Privacy policy

1. Your vault and connected tools

The app stores the project names and images, credential names and values, original files and previous versions, providers, account labels, notes, project/environment bindings, and recent activity that you put in its encrypted vault on your Mac. Device protection keys are kept in macOS Keychain. Backup status and your selected folder settings also remain on your Mac. Kohana does not receive or read these files or keys, and runs no Cellar accounts, remote vault service, Sentry, automatic usage analytics, or automatic error reports.

Your chosen cloud services and encrypted backups

In Backup & CLI settings, you can choose iCloud Drive, Google Drive, or another folder and turn off automatic backup. When iCloud Drive and iCloud Keychain are available, your Apple account stores and syncs encrypted backups and a recovery key. Apple may process service metadata such as file names, sizes, and timestamps. The app’s vault encryption is separate from Apple’s service protection; Apple’s policies govern your Apple account, sync, and service data. This feature does not give Kohana access to your Apple account or iCloud files.

The Google Drive option writes and verifies an encrypted .keydesk backup in an actual sync folder managed by Drive for desktop, which you install and sign in to yourself. Cellar does not use Google sign-in or the Drive API; this feature does not give Kohana access to your Google account or Drive files. A successful save does not confirm Google upload completion: check Sync status in Drive for desktop. The recovery key stays in iCloud Keychain or your separate safekeeping; the app does not store a plaintext recovery key in Google Drive. Google may process the encrypted file and service metadata such as file names, sizes, and timestamps under its own policies. You manage your Google account, sync, sharing, and cloud copies directly with Google.

CLI, MCP, and external APIs you approve

SDK, build, and CLI processes you approve receive the selected credentials or temporary key files and can read or transmit them. Supported API requests pass authentication and request content to the provider you approve. There is no remote relay run by Kohana. Review the connected tool’s and provider’s own privacy terms, and check the request before approving it when it includes personal information.

2. Support, bug reports, and updates

Support is used to handle the inquiry you request, reproduce and fix problems, reply, and follow up. Kohana receives the sender address, message, replies, and material you choose to send by email, or the account attribution, report content, and optional app/OS information you submit on GitHub. Received information is used for support, not advertising or the sale of contact lists. You can use the app without sending an inquiry. Necessary support in response to your request relies on Article 15(1)(4) of South Korea’s Personal Information Protection Act; we explain any processing that requires separate consent before it happens.

Bug reports are reviewed first

The in-app draft stays in memory on your Mac while you compose it. You write the title, reproduction steps, expected result, and actual result. Optional app version/build, macOS version, and architecture are off by default. The app does not automatically attach logs, paths, screenshots, keys, or vaults. When you choose Open GitHub draft after reviewing the full content, the title and body are passed to GitHub in a browser URL even before final submission. That URL may remain in browser history, sync, or service request records. A public issue is created only when you sign in and submit it yourself on GitHub; your account attribution and report then become public. The local filter for common secret patterns cannot detect every secret or piece of personal information.

Checking for updates

Checking for updates queries the official public GitHub releases API only when you press the button. The request includes no vault contents, credentials, account details, or installed version number. GitHub processes connection information such as your IP address and normal request headers. The app uses no login, authentication key, cookies, or saved session for this check and does not install updates automatically.

3. The website and cookies

Cellar’s own page code has no account registration, input forms, payments, advertising, or analytics scripts and does not accept uploads of API keys or files. Previews use fictional data. The site code does not save visitor information in cookies or local storage; language choice is reflected in the URL. The official site serves static files through Cloudflare Workers Static Assets without running a separate Worker server script. Hosting, CDN, and security services may process IP addresses, HTTP request URLs, headers and timestamps, browser information, and response status to serve pages and investigate malicious requests. The alternate ChatGPT Sites pages also use the hosting provider’s automatic visitor and page-view statistics. Provider processing is separate from the absence of analytics in Cellar’s own code.

Hosting security cookies

The official site currently does not use Cloudflare Bot Fight Mode. Hosting platform security checks and Cloudflare security on the alternate ChatGPT Sites pages may nevertheless use security cookies depending on the enabled features and request conditions. On pages protected by Bot Fight Mode or Bot Management, __cf_bm expires after 30 minutes of continuous inactivity. Security challenges may use separate cookies such as cf_clearance to remember that a challenge was passed. Cloudflare processes these cookies. You can delete or block cookies in your browser, but doing so may affect security checks or page access. Cellar’s site code adds no cookies for advertising or visitor tracking.

4. External services and international processing

Support email uses Gmail; code, downloads, and reports use GitHub; the official pages use Cloudflare Workers Static Assets, CDN, and security services; and the alternate pages use ChatGPT Sites. When you access these services or pass content to them, information is processed through their communication mechanisms, including HTTPS, and may be stored or processed outside South Korea. Kohana limits external support storage to what your requested support needs. International outsourcing or storage under Article 28-8(1)(3) of South Korea’s Personal Information Protection Act must be necessary to enter into or perform a contract with the data subject. All required details—data, countries, timing, methods, recipients and contacts, purposes and retention, and refusal procedures and effects—must also be published or notified as the law requires. A provider’s general policy or DPA does not by itself satisfy all these conditions. Your Apple and Google Drive accounts and approved API providers are separate services you use directly.

Support email: free personal Gmail

The support address uses free personal Gmail. Google LLC handles consumer Gmail information under its own terms and privacy policy and does not provide a consumer Gmail Data Processing Agreement. Kohana uses the reply address and inquiry content to provide support.

Deleted Gmail messages can remain in Trash for up to 30 days unless permanently deleted sooner. Google describes backend deletion generally taking around two months and encrypted backups retaining data for up to six months. Additional safe-deletion time, system delays, and security or legal retention exceptions mean this is not a universal maximum for all information. Recipient-held copies may remain separately.

Official website: Cloudflare

Cloudflare’s South Korea PIPA guidance says its Data Processing Addendum is incorporated into all customer service contracts. Cloudflare distinguishes entrusted data processed on customer instructions from its independent network and security processing. The official site has no separate server script that logs visitor requests and does not use Cloudflare Web Analytics. These settings do not remove Cloudflare’s own network and security records.

Cloudflare’s South Korea addendum lists the United States, United Kingdom, Singapore, Australia, Germany, Portugal, France, Japan, Canada, Netherlands, United Arab Emirates, India, Mexico, Malaysia, and Sweden as general recipient countries for Cloudflare and its subsidiaries. This does not mean every visitor’s information reaches all 15 countries or establish every processing country for a particular request or log.

The separate Developer Platform subprocessor table lists Google locations in the EEA, United States, Australia, and India, and Oracle locations in the United States, EEA, United Kingdom, Japan, Australia, Canada, and Singapore. This is a platform-wide disclosure, not confirmation that both providers or all these locations process this site’s static-file requests.

Alternate pages: ChatGPT Sites

Sites hosting has its own terms and applicable hosting data-processing addendum. OpenAI processes hosted visitor information on the operator’s behalf. For personal services, publishing and hosting a Site that processes personal data constitutes agreement to the Sites addendum. Its processing period covers service use and the time needed afterwards to perform obligations such as deletion, with legal-retention exceptions.

OpenAI’s official guide says Sites automatically records visitors, page views, and statistics over time without a separate analytics SDK. The absence of an analytics SDK added by Kohana to the app or page code does not mean the hosting provider performs no such statistical processing.

The countries and regions above describe providers’ general public disclosures. The reviewed public material does not establish every actual processing, storage, or access country for this support mailbox and these sites, or a retention day count for each log. A company address, general country list, or subprocessor list is not confirmation of the full set of actual transfer countries.

Providers retain connection and security records under their own policies for operation, security, and legal obligations. Public policies describe retention and deletion criteria, rather than a single verified day count for every record on this site. Kohana’s support retention period below applies to support material Kohana manages. It does not mean independent provider records or backups, or third-party copies of public content, are erased at the same time.

If you do not want to pass information to these overseas services, you can skip update checks, opening/submitting GitHub drafts, and support email. The vault’s basic local functions remain available, while update lookup and online support that depend on those services will be unavailable. You can stop visiting a hosted page if you do not want its hosting connection information processed. Turn off cloud backup in Cellar or choose a folder that is not synced, and manage Apple or Google sync and existing cloud copies separately in each service. Manage external API use through tool approvals.

Accounts you create directly with services such as GitHub, Apple, or Google Drive, and their own logging, security, and policy activities, fall within those services’ responsibilities. Kohana does not use personal information received in reports or inquiries for general advertising or separate third-party disclosure. If disclosure is required by law or another lawful basis, the applicable notices and protections will apply.

5. Retention and deletion

For private inquiries Kohana manages from this effective date, information is retained while the inquiry is handled and for up to 90 days after the final reply when needed for follow-up. Personal information that is no longer needed is deleted without delay before that limit. By the deadline, email, attachments, replies, and working copies within Kohana’s control are permanently deleted, including copies remaining in Trash. Technical information with personal information removed may be kept as a problem-resolution record. Where a legal retention duty actually applies, we separate its basis, information, and period, retain it only for that purpose, and explain it to the requester.

Public GitHub history

Public technical records such as reproduction steps and fixes, without personal information, may be kept as project history. Account attribution and content of public reports also remain on GitHub. Within 90 days after handling the inquiry or issue, unnecessary personal information is removed or anonymized within the operator’s control; verified deletion requests are reviewed sooner. If account attribution cannot be removed, we consider available measures such as deleting the issue. GitHub’s own records, search caches, and third-party copies may require separate service deletion procedures because the operator cannot erase them all.

Deleting your vault and backups

You manage retention and deletion of local information. Closing the report sheet clears the in-app draft, but not its browser URL or history. Deleting a credential does not revoke it at the provider or remove it from earlier backups. Uninstalling the app does not remove all macOS Keychain items, support files, or iCloud, Google Drive, or manual backups. Before ending use, check the recovery and backups you need, then manage the relevant Mac files, Keychain items, and cloud copies separately. After a successful backup save, the managed folder retains the newest authenticated backup for each of the latest seven distinct UTC dates and four distinct UTC weeks for that vault, pruning the other managed copies. This is not a rule that erases every copy after seven days or four weeks. Manual copies and backups outside the managed folder are not automatically pruned.

6. Exercising your privacy rights

You can email requests for applicable rights concerning information Kohana manages, including access, correction, deletion, restriction of processing, and withdrawal of consent. We verify the request and act without delay within applicable legal time limits, explaining any restriction permitted by law. Exercising a right or declining an optional report does not limit use of the basic local app.

We may verify identity or authority using the minimum necessary method, such as control of the email or relevant GitHub account. Do not send identity documents, national identification numbers, recovery codes, or key files with the initial request. You may act through an authorized representative; any necessary verification is explained separately.

Kohana cannot access or delete your local vault; manage it on your Mac. For external services’ independent accounts and connection records, use their privacy contact routes in the table above. The authorities below provide information on privacy complaints and disputes.

7. Children’s information

Cellar has no account feature that asks for age or birth date and does not automatically verify age. We operate no support procedure that requests personal information from children under 14. If we become aware that support contains a child’s personal information, we remove unnecessary information. Where consent is legally needed to continue processing, we obtain and verify a legal representative’s consent first. A guardian can use the email above for deletion and rights requests.

8. Safeguards

The app uses vault encryption, macOS Keychain, and tool connections that you approve. Support uses minimal material and does not request secrets in public reports. The website and official external links use HTTPS. These measures do not prevent every leak, compromised device, or malicious approved tool; we do not claim completion of an independent security audit or recovery verification on every Mac. Use private vulnerability reporting for security problems instead of public issues.

9. Policy changes

If processing or services change, we update this page and its effective date and describe material changes in the relevant notices and release notes. Where new processing requires separate consent, we explain it and obtain the required consent first. This policy does not limit your statutory privacy rights.