Exactly what we collect
A plain-language table of every category of data Kiteloom collects, why, and for how long. This is the detail behind our Privacy Policy.
⚠️ Pre-release notice. Kiteloom is in pre-release. This page reflects exactly what the product collects today; see our Privacy Policy for the rights you have over it.
최종 업데이트 2026-08-06 · v1.0
What we collect
| Data | Collected | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Email address | At signup | Account identity, transactional email | Contract | Life of account + 30 days |
| Password hash | At signup | Authentication | Contract | Life of account |
| Display name | At signup / edit | Showing you to collaborators | Contract | Life of account |
| Google profile (ID, email, name, avatar) | If you use Google sign-in | Authentication | Contract | Life of account |
| 2FA secret + backup code hashes | If you enable two-factor authentication | Account security | Contract | Until you disable 2FA |
| Session records (device, IP address, last seen) | On sign-in | Security, session management | Legitimate interest | 30-day rolling window, capped at 90 days from creation |
| Board content (shapes, text, images) | As you create it | Providing the product | Contract | Life of board + 30-day trash window |
| Board metadata (name, timestamps, members) | As you create it | Providing the product | Contract | Life of board + 30-day trash window |
| Version history | Automatically, plus on manual checkpoint | Letting you restore earlier versions | Contract | 7 days on the free plan; unlimited on paid plans |
| Uploaded images | When you upload one to a board | Providing the product | Contract | Life of board + 30-day trash window |
| Audit log (auth and admin actions, IP, user agent) | Automatically | Security, fraud prevention, compliance | Legal obligation / legitimate interest | 400 days |
| Rate-limit counters | Automatically | Abuse prevention | Legitimate interest | Under 24 hours (rolling token-bucket windows) |
| Subscription and payment status | On purchase | Billing | Contract | Life of account; billing records kept per applicable tax law |
| Card details | Never — Paddle handles payment. We never see or store card data. | — | — | — |
| Error reports (Sentry) | When the app errors | Fixing bugs | Legitimate interest | Per Sentry's plan retention policy |
| Product analytics (PostHog) | Only with your consent, once analytics ships | Improving the product | Consent | Per PostHog's plan retention policy |
| Cookies | See the cookie table below | See the cookie table below | Consent / strictly necessary | See the cookie table below |
Cookies
A cookie is a small file a website stores in your browser. Here's every cookie Kiteloom sets, first-party or otherwise:
| Name | Category | Purpose | Expiry | Party |
|---|---|---|---|---|
| better-auth.session_token | Strictly necessary | Keeps you signed in | 30 days, refreshed on activity, capped at 90 days from sign-in | First-party |
| ph_<project_key>_posthog | Analytics | Product usage analytics — only set once you accept analytics cookies | 12 months | Third-party |
Strictly-necessary cookies can't be switched off — they're what keeps you signed in. Analytics cookies are opt-in only, through the cookie banner, and no analytics cookie is set unless you accept it there. You can change your choice at any time from the "Cookie settings" link in our footer.