Privacy
Effective · 2026-09-11
BeM (sole proprietor: Taehyun Hwang) (the "Operator") runs Kallimachos (the "Service") and publishes this policy under Article 30 of the Personal Information Protection Act of Korea.
Article 1 — What we collect, and how
- Account — your email address, given by you through the email sign-in link or Google sign-in. With Google sign-in we also receive whether Google has verified the address, and your Google account identifier (the
subvalue), which links the Google account to your account. - Usage records — when the account was created, when sessions were created, the name / creation time / last-used time of credentials (tokens), the optional first-run answers (what you do, how you heard of us), the number of remote MCP tool calls your account made in each month, and which account notice emails were sent to you (the kind of notice and the month).
- Device sign-in requests — when a device asks to sign in with a code: the device name, the client IP address and the time of the request. Deleted within an hour after the code expires; an approved code is deleted when it is used.
- Knowledge data — the search index and knowledge graph you build on your own machine and upload: Entity names and descriptions · Relations between entities · Chunk text used for search (parts of notes not marked no_llm) · Document paths relative to your vault, and titles · If you connect a GitHub repository: a copy of the whole repository at its latest commit (attachments and no_llm notes included), kept to rebuild your index; the search graph leaves out the text, paths and titles of no_llm notes · If you turn on the desktop session archive: your Claude Code and Codex session logs, secret-masked by default and encrypted on your device — the server sees only account and pack identifiers, sizes, counts and times · Photos and videos you push: thumbnails and view copies (camera metadata removed, except GIFs), originals unless you turn them off (stored as they are, location included), capture date, file name and path, text read from pictures, and which entities and notes each one is linked to. Because it is extracted from your notes it can contain the content of your notes themselves. The server stores it and returns it as search results to your own AI clients.
- Billing — subscription status and period, the amount, tax and currency of each payment and of any refund or adjustment to it, the reference numbers issued by the payment processor, and refund follow-up records (described in Article 3). Card numbers and other billing details are collected directly by the payment provider (Paddle) on its own checkout page, under its own privacy notice; the Operator never receives or stores them.
- GitHub — only if you connect GitHub: your GitHub account number and the GitHub app-installation number.
- Automatically — server access logs. Logs are kept by the front web server; for the marketing site (
https://kallimachos.dev) and the app server (https://app.kallimachos.dev) it records IP address, request path, time and processing time, and is configured to drop the query string (sign-in tokens live there). The MCP server (https://mcp.kallimachos.dev) records not even the path, because the path itself is the secret. When a request is rejected as malformed, only the IP, time and status are recorded — never the request line. Separately, the MCP application writes one line per request recording the HTTP method, response status and processing time — no URL, no IP, no query content. When a request fails, and on some process events (for example, when your graph is reloaded), the MCP application also writes a line that includes the internal account identifier (in full or its first 8 characters). If the search process it runs for your account writes a line to its normal output that is not a protocol message, only the length of that line in bytes is recorded, not its content. It also copies into the same log everything the search process it runs for your account writes to its error output (stderr), whenever that process writes it. The API application (https://app.kallimachos.dev) also writes log lines that include internal account identifiers.
What is never uploaded — A mirror of your whole vault folder — unless you connect a GitHub repository (above) · Your raw agent conversations in readable form — only the summarized documents, or the encrypted archive above · Any LLM call on the server — extraction runs on your machine. The Service uses no advertising or analytics trackers and never calls an LLM on the server.
Kept on your computer — the desktop app keeps, on your computer, a list of the session files it has uploaded, so it does not re-read unchanged files. For each session the list records its identifier, which tool it came from, which scanned folder it came from, its path, size and modification time, and the fingerprints of the pieces of each session (a hash of each piece’s content). The list also records the version tag the server gave for its copy of the list, a cache tag made of the app version and whether secret masking was on, and it keeps the lines of sessions already deleted from your computer while their pieces are still on the server. In the same folder the app also keeps its settings (including the sign-in token), the key that encrypts your session archive, a device identifier, the lists of pieces and graph snapshots it has uploaded, and its schedule state.
Notes marked no_llm — Notes marked no_llm (in their frontmatter, or by folder with KAL_NO_LLM) are never sent to an LLM, and their passages are left out of the upload. The no_llm mark takes effect when your notes are next indexed; a KAL_NO_LLM folder is also checked again at every push. If a note was extracted before you marked it, the entity and relation text already drawn from it is still uploaded until the next extraction; the server withholds it when answering.
Article 2 — Why
- Identifying your account, signing you in, sending sign-in links
- Service notices about your own account — your free trial ending, or the free plan's monthly limit being nearly or fully used
- Storing your knowledge data and serving it to your own AI clients
- Managing the subscription, billing, and VAT reporting
- Keeping the Service stable and secure — abuse prevention (including stopping the free trial from being restarted with the same address), incident analysis
- Meeting legal obligations
Article 3 — How long
| Data | Retention |
|---|---|
| Account · usage records · knowledge data · credentials | Erased immediately when you delete the account — and only then. Cancelling a subscription or the end of the free trial moves you to the free Hobby plan: nothing is erased, the knowledge data stays reachable within Hobby's limits, and no timer erases it later. |
| A one-way hash of your email address and the end date of your free Cloud trial | Kept after you delete the account, so that signing up again with the same address does not start a new trial. Erased one year after that trial ended. This record holds no email address. |
| If the payment provider created a customer record for you (a payment, or a checkout you started and left): its customer number, with a one-way hash of your email address | Kept after you delete the account, so that payment notifications arriving late are recognized as belonging to a deleted account and are not attached to anyone else — and so that a purchase is recognized if you sign up again with the same address. The hash is erased one year after deletion; the bare customer number stays, with no link to you in our database, so later notifications keep being ignored. The provider (Paddle) can match that number to its own records. |
| If you revoked Kallimachos' access on GitHub, or removed a repository from its GitHub app: your GitHub account number, the app-installation number, a one-way hash identifying the removed repository, and for older revocations our internal account number (numbers and hashes only, no name or email) | Kept with no end date, so that access you revoked on GitHub can never be restored from an old authorization. The record itself holds no email; while your account exists it stays associated with it, and after deletion nothing links it to you in our database. |
| Subscription numbers from the payment provider, with the time of the latest notification about each (kept in a separate list, apart from your account) | Each entry is erased 400 days after the latest notification about that subscription, whether or not the account still exists. 400 days is longer than a yearly subscription period, so an old, delayed notification cannot switch a subscription back on. While your account exists, your subscription itself is part of the account and is erased with it. |
| A random account identifier (no email, no content) | Kept after you delete the account, only so that the account is erased again if a disaster-recovery copy is ever restored. |
| An invitation for your address, if an administrator added one | Kept until the administrator removes it — it belongs to the invitation list, not to your account. |
| Sign-in links | Valid 15 minutes; deleted about 24 hours after expiry (at most 25 hours), by a cleanup that runs every hour |
| Sessions | 30 days, or on log-out |
| Server access logs and application logs (including the account identifiers in API and MCP log lines) | Up to 90 days |
| Device sign-in requests | Deleted within an hour after the code expires; an approved code is deleted when it is used |
| Disaster-recovery copies | Each copy is deleted once it is older than 30 days. A copy made before you deleted your account still contains your data until that copy is deleted. If such a copy is ever restored, your account is deleted again before the server accepts any requests. This applies to the copies only; live data is erased only on account deletion (see the first row). |
| Refund follow-up records — created when deleting an account, or a payment that arrives after deletion, may need a refund: the payment provider’s subscription or transaction number, our random account identifier (no email), the reason, the end of the paid period or the time of the payment (and, for a payment that arrived after deletion, its amount, currency and plan period), and when the Operator handled it | Kept until 5 years after the Operator handled it. A record not yet handled is kept until it is handled. |
| Contract, withdrawal and payment records | While your account exists, your billing history is part of the account. After deletion, 5 years from each payment — Act on Consumer Protection in Electronic Commerce, Art. 6 and Enforcement Decree Art. 6. When you delete the account, each payment, with any refund or adjustment to it, is kept only as a reduced record — amount, tax, currency, plan period, status, refunded amount, date, and the payment provider's transaction number — with no link to your account or email in our database, and erased when its 5 years end. Refunds and other adjustments are also recorded separately (adjustment number, transaction number, kind, status, amount, time), with no account link, and erased 5 years after their last update. The transaction number lets the payment provider (Paddle, the merchant of record) find the original transaction, including the billing details it holds; that is the point of keeping it. |
Article 4 — Sharing with third parties
The Operator does not provide your personal data to third parties, except as listed below, where a law requires it, or where you separately consent.
| Recipient | Paddle (Paddle.com Market Ltd) |
|---|---|
| Why this is a provision, not processing on our behalf | Paddle sells the subscription to you as merchant of record: you enter into the purchase with Paddle, and Paddle uses the data for its own obligations (tax, fraud prevention, its own record keeping). It is listed here, not in Article 5. |
| Data items provided | Email address; your Kallimachos account identifier (sent with checkout); after a checkout, the customer number Paddle issued to you (sent by Paddle's script, which the billing page loads to show prices); plan, price, tax and currency of each payment; the billing details you type into Paddle's checkout (entered on Paddle's page, not sent through us) |
| When | Over the network (TLS), when you open checkout, pay, or a subscription renews. When you delete your account, your email address is sent to Paddle to find and cancel any subscription, only if Paddle has, or had, a record connected to you:
|
| Recipient's contact | privacy@paddle.com |
| Recipient's purpose | Taking payment as merchant of record, issuing receipts, tax reporting |
| Recipient's retention | Under Paddle's own privacy notice (paddle.com/legal/privacy). Paddle states that it keeps certain transaction data for five years to meet its legal obligations |
| Legal basis | Your email address and Kallimachos account identifier are provided at checkout on the basis of your consent (Personal Information Protection Act, Article 17(1)1), given with the checkbox on the billing page before checkout opens. Without it, checkout does not open. Before your first consent, what reaches Paddle is only what your browser sends when the billing page loads Paddle's script to show prices in your currency: your IP address, browser information, and, when known, the country used for the price. Your email address and account identifier are sent only after you consent. After a checkout, Paddle has issued you a customer number; from then on, when the billing page loads Paddle's script to show prices, the script also sends that number to Paddle. When you delete your account, your email address is sent to Paddle only if our records show that Paddle has, or had, a record connected to this account or to this email address (including a record kept from an account deleted earlier), or that you opened a checkout window; it is sent to find and cancel a subscription and stop further charges, to carry out your deletion request. |
| Refusing | Do not open checkout. Without it you cannot buy Cloud; Hobby and the free trial do not involve Paddle unless you open checkout or your email address was used with Paddle before. |
Article 5 — Processors
| Processor | Task |
|---|---|
| Hostinger (United States) | Server operation and data storage |
| Resend | Delivery of sign-in link emails and the account notices in Article 2 |
| Google LLC | Google sign-in — only if you choose it |
Article 6 — Cross-border transfer
Personal data is transferred to the recipients below, all outside Korea. For each one, this policy discloses the items required by Article 28-8(2) of the Act, as permitted by Article 28-8(1)3(a).
| Required disclosure (Art. 28-8(2)) | Hostinger |
|---|---|
| 1. Data items transferred | Everything in Article 1 |
| 2. Country, timing and method | United States · Whenever you use the Service — over the network (TLS) |
| 3. Recipient's name and contact | Hostinger · gdpr@hostinger.com |
| 4. Recipient's purpose and retention | Running the servers and storing the data, for the purposes in Article 2 · The periods in Article 3 |
| 5. How to refuse the transfer, and what refusing means | Because the servers are there, refusing means the cloud service cannot be used: tell us at thbeem94@gmail.com, delete the account and use the free self-host build, and nothing is transferred. |
| Required disclosure (Art. 28-8(2)) | Paddle (Paddle.com Market Ltd) |
|---|---|
| 1. Data items transferred | Email address; your Kallimachos account identifier (sent with checkout); after a checkout, the customer number Paddle issued to you (sent by Paddle's script, which the billing page loads to show prices); plan, price, tax and currency of each payment; the billing details you type into Paddle's checkout (entered on Paddle's page, not sent through us) |
| 2. Country, timing and method | United Kingdom · United States · Over the network (TLS), when you open checkout, pay, or a subscription renews. When you delete your account, your email address is sent to Paddle to find and cancel any subscription, only if Paddle has, or had, a record connected to you:
|
| 3. Recipient's name and contact | Paddle (Paddle.com Market Ltd) · privacy@paddle.com |
| 4. Recipient's purpose and retention | Taking payment as merchant of record, issuing receipts, tax reporting · Under Paddle's own privacy notice (paddle.com/legal/privacy). Paddle states that it keeps certain transaction data for five years to meet its legal obligations |
| 5. How to refuse the transfer, and what refusing means | Do not open checkout. Without it you cannot buy Cloud; Hobby and the free trial do not involve Paddle unless you open checkout or your email address was used with Paddle before. |
| Required disclosure (Art. 28-8(2)) | Resend |
|---|---|
| 1. Data items transferred | Email address, and the text of the email (a sign-in link, or an account notice from Article 2) |
| 2. Country, timing and method | United States · Each time one of those emails is sent — over the network (TLS) |
| 3. Recipient's name and contact | Resend · [settled before launch] |
| 4. Recipient's purpose and retention | Delivering those emails · [settled before launch] |
| 5. How to refuse the transfer, and what refusing means | Sign in with Google instead of the email link. Account notice emails cannot be turned off separately, so refusing those means deleting the account. |
| Required disclosure (Art. 28-8(2)) | Google LLC |
|---|---|
| 1. Data items transferred | Your email address and Google account identifier, exchanged during Google sign-in |
| 2. Country, timing and method | United States · Only when you choose Google sign-in — over the network (TLS) |
| 3. Recipient's name and contact | Google LLC · https://policies.google.com/privacy |
| 4. Recipient's purpose and retention | Signing you in with your Google account · [settled before launch] |
| 5. How to refuse the transfer, and what refusing means | Use the email sign-in link instead; then nothing goes to Google. |
Article 7 — Your rights
- Access — account details are in the account menu; the home screen shows the size of the uploaded knowledge data. The original of that data is on your own machine.
- Erasure — account menu → "Delete account". The server first cancels any Paddle subscription — if that fails, nothing is deleted and you are asked to try again; then it erases the graph, the session archive, photos and videos, and repository copies; then it erases the account, sessions, credentials and the subscription record. If erasing that data fails after the subscription was canceled, the account remains with its subscription already canceled, and deleting again continues from there. To find a subscription to cancel, the server sends your email address to Paddle only if Paddle has, or had, a record connected to you: a Paddle customer record for this account or for your email address (including one kept from a deleted account), a Paddle subscription or payment for this account, or a checkout window you opened. Deleting the account ends Cloud immediately. The Operator then issues a refund: a yearly subscription is refunded for the unused full months, and a deletion within the 7-day withdrawal window is refunded as a withdrawal unless withdrawal is limited as described in Article 8 of the Terms. Only the records listed in Article 3 as kept after deletion remain — the reduced payment records, refund follow-up records and the trial record among them — and none of them holds your knowledge data.
- Correction, suspension and anything else — thbeem94@gmail.com. We act without delay and tell you the result.
- Children under 14 may not use the Service and we do not knowingly collect their data.
Article 8 — Erasure
When a retention period ends or the purpose is fulfilled, data is erased without delay, in a way that cannot be recovered. No paper records are kept.
Article 9 — Security
- Encryption in transit (TLS)
- Sign-in links, sessions and credentials are stored only as hashes — a leaked database cannot be used to sign in
- Session cookies are HttpOnly · Secure · SameSite
- Storage isolated per user; access limited to the Operator
- Access logs kept and reviewed
Article 10 — Cookies and browser storage
| Name | Purpose | Lifetime |
|---|---|---|
kal_session | Keeps you signed in | 30 days or log-out |
kal_oauth | Forgery protection during Google sign-in | 10 minutes |
kal.lang (localStorage) | Display language | Until you clear it |
kal.next · kal.plan (sessionStorage) | Where to return after sign-in | Until the tab closes |
No tracking or advertising cookies. If your browser rejects cookies you cannot stay signed in.
Article 11 — Data protection officer
BeM (sole proprietor: Taehyun Hwang) · thbeem94@gmail.com
Article 12 — Remedies
- Personal Information Infringement Report Center (KISA) — 118 · privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee — 1833-6972 · kopico.go.kr
- Supreme Prosecutors' Office — 1301 · National Police Agency — 182
Article 13 — Changes
Changes are posted on this page 7 days before they take effect. Material changes — new data items or purposes — are also sent to your account email.
Article 14 — Operator
BeM (sole proprietor: Taehyun Hwang) · Business Registration No. 628-26-01466 (Republic of Korea) · Mail-order Business Registration: [settled before launch] · Unit 3502, Bldg 102, 190 Simin-daero, Dongan-gu, Anyang-si, Gyeonggi-do, Republic of Korea · thbeem94@gmail.com
← Home