Privacy Policy

In short

We collect account and operational information needed to provide and protect the Service. Kunkafa's website and app show one cookie notice, and it must be accepted to use Kunkafa; analytics start only after you accept. Nothing is used for advertising or shared with advertisers.

1. What we collect

• Account: Your email address and sign-in information, handled through Firebase Authentication.
• Plan and billing: your plan and its status. Stripe processes payments and holds card details; we never see your card number.
• What you do in the app: the markets you follow, the outlooks you save, the alerts you create, and the share cards you publish.
• Notifications: a device push token, only if you allow notifications.
• Emails: with an account, Kunkafa sends account and billing emails (sign-in links, receipts, plan changes and the alerts you set up) and occasional product emails. You can stop the optional ones at any time from Account → Notifications or with the unsubscribe link in every email; opening a link from an email records that click on your account.
• Embedded videos: the walkthrough plays through YouTube’s privacy-enhanced player (youtube-nocookie.com), which stores nothing until you press play; from then on Google’s privacy policy applies to the player.
• Usage measurement (after the relevant consent): Page and screen performance and interactions covered by the website or app notice. Operational security and limited support diagnostics are described separately below.

1a. Connections, usage and security

These provisions apply when you connect an AI assistant or application to your Kunkafa account.

When you use an integration, we process your account identity, connection names, permissions, expiry and last-use times, active platform, usage counts and timestamps needed to enforce rolling allowances and avoid charging the same current summary twice. We also record limited session changes, revocations, denied requests and redacted operational errors to protect access and help resolve problems. These controls and usage notices work independently of website analytics. They are not advertising profiles. Verified API/MCP requests are recorded for 90 days with requested public market names, operation, connection reference, outcome, response size and server timing. We do not store AI chat prompts, credentials or prediction response contents in this request history. Requests rejected before account verification are not attached to a guessed identity. Completion records mean handoff to the network, not proof that a recipient read the response.

Personal tokens are shown once and retained as verification values. OAuth authorization state is protected on the server. Operational logs must not contain tokens, passwords, sign-in codes or private prediction contents. Limited app access and error diagnostics may include the app route, platform, language, error stage and timestamp; authenticated support records are associated with the signed-in account.

An assistant or application you authorize receives the information allowed by its connection. Its provider may retain or process what it receives under its own terms and privacy policy. Review those before connecting. Revoking access cannot recall copies already delivered. Public website and embedded-widget activity are kept separate from identifiable app journeys.

Read the connection security guide

2. What we do not collect

No advertising identifiers, no advertising cookies, no sale or sharing of personal data with advertisers, and no tracking across other sites.

3. Cookies and identifiers

The website stores your cookie choice and language as needed. Analytics identifiers are set only after you accept the cookie notice, which is required to use Kunkafa. App sign-in, security and preferences use their own necessary identifiers and device storage. When you start MCP browser authorization, a secure session cookie maintains that authorization interaction; it is not an advertising or analytics cookie. To withdraw, clear kunkafa.com's cookies in your browser and stop using Kunkafa, or delete your account in the app; Kunkafa cannot work without these cookies.

4. Who processes data for us

• Google Firebase (authentication, database, analytics, performance and crash reporting)
• Stripe (payments and billing)
• Expo (push notification delivery)
• Google Workspace (sending our emails)
• YouTube (the walkthrough player, privacy-enhanced mode)

5. How long we keep it

Account information is retained while the account exists. Account deletion removes owned data through the deletion process; it is not a promise of instant removal from every system. Billing and other legally required records may need to be retained. Minimal security records may remain to prevent revoked access or deleted data from being restored. Analytics retention follows the relevant service configuration. Information already shared with another recipient cannot be recalled by deleting your account.

For integrations, disclosure accounting covers a rolling maximum of 30 days, with short-lived request controls. API tokens expire no later than 90 days after creation. An MCP (OAuth) connection expires after 90 days without use and no later than one year after approval; its refresh access also expires after 30 days of inactivity. Expired credentials are removed by scheduled cleanup. Operational integration records are scheduled for deletion after 90 days, and support diagnostics after 30 days. Expiring revocation records can remain for up to 90 days after revocation, or until the replaced connection's one-year limit, to stop old access being restored. Expiry blocks access independently of asynchronous storage cleanup.

6. Your rights

You can ask to see, correct or delete your personal data, or object to how we use it. Write to contact@kunkafa.com. Where the law where you live gives you further rights, they apply.

7. Children

The Service is not for anyone under 18.

8. Changes

The date at the top is the date of the current version. We change this page when what we collect changes.