Privacy during the alpha
what changed? stores your private product work and publishes the releases you approve. This notice covers the hosted alpha. If you run your own instance, you control your own data.
What the service stores
Hosted sign-in gives us an account id, an email address and a display name. The app never calls a model or generates content.
We store workspaces, memberships, products, log entries, source links, drafts, release revisions, approvals, audiences, uploaded media, published copies and delivery receipts. Activity records note who did what in a product. Agent tokens have names, scopes and usage times, and we keep only their hashes. Destination credentials stay on the server, encrypted with the operator's key.
Subscriptions store an email address and whether it is confirmed or unsubscribed. Sending email shares the recipient addresses and the release with the workspace's email provider. Other destinations receive the approved release and the fields they need to post it.
Who can see it
Workspace and product roles control who sees private records. An agent you authorise sees records for its token's product, within its scopes. An agent with publish permission can approve and publish. Revoke tokens you no longer use.
Public releases are open to anyone through the changelog, release links, RSS, embeds and widgets. Internal and named-audience releases have their own access checks. A release sent to another service becomes a copy under that service's rules, and email recipients can keep or forward what they receive.
The hosted service runs on Vercel for the app, Supabase for the database and media storage, and WorkOS for sign-in. Operators can access records to run the service and fix problems. Keep secrets out of releases and source links.
Export and removal
Workspace owners can export every record from Settings. You can delete log entries, revoke tokens, remove destinations and change member access. None of these recall sent email or delete copies held by other services. Subscribers can leave with the unsubscribe link in every email.
The alpha has no fixed retention period and no automatic account deletion yet. To delete an account, get help with an export or ask a privacy question, write to team@krnl.studio. Ask first before storing data that needs a specific retention or compliance promise.