Krayton

Privacy Policy

Last updated: October 2026

This notice covers the Krayton website, desktop app and account service. The person responsible for Krayton account data is Oussama Hadji, an individual based in Algeria. For privacy questions or requests, email kraytonsoftware@gmail.com. Paddle separately handles payment information as the seller at checkout; see Paddle’s Privacy Notice.

In short: your Krayton workspace data is stored on your device. Our server handles account sign-in, subscription status and device licensing. When you choose an external AI service, your app may send the content needed for that request to that service. Paddle collects payment details; we do not receive card numbers.

1. Data kept on your device

The desktop app stores chats, project references, settings and configured credentials locally. We do not host a copy of your workspace through the Krayton account service. Your use of third-party coding agents, model APIs or gateways may send prompts, files or code directly from your computer to those providers under their own privacy policies. Review their settings before sending sensitive content.

2. Data our account service handles

Identity and sign-in: email address, whether it was verified, the selected sign-in method and account timestamps. If you choose email/password, we store a salted password hash, never the password itself. For Google sign-in, we use Google’s verified email; we do not receive your Google password.
Billing status: Paddle customer and subscription identifiers, product/price identifiers, subscription status, scheduled cancellation and timestamps sent in Paddle webhooks. Paddle handles card details, checkout taxes, receipts and invoices.
Device licensing: a one-way hash derived from your computer’s machine identifier, a device label based on its user agent, registration time and license information. The raw operating-system machine identifier is not sent to our server.
Security and support: session tokens, short-lived verification and Google sign-in state, IP address and basic request or error information used to protect and troubleshoot the service, plus messages you send to support.

3. Why we use it

We use account and billing status to create your account, authenticate you, provide subscribed features, manage devices and answer support requests. We use limited technical data to prevent abuse and diagnose failures. Where a legal basis is required, account and license processing supports our contract with you; security and support rely on legitimate interests; and information required by law is processed to meet legal obligations. Google sign-in is your optional choice; you can instead create an email account.

4. Cookies and checkout

The account site uses an essential, HTTP-only session cookie to keep you signed in. It normally expires after 30 days unless you sign out earlier. A short-lived cookie protects the Google sign-in flow. Paddle Checkout may set its own cookies and process payment and location information to show your final amount and collect payment. We do not run advertising cookies on the Krayton account service.

The public website uses Cloudflare Web Analytics to measure page views, referring websites and page performance. Cloudflare receives technical information from your browser to provide these reports. This analytics service does not use cookies or local storage to collect usage metrics and does not fingerprint visitors. It is not installed in the desktop app or on account and payment pages. See Cloudflare’s Web Analytics description.

5. Who receives information

Paddle: your checkout, payment, customer and subscription details as merchant of record; see its privacy notice.
Google: authentication information only when you choose Google sign-in.
Resend or our configured email provider: your email address and verification message when you register by email.
Hosting provider: the infrastructure that stores and backs up the Krayton account database.
Cloudflare: public website usage and performance measurements through Web Analytics.
Authorities: information when legally required.

We do not sell personal data or use it for targeted advertising. External AI providers you choose are separate services and may receive workspace content directly from your app.

6. Storage and retention

We keep account, subscription and registered-device records while needed to provide the service or resolve a billing or support matter. Sign-in sessions stop working after their expiry or sign-out. Verification and Google sign-in challenges expire after about 10 minutes. Database backups are rotated, so deleted information may remain in a backup for a limited period. Paddle keeps its own transaction records under its separate policies and legal duties.

7. Your choices and rights

You can sign out and remove devices from your account page. To ask for access, correction or deletion of account information, or to object to or restrict processing, email kraytonsoftware@gmail.com from your account email. We may verify your identity and may need to retain information needed for legal claims or required records. Deleting Krayton account data does not automatically cancel a Paddle subscription; cancel it first using your account page or Paddle’s customer portal. You can contact your local data protection authority where the law gives you that right.

8. International use and security

Customers may be in many countries, and our providers may process information outside your country. Where required, we use applicable transfer protections. We use HTTPS for account traffic, password hashing, limited device identifiers and signed licenses. No internet service can guarantee absolute security.

9. Children, changes and contact

Krayton is for people old enough to enter a binding contract where they live and is not directed to children. We may update this notice as the service changes; the date above identifies the current version. Send privacy questions or requests to kraytonsoftware@gmail.com.