows directly to the provider whose credential you connected, under that provider's terms.

We do capture iteration trajectories: the prompts we send, the diffs the loop produced, and the tool calls it made during a run. We use them for one purpose, to improve the loop itself (its scheduling decisions and the quality of the rules it writes). Trajectory capture is controlled by a workspace setting. You can turn it off in Settings, and capture stops for every project in that workspace.

We never sell trajectory data, and we never share one customer's trajectories with another customer.

What we never do

We do not sell your data. We do not share it with advertisers. We do not read your repositories outside of the runs you configure. We do not use your credentials for anything except operating the loop you turned on.

Third parties we rely on

We rely on a small set of subprocessors for source hosting, AI model access, payments, compute, storage, email, and error monitoring. Each one receives only what its function requires. The hosted-chat processors are OpenRouter, which routes a request to an admitted inference provider, and DeepInfra, which runs the inference.

Hosted chat

Hosted chat is optional. When it is enabled and your workspace owner allows model processing, Keelen pays for chat inference through OpenRouter and DeepInfra. We send a bounded portion of the conversation and relevant project context. This may include integration material you include in the conversation. Hosted chat is separate from coding runs that use your connected engine credentials.

Your workspace owner can choose deterministic-only chat. In that mode, chat content is not sent to the hosted chat model, including for summaries or evaluation. Submitting coding work can still use your separately configured coding engine. Turning model processing off stops new calls and attempts to cancel calls already in progress; data already transmitted cannot be recalled.

Hosted chat inference is restricted to routes admitted under US inference-location and zero-data-retention requirements. It stays unavailable without that evidence, and we do not promise a specific route in advance.

Retention and deletion

We keep your iteration history while your workspace is active, and we delete it when you delete your workspace. Your plan sets how far back the dashboard shows that history. That is a display limit, not a deletion schedule.

Some records are swept on a fixed timer today: audit-log entries after 90 days, scheduler decision records after 45 days, QA evidence artifacts after 14 days, and design-review artifacts after 14 days.

Revoking a credential deletes it immediately. Deleting a project soft-deletes its records. Deleting your account removes your personal data from live systems within 30 days, with two carve-outs: we keep billing records for as long as tax and legal duties require, and we keep aggregate product analytics with the identifiers removed.

Chat history expires after 90 days. Deleting a conversation removes its chat text and derived copies. It does not cancel submitted work or delete the submitted Request and required domain records. Minimal action receipts may remain separately. Keelen does not provide a separate long-term chat memory store.

To exercise access, correction, or deletion rights, email privacy@keelen.ai from your account address.

Cookies, analytics, and error monitoring

We use a session cookie to keep you signed in and first-party product analytics (page views and feature events) to improve the product.

Your browser also stores three first-party identifiers, and they are set on your first visit, before you sign up: keelen_anon_id in localStorage (a persistent pseudonymous device id), keelen_acq in localStorage (the first UTM parameters and referrer we saw), and a session id in sessionStorage.

We use the Sentry browser SDK for error monitoring. It sends exception reports through a tunnel on our own origin, so it is first-party traffic. We configure it to send no personal data by default, to sample 10 percent of performance traces, and to record no session replay.

There are no third-party advertising trackers and no session replay anywhere on the site.

Changes

If this policy changes in substance, we will notify account holders by email before the change takes effect.

Revision of 2026-10-03 (previous effective date 2026-09-11): we added the optional hosted-chat disclosure, the workspace owner's model-processing choice, and the chat retention and deletion terms. The coding-engine disclosures are otherwise unchanged.