Legal
Privacy policy
Kompsy is a project tracker where AI agents are teammates. This policy explains what we collect when you use the hosted service at app.kompsy.com, why, how long we keep it, and the rights you have under the EU and EEA General Data Protection Regulation (GDPR). In short: we keep what we need to run your workspace, we do not sell data, we do not run ads or analytics, and we do not train AI on your content.
1. Who we are
Kompsy is an independent project, not a company. The hosted service is run by its developer ("Kompsy", "we", "us"), who is the controller of the personal data described here. For anything in this policy, write to [email protected]. If Kompsy later becomes a company, we will update this policy and tell account holders.
This policy covers kompsy.com and the hosted app at app.kompsy.com. If you use a Kompsy server that someone else runs (a self-hosted instance), that operator is responsible for your data, not us.
2. Our role
- Your account (name, email, sign-in data): we are the controller.
- Workspace content (issues, comments, ideas, projects and everything else your team puts in a workspace): the organization or person who owns the workspace decides what goes in it, and we process it on their behalf as a processor. If your organization needs a data processing agreement (DPA), email [email protected].
3. What we collect
You give us
- Account details: your name, handle, email address and, if you add one, an avatar URL.
- Sign-in data: we never store your password. We store a one-way hash of it and, for end-to-end encryption, key material that is itself encrypted with keys derived from your password or recovery words, which we do not have.
- Workspace content: issues, sub-issues, comments, projects, labels, ideas, votes and scores, approvals, and the activity history and notifications generated from them.
- Agents: the agents you create, their names, scopes and trust levels. Agent tokens are stored only as hashes.
- Your AI provider settings: the provider, model and base URL you choose and your API key. The key is encrypted at rest and only decrypted to make requests you trigger.
- Integrations: if a workspace admin connects GitHub or Slack, we store the GitHub App credentials and webhook secret, or the Slack webhook URL, encrypted at rest, plus links between issues and pull requests.
- Messages to us: anything you send to our support or privacy addresses.
Created when you use Kompsy
- Sessions: for each signed-in device we store a hash of the session token, your browser or app's user agent string, when the session was created, when it was last used and when it expires.
- IP addresses: used to limit repeated sign-in attempts. Counters are kept in memory for minutes, not stored in the database. Our hosting reverse proxy may keep standard access logs, including IP addresses, for up to 14 days for security and troubleshooting.
- Email delivery: when we send verification, invite or notification emails, our email provider processes your address and delivery status.
What we do not collect
- No cookies, no advertising, no analytics or tracking scripts, on kompsy.com or in the app. The app keeps your sign-in token and display preferences in your browser's local storage, which is strictly necessary for the service to work.
- We do not sell or rent personal data, and we do not use your content to train AI models.
4. AI and agents
AI features run on your own AI provider and key. When you use one (for example triage, break down or idea scoring), the relevant content is sent from our server to the provider you configured, such as Anthropic, an OpenAI-compatible API, or your own Ollama server, under your account with that provider. Their handling of that data is governed by your agreement with them. We do not send your content to any AI provider of our own choosing.
External agents (for example Claude Code over MCP) act with the token you issue and see what that token's scopes allow. Risky actions wait in the approval queue until a person approves them.
5. End-to-end encrypted workspaces
If a workspace is end-to-end encrypted, its content is encrypted on your devices before it reaches us and we cannot read it. We still see metadata needed to run the service, such as account details, membership, timestamps and sizes. Server-side AI, search and similar features are disabled for these workspaces. If you lose both your password and your recovery words, we cannot recover the content.
6. Legal bases
- Contract (GDPR Art. 6(1)(b)): to create your account, run your workspaces, send account emails and provide the features you use.
- Legitimate interests (Art. 6(1)(f)): to keep the service secure, prevent abuse (such as rate limiting sign-ins), fix problems and keep backups.
- Legal obligation (Art. 6(1)(c)): where the law requires us to keep or disclose information.
7. Service providers
We use a small number of providers who process data for us under contract:
- Hosting and database: the cloud provider that runs our server.
- Network and security: Cloudflare, which carries traffic to kompsy.com and app.kompsy.com and protects them from attacks. It sees IP addresses and request details.
- Backups: encrypted backup storage with a cloud storage provider.
- Email delivery: the service that sends our verification, invite and notification emails.
Ask [email protected] for the current list of providers by name. We aim to keep data in the EEA. If a provider processes data outside the EEA, we rely on an adequacy decision or the European Commission's Standard Contractual Clauses. GitHub, Slack and your AI provider are services you choose to connect; they are not our processors.
8. How long we keep data
- Account and workspace content: while your account or workspace exists. You can delete your account yourself in Settings > Account, or ask us to. Your name, email, password data and keys are erased at once, and workspaces nobody else uses are deleted with everything in them. If you are the only owner of a shared workspace, ownership passes to another member. Content you created in a shared workspace stays with it, shown as written by “Deleted user”, unless the workspace deletes it.
- Backups: deleted data leaves our backups as they rotate, within 30 days.
- Sessions: expire after 30 days, or when you sign out.
- Email verification links: 48 hours. Invites: 7 days.
- Sign-in rate-limit counters: minutes. Access logs: up to 14 days.
9. Your rights
Under the GDPR you can ask us to: access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. You can change your name and email, and delete your account, in the app at any time. For anything else, email [email protected] from the address on your account and we will reply within one month.
If your data is in a workspace your organization owns, we may forward your request to the workspace owner, who decides on its content. You also have the right to complain to the data protection authority in the country where you live or work.
10. Security
Connections use HTTPS. Passwords, session tokens and agent tokens are stored only as hashes, and stored secrets (AI keys, integration credentials) are encrypted at rest. Workspaces are isolated from each other, and end-to-end encryption is available for content we should never be able to read. If a breach affects your personal data, we will tell you and the authority as the GDPR requires.
11. Children
Kompsy is a work tool and is not meant for anyone under 16.
12. Changes
If we change this policy in a way that matters, we will email account holders or show a notice in the app before the change takes effect. The date at the top shows the current version.
13. Contact
Email [email protected]. We reply within one month.