Privacy notice
Effective 8 September 2026. Version 2.
Scope and responsibility
This notice describes the repository’s observable data flows. iQit BV, trading as Kanzai, is the controller for the processing described here. Its address is Uilenstraat 73, 9100 Sint-Niklaas, Belgium. Write to privacy@kanzai.io about your data. No telemetry does not mean no data processing. This notice is information, not a request for blanket consent.
Website, downloads and updates
Website visits request HTML, CSS, images and locally hosted fonts. No analytics script, contact form or third-party font service is present in the reviewed site. Requests reveal an IP address and request information to the hosting infrastructure. The site is an Amazon S3 bucket in eu-west-1 behind CloudFront. The Terraform turns on no S3 or CloudFront access logging. CloudFront serves the site from edge locations worldwide.
Kanzai requests https://kanzai.io/updates/latest.json at launch and when you manually check for updates. The configured URL has no project, license key or user identifier in it. Network requests still expose connection and HTTP metadata. If you choose to install, the updater requests the artifact URL in the feed. The release workflow publishes artifacts to the site’s updates path.
Licensing and purchases
When you paste a non-KZ1 key, Kanzai sends the key, organization identifier and a machine name to Polar’s license activation API. On macOS that machine name is the Mac computer name. On Windows and Linux Kanzai has no name to read, so it sends “Kanzai”. A Mac whose name is unavailable is sent as “Kanzai” too. Validation sends the key, organization identifier and the cached activation identifier when present. Polar also receives connection metadata. Successful validation is reused for fourteen days. A KZ1 key is verified locally and is not sent to Polar.
The local license.key file contains your key. The checked.json cache contains the key, activation identifier and check time. The seen file contains the last clock mark. The cache validity period is not a deletion deadline: stale records are retained to support later validation. These local files have no automatic retention limit in the reviewed code. The default locations are ~/.kanzai and ~/Library/Application Support/dev.kanzai.desktop. Changing the Kanzai home changes the key’s location.
Checkout and the customer portal are hosted by Polar. They process purchase, contact, billing and payment information under Polar’s privacy policy. The desktop license calls do not send payment-card details. Polar identifies payment providers and other recipients in its policy and legal documents. In Polar’s dashboard the supplier can see the order, the customer name and email, and the key’s activation state. Those records stay visible for as long as the order record exists in Polar.
Projects and agent providers
Boards, paths, worktrees, event logs and transcripts are stored locally. Kanzai launches the Claude Code or Codex tools selected by you. Those tools can send prompts, repository contents, file excerpts, command output and conversation history to their configured providers and connected tools. Standard providers include Anthropic and OpenAI; custom configurations can change recipients. Git remotes, MCP servers and commands can send data to further destinations. The licensing and update paths do not upload your project contents.
Kanzai uses local provider authentication. Its Codex home links to the user’s Codex authentication file. Kanzai does not promise that agents process everything locally or that providers never retain or train on data. Provider terms, account type and settings govern those practices. Verify each configured provider’s current privacy terms before sending personal or confidential information. Local transcripts and task records may persist until you remove them; provider-side retention is separate.
Support
If you contact support, your address, message, attachments and order reference may be processed to answer the request. Do not include secrets or unrelated personal data. Support mail goes to support@kanzai.io. It stays in the supplier’s mailbox. Support mail is kept for two years after the last message in the thread, then deleted.
Purposes, legal bases, transfers and retention
Kanzai processes data to deliver the website and downloads, to administer licenses and purchases, to answer support, to maintain security and to meet legal duties. Contract is the legal basis for licenses, purchases and support. Legitimate interest is the legal basis for serving and securing the website. Legal obligation is the legal basis for the records Polar keeps as merchant of record.
The recipients are the AWS hosting, Polar, and the agent providers you configure. Local files stay on your machine until you delete them. Polar keeps its own records under Polar’s privacy policy; that policy also describes Polar’s transfers and safeguards. Support mail is kept for two years after the last message in the thread, then deleted.
Your choices and rights
You can use the free tier without a Polar key, choose which providers and repositories to connect, decline update installation and remove local data. Deleting a local key or uninstalling the app does not erase Polar records, provider records, or cancel billing. Check for ongoing task agents before deleting worktrees. On macOS and Linux an agent can still be running after you quit Kanzai. On Windows none can, because the app owns each agent’s process.
Where applicable, you may request access, correction, deletion, restriction, portability or object to processing, and withdraw consent for consent-based processing. You may complain to your competent supervisory authority. Write to privacy@kanzai.io to make a request. The responsible supervisory authority is the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels. Its website is dataprotectionauthority.be. Direct Polar requests to the contact in its privacy policy. Requests concerning agent-provider records should also go to the relevant provider. No automated legal or similarly significant decision-making by Kanzai is identified in the reviewed licensing and update flows.
See the sources these documents rest on.