Your work deserves
clear boundaries.

1. Who is responsible

Tervaq Inc operates Kivren and this website. Contact [email protected] for privacy questions, requests or concerns. Company information is available at tervaq.com. This notice applies to data Tervaq processes as part of Kivren; a connected provider’s own processing is governed by that provider’s notice.

2. Data we process

What Kivren processes depends on the features you use and what you choose to share.

• Account and sign-in: email address, account ID, display name, profile image where supplied, sign-in method, Google subject identifier when Google is used, session records, device enrollment and security events. We do not receive your Google password.
• Device and connection: device name, operating system and app version, connector/session identifiers, connection status, last-seen time, client/provider label, authorization state, expiry and revocation records. We do not need a full filesystem inventory to register a device.
• Project and collaboration: account and device relationships, room membership, agent identity and capability metadata, routing records, messages, selected files or artifacts, task/plan records, approvals, receipts and encrypted content needed to deliver the features you select.
• MCP and connector traffic: when you connect a computer or server, Kivren may process the request and result needed to route a tool call. Depending on the request, this can include command text, file paths, file contents, command output, error output, tool arguments, tool results and timestamps. This happens because you or an authorised connected client asked for it; Kivren does not scan your computer by default.
• Usage and billing: plan, request/tool-call counts, device or room counts, allowance events, timestamps, billing status and payment metadata when paid features are enabled. Payment-card details are handled by the payment processor rather than stored by Kivren where the processor supports that arrangement.
• Support and communications: messages you send to us, attachments you choose to include, survey responses and records needed to answer a request.
• Technical and security data: IP address, request time, browser or client details, coarse diagnostics, error events, rate-limit events and audit records used to operate and protect the Service.

3. What Kivren does not collect by default

Installing Kivren does not automatically upload your entire computer, unrelated folders, private IDE transcripts, provider passwords, API keys, browser cookies or private model history. The desktop daemon keeps local identity and permission material in the operating system and local profile according to the app’s implementation. A connected runtime can still send the specific file, command or result that an authorised client requests, so review a connection before using it with sensitive data.

We do not sell personal information. The landing page does not use advertising pixels or third-party analytics scripts. We may still use essential security, hosting, error and operational logs needed to run the site and Service.

4. Why we use data

• create and secure accounts, sign users in and link desktop and web sessions;
• register devices, route authenticated MCP/A2A traffic and deliver project messages;
• store and synchronise the project records, files and encrypted history you choose to use;
• show connection state, usage, plan entitlements, tool-call counts and service limits;
• send account, security, transactional and support messages you request;
• detect abuse, fraud, unauthorised access, service attacks and policy violations;
• debug, maintain and improve reliability, compatibility and accessibility; and
• comply with legal obligations, enforce our terms and protect users, Tervaq and others.

Depending on where you live, the relevant grounds may include providing the service you request, legitimate interests in operating and securing it, consent for an optional choice and compliance with law. We do not claim a specific privacy certification or a single legal regime for every user.

5. Content, encryption and visibility

Kivren is designed to keep deliberately shared room content separate from unrelated private work. Supported room flows use encryption for content in transit and storage; authorised recipients and the connected tools they choose may still decrypt, read, copy or retain content. The coordination service can process the metadata needed to route delivery, enforce membership, expire sessions, prevent replay, meter usage and protect the network. Metadata is not the same as a promise that traffic is anonymous.

MCP or connector traffic may follow a different path from encrypted room history. A requested command, file or result may be visible to the authorised connected chat or agent, its provider, the local runtime and Kivren’s gateway as necessary to complete the request. Do not use a connection for material you are not authorised to disclose.

6. Who receives data

• Authorised participants: people, agents and devices admitted to the relevant project or connection receive the content and metadata needed for that scope.
• Connected providers: ChatGPT, Claude, OpenRouter, IDEs or another provider may receive prompts, selected context, tool requests and results when you connect or use them. Their terms and notices apply separately.
• Service providers: Tervaq Cloud hosting and infrastructure providers process data on our instructions to host, route, store and secure Kivren. Our transactional email provider is currently Zoho ZeptoMail. Google processes the identity data required for Google sign-in. A payment processor such as Stripe may process billing data when paid checkout is enabled; paid checkout is not active in the current preview catalog.
• Legal and safety recipients: we may disclose information when reasonably required by law, legal process, security response or an emergency involving risk of harm, or to protect the rights and property of users and Tervaq.
• Business changes: if Tervaq undergoes a reorganisation, financing, acquisition or asset transfer, data may be transferred with appropriate safeguards and notice where required.

7. Cookies and local storage

The landing site uses essential browser behavior, such as navigation and downloads. The signed-in web app may use cookies, local storage or equivalent session storage to keep you signed in, remember presentation preferences, protect requests and support device pairing. We do not use those controls to create an advertising profile. Your browser, operating system and connected providers may set their own storage under their separate notices. Blocking essential storage can prevent sign-in or connection flows from working.

8. Retention and deletion

We keep data for as long as needed to provide the feature, maintain security, reconcile usage or billing, resolve disputes, meet legal obligations and preserve reliable audit or backup records. Retention varies by record. We do not promise a single fixed deletion period for every account, message, encrypted artifact, usage event or security log.

You can disconnect devices, revoke sessions, leave rooms, delete local data and close an account through available controls. Contact us to request access, correction or deletion of account-associated personal data. Deleting a local record does not delete a copy held by another authorised participant, erase immutable security evidence, recall a command or remove a provider’s copy. Encrypted backups may remain until their normal expiry and are not used to restore active access after account closure.

9. Your choices and rights

Depending on applicable law, you may have the right to request access, correction, deletion, portability or restriction of personal data, object to certain processing, withdraw consent where consent is the basis, or complain to a data-protection authority. You can also manage device connections, sign-in sessions, room membership, notifications and optional sync in the product where those controls are available. We may verify your identity and may retain information we must keep for security, legal or contractual reasons. Contact [email protected] with the subject “Kivren privacy request”.

10. Security

We use access controls, authenticated sessions, encryption where supported, scoped membership, rate limits, audit records and least-privilege service boundaries intended to protect Kivren. No online service, operating system, provider, package registry or local computer is perfectly secure. You are responsible for updating devices, protecting your accounts, reviewing connection scopes, keeping credentials private and revoking access when a device or session is no longer trusted. Report suspected security issues to [email protected] rather than including live secrets in a support message.

11. International processing

Tervaq, its infrastructure providers and connected providers may process information in countries other than where you live. The protections for an international transfer depend on the provider, the data, the destination and applicable law. By using a cross-device, cloud, MCP or provider connection, you understand that routing can cross borders. Ask us about a particular processing path before sending sensitive data.

12. Children

Kivren is intended for adults and professional or educational project work, not for children who are below the minimum age required to use an online service where they live. If you believe a child provided personal information without appropriate permission, contact us so we can review and delete it where required.

13. Changes to this notice

We may update this notice when Kivren, its providers or the law changes. We will update the effective date and give notice appropriate to a material change. The version shown on this page applies to processing after its effective date, subject to any rights or notice requirements that apply to you.