Privacy Policy

Effective 15 September 2026 · Contact: hello@joinkord.com

Kord is a local-first desktop application: it runs on your computer and orchestrates AI coding tools you have installed and signed into yourself. This policy explains the small amount of data the Kord account service collects, why, and what never leaves your machine.

What stays on your computer

• Your provider accounts and credentials. Sign-ins to ChatGPT/Codex, Claude Code, Cursor, and any API keys you paste are stored by those tools or in your operating system's keychain, on your machine. They are never transmitted to Kord's servers.
• Your conversations and code. Prompts, responses, files, and project contents are exchanged directly between your machine and your chosen AI providers. Kord's servers never see them.
• Usage of the app. Kord contains no analytics or tracking. We do not collect telemetry about how you use the app.

Applying to the closed beta

To submit a closed-beta application you provide a valid invitation code and an email address. We store the address, the invitation record, the date of application, its status, and — if you arrived from a tagged link — a short campaign tag naming the post or channel that sent you. We use this information only to operate the closed beta and contact you about your application or participation. We do not send unrelated marketing email, and the address is not shared with anyone.

Checking an invitation does not consume it. An invalid email does not create an application or consume the invitation. Applying is separate from a Kord account and does not itself grant access. To withdraw an application or be removed from the beta list, email hello@joinkord.com.

What the Kord account service collects

If you create a Kord account (needed for the trial and paid plans), our account service at api.joinkord.com stores:

• Email address — your account identity, used to sign you in and to send sign-in codes.
• Display name and profile picture — optional; the picture is only ever received from Google if you choose "Continue with Google", and the name can be set or cleared by you at any time.
• Device records — a random device identifier generated on your machine (not a hardware serial) and the device name, used to enforce the per-account device limit.
• Plan state — your trial dates, current plan, and, if you press "Notify me", which plan you asked to hear about.

That is the complete list. There are no advertising identifiers, no behavioural profiles, and we do not sell or share personal data for advertising.

Sign-in with Google

If you use Google sign-in, Google tells us your email address, name, and profile picture, and confirms the email is verified. We use this information only to create and identify your Kord account, consistent with the Google API Services User Data Policy, including its Limited Use requirements. We never receive your Google password.

Service providers

• Cloudflare — hosts the account service and this website; account data is stored in Cloudflare's D1 database on Cloudflare's global network.
• Resend — delivers sign-in code emails on our behalf.
• Google — only if you choose Google sign-in, as described above.

These providers process data only to provide their service to us. When we add paid checkout, payments will be processed by a merchant of record; your card details will go to them directly and never touch Kord's servers. This policy will be updated to name them before checkout opens.

International transfers

Kord is operated from Türkiye and our service providers store data on infrastructure that may be located in other countries, including the United States and the European Union. We rely on our providers' standard safeguards for these transfers.

Retention and deletion

Account data is kept for as long as your account exists. To delete your account and its data, email hello@joinkord.com from the account's address; we will delete it within 30 days, except records we must keep for legal or accounting reasons. Signing out of the app removes the session from your machine at any time.

Closed-beta application addresses are kept while the beta operates and are deleted within 90 days after it closes, or sooner on request.

Your rights

Depending on where you live (including under the GDPR and Türkiye's KVKK), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict processing. Write to hello@joinkord.com and we will respond. You may also complain to your local data-protection authority.

Children

Kord is not directed at children under 16, and we do not knowingly collect their data.

Changes

If this policy changes materially, we will note the new effective date here and, for significant changes, notify account holders by email.

joinkord.com · Terms of Service · Privacy Policy · Font licences